Method and apparatus for avoiding double-encryption in site-to-site IPsec VPN connections
View Patent ↗A system and a method are described that reduce or eliminate inefficiencies caused by double encryption in network tunnel communications. In particular, a set of virtual tunnels may be established that require a lower level of encryption in comparison to a full-encryption tunnel. Upon determining that a session is end-to-end encrypted, the system and method described herein may assign the session to one of the virtual tunnels instead of the full-encryption tunnel. By intelligently assigning sessions to virtual tunnels when encryption has already been applied, double encryption may be avoided, which will improve throughput and decrease processor usage. However, in cases where a session is not end-to-end encrypted, the full-encryption tunnel may be utilized to ensure secure communications are maintained between gateways.
1. A method for efficiently managing secure communications using tunnels, comprising:
establishing a full encryption tunnel between a first gateway and a second gateway, wherein data packets are entirely encrypted by the first gateway before transmission through the full encryption tunnel to the second gateway;
establishing a first virtual tunnel between the first gateway and the second gateway, wherein data packets transmitted through the first virtual tunnel have a reduced level of encryption applied by the first gateway before transmission through the first virtual tunnel in comparison to the full encryption tunnel;
receiving, by the first gateway, a set of data packets from a first computing device located within a first network managed by the first gateway, wherein the data packets correspond to a session between the first computing device and a second computing device located in a second network managed by the second gateway;
determining whether the data packets in the session are encrypted; and
in response to determining that the data packets are encrypted, transmitting the data packets through the first virtual tunnel to the second computing device via the second gateway; and
in response to determining that the data packets are unencrypted, transmitting the data packets through the full-encryption tunnel to the second computing device via the second gateway.
2. The method of claim 1 , wherein determining whether the data packets are encrypted comprises:
analyzing the data packets using deep packet inspection (DPI) to classify the data packets as being associated with an application, a process, or a class of data; and
determining that the data packets are encrypted based on the classification.
3. The method of claim 1 , wherein determining whether the data packets are encrypted comprises:
analyzing a header of one or more of the data packets; and
determining that the data packets are encrypted based on metadata of the data packets within the header.
4. The method of claim 3 , wherein the metadata includes a flag that indicates the data packets are encrypted.
5. The method of claim 1 , further comprising:
establishing a second virtual tunnel between the first gateway and the second gateway, wherein data packets transmitted through the second virtual tunnel have a reduced level of encryption applied by the first gateway before transmission through the second virtual tunnel in comparison to the full encryption tunnel.
6. The method of claim 5 , wherein establishing the first and second virtual tunnels comprises assigning pairs of virtual security parameter indices (SPIs) to each of the first and second virtual tunnels.
7. The method of claim 5 , wherein the first gateway applies no additional encryption to the data packets transmitted through the first virtual tunnel and the first gateway applies encryption only to a subset of bytes of each of the data packets transmitted through the second virtual tunnel.
8. The method of claim 7 , wherein the subset of bytes includes a header of each data packet.
9. The method of claim 1 , wherein a controller separate from the first and second gateways determines whether the data packets of the session are encrypted.
10. The method of claim 1 , wherein one or more of the data packets in the session are sent through the full encryption tunnel until it is determined that the data packets in the session are encrypted, at which point subsequent data packets in the session are sent through the first virtual tunnel.
11. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors of a network device operating in a network system, cause the network device to:
establish a full encryption tunnel between a first gateway and a second gateway, wherein data packets are entirely encrypted by the first gateway before transmission through the full encryption tunnel to the second gateway;
establish a first virtual tunnel between the first gateway and the second gateway, wherein data packets transmitted through the first virtual tunnel have a reduced level of encryption applied by the first gateway before transmission through the first virtual tunnel in comparison to the full encryption tunnel;
process a set of data packets received from a first computing device located within a first network managed by the first gateway, wherein the data packets correspond to a session between the first computing device and a second computing device located in a second network managed by the second gateway;
determine whether the data packets in the session are encrypted; and
in response to determining that the data packets are encrypted, transmit the data packets through the first virtual tunnel to the second computing device via the second gateway; and
in response to determining that the data packets are unencrypted, transmitting the data packets through the full-encryption tunnel to the second computing device via the second gateway.
12. The non-transitory computer readable medium of claim 11 , wherein the instructions that determine whether the data packets are encrypted cause the network device to:
analyze the data packets using deep packet inspection (DPI) to classify the data packets as being associated with an application, a process, or a class of data; and
determine that the data packets are encrypted based on the classification.
13. The non-transitory computer readable medium of claim 11 , wherein the instructions that determine whether the data packets are encrypted cause the network device to:
analyze a header of one or more of the data packets; and
determine that the data packets are encrypted based on metadata of the data packets within the header.
14. The non-transitory computer readable medium of claim 13 , wherein the metadata includes a flag that indicates the data packets are encrypted.
15. The non-transitory computer readable medium of claim 11 , comprising further instructions which, when executed by the one or more hardware processors of the network device operating in a network system, cause the network device to:
establish a second virtual tunnel between the first gateway and the second gateway, wherein data packets transmitted through the second virtual tunnel have a reduced level of encryption applied by the first gateway before transmission through the second virtual tunnel in comparison to the full encryption tunnel.
16. The non-transitory computer readable medium of claim 15 , wherein the instructions that establish the first and second virtual tunnels cause the network device to:
assign pairs of virtual security parameter indices (SPIs) to each of the first and second virtual tunnels.
17. The non-transitory computer readable medium of claim 15 , wherein the first gateway applies no additional encryption to the data packets transmitted through the first virtual tunnel and the first gateway applies encryption only to a subset of bytes of each of the data packets transmitted through the second virtual tunnel.
18. The non-transitory computer readable medium of claim 17 , wherein the subset of bytes includes a header of each data packet.
19. The non-transitory computer readable medium of claim 11 , wherein a controller separate from the first and second gateways determines whether the data packets of the session are encrypted.
20. The non-transitory computer readable medium of claim 11 , wherein one or more of the data packets in the session are sent through the full encryption tunnel until it is determined that the data packets in the session are encrypted at which point subsequent data packets in the session are sent through the first virtual tunnel.
21. The non-transitory computer readable medium of claim 11 , comprising further instructions which, when executed by the one or more hardware processors of the network device operating in a network system, cause the network device to:
in response to determining that the data packets are unencrypted, transmit the data packets through the full-encryption tunnel to the second computing device via the second gateway.
22. A network device for efficiently managing secure communications using tunnels, comprising:
a hardware processor to:
establish a full encryption tunnel between a first gateway and a second gateway, wherein data packets are entirely encrypted by the first gateway before transmission through the full encryption tunnel to the second gateway, and
establish a first virtual tunnel between the first gateway and the second gateway, wherein data packets transmitted through the first virtual tunnel have a reduced level of encryption applied by the first gateway before transmission through the first virtual tunnel in comparison to the full encryption tunnel,
process a set of data packets received from a first computing device located within a first network managed by the first gateway, wherein the data packets correspond to a session between the first computing device and a second computing device located in a second network managed by the second gateway,
determine whether the data packets in the session are encrypted; and
in response to determining that the data packets are encrypted, transmit the data packets through the first virtual tunnel to the second computing device via the second gateway; and
in response to determining that the data packets are unencrypted, transmitting the data packets through the full-encryption tunnel to the second computing device via the second gateway.