Deterministic distribution of rekeying procedures for a scaling virtual private network (VPN)
A network device may determine that network traffic for a communication session between a first peer device and a second peer device is to be protected using a security protocol suite. The network device may establish, using one or more tunnels, multiple security associations that are to be used to securely provide the network traffic of the communication session over an unsecured medium. The network device may determine a rekey scheduling time for each security association, of the multiple security associations, based on a combination of configuration information and dynamic network device information. The network device may perform, at each rekey scheduling time, a rekeying procedure to rekey each security association of the multiple security associations.
1. A network device, comprising:
one or more memories; and
one or more processors to:
determine that network traffic for a communication session between a first peer device and a second peer device is to be protected using a security protocol suite,
where the network device is in a first network with the first peer device, and
where the network device is to provide the network traffic over an unsecured medium to another network device that is in a second network with the second peer device;
establish, with the other network device and by using one or more tunnels of a set of active tunnels, multiple security associations that are to be used to securely provide the network traffic of the communication session over the unsecured medium;
determine a rekey scheduling time for each security association, of the multiple security associations, based at least in part on an active tunnels count,
where the active tunnels count is included in one or more of configuration information or dynamic network device information, and
where the one or more processors, when determining the rekey scheduling time, are to:
determine, for a security association of the multiple security associations, a total rekey time by dividing the active tunnels count by a tunnel setup rate,
where the active tunnels count is included in the dynamic network device information, and
where the tunnel setup rate is included in the configuration information,
determine, for the security association of the multiple security associations, a total time until a rekeying procedure is to be performed by subtracting the total rekey time from a maximum security association duration,
where the maximum security association duration is included in the configuration information, and
determine, for the security association of the multiple security associations, the rekey scheduling time by adding the total time until a rekeying procedure is to be performed to a current time; and
perform, at each rekey scheduling time, a rekeying procedure to rekey each security association of the multiple security associations.
2. The network device of claim 1 ,
where the rekey scheduling time for each security association, of the multiple security associations, is part of a distribution of rekey scheduling times, and
where the distribution of rekey scheduling times has a standard deviation that is larger than a preset threshold standard deviation.
3. The network device of claim 1 , where the security protocol suite is an internet protocol security (IPsec) protocol suite, and where the multiple security associations include at least one of:
an internet key exchange (IKE) security association,
a first IPsec security association that is to be used to secure a first network traffic flow from the first peer device to the second peer device, or
a second IPsec security association that is to be used to secure a second network traffic flow from the second peer device to the first peer device.
4. The network device of claim 1 , where the one or more processors, when establishing the multiple security associations, are to:
establish, using a first tunnel of the one or more tunnels, a first security association of the multiple security associations,
where the first security association includes information that is to be used to secure packets associated with a first network traffic flow from the first peer device to the second peer device, and
establish, using the first tunnel one of the one or more tunnels, a second security association of the multiple security associations,
where the second security association includes information that is to be used to secure packets associated with a second network traffic flow from the second peer device to the first peer device.
5. The network device of claim 1 , where the one or more processors, when determining the rekey scheduling time, are to:
determine, for a security association of the multiple security associations, a first rekey scheduling time,
where the security association, of the multiple security associations, is part of a group of security associations that share the first rekey scheduling time,
determine that a number of tunnels used to support the group of security associations is greater than a number identified by the tunnel setup rate,
determine a second rekey scheduling time for the security association of the multiple security associations, and
use the second rekey scheduling time as a time period at which to perform a particular rekeying procedure.
6. The network device of claim 1 , where the one or more processors, when using the one or more tunnels to establish the multiple security associations, are to:
establish a pair of internet protocol security (IPsec) security associations of the multiple security associations; and
where the one or more processors, when performing the rekeying procedure, are to:
establish a new pair of IPsec security associations to be used for securing the network traffic associated with the communication session instead of the pair of IPsec security associations, and
determine a new rekey scheduling time for the new pair of IPsec security associations based on the configuration information and the dynamic network device information.
7. The network device of claim 1 , where the tunnel setup rate is a value that indicates a maximum number of tunnels that may be rekeyed by the network device during a particular time period.
8. The network device of claim 1 , where the active tunnels count is a value that indicates a total number of tunnels included in the set of active tunnels.
9. A non-transitory computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by one or more processors of a network device, cause the one or more processors to:
determine that network traffic for a communication session between a first peer device and a second peer device is to be protected using a security protocol suite;
establish, using one or more tunnels, multiple security associations that are to be used to securely provide the network traffic of the communication session over an unsecured medium,
the one or more tunnels being part of a set of active tunnels that support additional communication sessions;
determine a rekey scheduling time for each security association, of the multiple security associations, based at least in part on an active tunnels count, where the active tunnels count is included in one or more of configuration information or dynamic network device information, the active tunnels count indicating a total number of tunnels included in the set of active tunnels;
where the one or more processors, when determining the rekey scheduling time for each security association, are to:
determine, for a security association of the multiple security associations, a total rekey time by dividing the active tunnels count by a tunnel setup rate,
where the tunnel setup rate is included in the configuration information,
determine, for the security association of the multiple security associations, a total time until a rekeying procedure is to be performed by subtracting the total rekey time from a maximum security association duration,
where the maximum security association duration is included in the configuration information, and
determine, for the security association of the multiple security associations, a rekey scheduling time by adding the total time until a rekeying procedure is to be performed to a current time; and
perform, at each rekey scheduling time, a rekeying procedure to rekey each security association of the multiple security associations.
