Optimized and scalable method of detecting dead internet key exchange (IKE) peers

1. A method of securing communications with a peer gateway, comprising:

establishing, at a local gateway, a first tunnel and a second tunnel with the peer gateway by engaging with the peer gateway in tunnel creation according to a security protocol, wherein establishing the first tunnel comprises setting a first tunnel ID for the first tunnel, and wherein establishing the second tunnel comprises setting a second tunnel ID for the second tunnel;

establishing, at the local gateway, one or more first security tunnels on the first tunnel and one or more second security tunnels on the second tunnel, wherein:

the one or more first security tunnels are associated with one or more first pairs of inbound-outbound security associations (SAs) with the peer gateway, the one or more first pairs of inbound-outbound SAs including one or more first inbound SAs, wherein each of the one or more first inbound SAs indicates the first tunnel ID, and

the one or more second security tunnels are associated with one or more second pairs of inbound-outbound SAs with the peer gateway, the one or more second pairs of inbound-outbound SAs including one or more second inbound SAs, wherein each of the one or more second inbound SAs indicates the second tunnel ID;

performing dead peer detection (DPD) for the first tunnel based on the one or more first inbound SAs indicating the first tunnel ID; and

performing DPD for the second tunnel based on the one or more second inbound SAs indicating the second tunnel ID.

2. The method of claim 1 , further comprising:

receiving an encrypted packet from the peer gateway, the encrypted packet including a security parameter index (SPI) value;

identifying an inbound SA from the one or more first inbound SAs based on the SPI value;

determining that the identified inbound SA indicates the first tunnel ID corresponding to the first tunnel;

based on determining that the identified inbound SA indicates the first tunnel ID corresponding to the first tunnel, examining a bit in a bitmap, the bit corresponding to a first array element in a timestamp array associated with the first tunnel, wherein:

the timestamp array comprises one or more array elements;

each of the one or more array elements corresponds to a different tunnel established between the local gateway and the peer gateway;

the first array element corresponds to the first tunnel;

determining whether to record a timestamp in the first array element based on whether the bit is set;

upon determining the bit is not set, recording the timestamp in the first array element, the timestamp indicating a time at which the encrypted packet was received; and

upon determining the bit is set, refraining from recording the timestamp in the first array element.

3. The method of claim 2 , wherein:

a DPD timer thread at the local gateway periodically examines the one or more array elements of the timestamp array; and

an examination of each of the one or more elements is used in determining whether to cause a notification to be transmitted to the peer gateway for checking whether the peer gateway is responsive.

4. The method of claim 3 , wherein:

the bit not being set indicates that the DPD timer thread has examined the first array element in a previous examination iteration; and

recording the timestamp in the first array element comprises setting the bit.

5. The method of claim 2 , wherein:

a DPD timer