10. The non-transitory computer-readable medium of claim 9 , where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
determine the rekey scheduling time for each security association of the multiple security associations,
where the rekey scheduling time for each security association, of the multiple security associations, is part of a distribution of rekey scheduling times, where the distribution of rekey scheduling times has a standard deviation that is larger than a preset threshold standard deviation.
11. The non-transitory computer-readable medium of claim 9 , where the one or more processors are associated with a network device that is in a first network with the first peer device, and where the network device is to provide the network traffic over the unsecured medium to another network device that is in a second network with the second peer device.
12. The non-transitory computer-readable medium of claim 9 , where the one or more instructions, that cause the one or more processors to use the one or more tunnels to establish the multiple security associations, cause the one or more processors to:
establish an internet key exchange (IKE) security association of the multiple security associations; and
where the one or more instructions, that cause the one or more processors to perform the rekeying procedure for each security association of the multiple security associations, cause the one or more processors to:
establish a new IKE security association to be used for establishing a new tunnel that is to be used to protect the network traffic of the communication session, and
determine a new rekey scheduling time for the new IKE security association based on the configuration information and the dynamic network device information.
13. The non-transitory computer-readable medium of claim 9 , where the one or more instructions, that cause the one or more processors to use the one or more tunnels to establish the multiple security associations, cause the one or more processors to:
establish a pair of internet protocol security (IPsec) security associations of the multiple security associations; and
where the one or more instructions, that cause the one or more processors to perform the rekeying procedure for each security association of the multiple security associations, cause the one or more processors to:
establish a new pair of IPsec security associations to be used for securing the network traffic associated with the communication session, and
determine a new rekey scheduling time for the pair of IPsec security associations based on the configuration information and the dynamic network device information.
14. The non-transitory computer-readable medium of claim 9 , where the maximum security association duration is a value indicating a limit on a length of time that the security association is to be used before a rekeying procedure is to be performed.
15. A method, comprising:
determining, by a network device, that network traffic for a communication session between a first peer device and a second peer device is to be protected using a security protocol suite;
establishing, by the network device and by using one or more tunnels of a set of active tunnels, multiple security associations that are to be used to securely provide the network traffic of the communication session over an unsecured medium;
determining, by the network device, a rekey scheduling time for each security association, of the multiple security associations, based at least in part on an active tunnels count, where the active tunnels count is included in a combination of configuration information or dynamic network device information;
where determining the rekey scheduling time for each security association comprises:
determining, for a security association of the multiple security associations, a total rekey time by dividing the active tunnels count by a tunnel setup rate,
where the active tunnels count is included in the dynamic network device information, and
where the tunnel setup rate is included in the configuration information,
determining, for the security association of the multiple security associations, a total time until a rekeying procedure is to be performed by subtracting the total rekey time from a maximum security association duration,
where the maximum security association duration is included in the configuration information, and
determining, for the security association of the multiple security associations, the rekey scheduling time by adding the total time until a rekeying procedure is to be performed to a current time;
and
performing, by the network device and at each rekey scheduling time, a rekeying procedure to rekey each security association of the multiple security associations.
16. The method of claim 15 , where the one or more tunnels are part of a set of active tunnels that each supports multiple security associations, where the dynamic network device information includes the active tunnels count indicating a total number of active tunnels included in the set of active tunnels, and where the active tunnels count is greater than a threshold number of tunnels.
17. The method of claim 15 , where determining the rekey scheduling time for each security association comprises:
determining the rekey scheduling time for each security association of the multiple security associations,
where the rekey scheduling time for each security association, of the multiple security associations, is part of a distribution of rekey scheduling times, where the distribution of rekey scheduling times has a standard deviation that is larger than a preset threshold standard deviation.
18. The method of claim 15 , where the network device is in a first network with the first peer device, and where the network device is to provide the network traffic over the unsecured medium to another network device that is in a second network with the second peer device.
19. The method of claim 15 , where determining the rekey scheduling time comprises:
providing, for the security association of the multiple security associations, information indicating a current distribution of rekey scheduling times as input to a machine learning model that has been trained on historical data,
the machine learning model to output a particular rekey scheduling time for the security association of the multiple security associations.
20. The method of claim 15 , where using the one or more tunnels to establish the multiple security associations comprises:
establishing, using an internet key exchange (IKE) tunnel, an IKE security association of the multiple security associations; and
where performing the rekeying procedure comprises:
establishing a new IKE security association to be used for securing the network traffic associated with the communication session, and
determining a new rekey scheduling time for the new IKE security association based on the configuration information and the dynamic network device information.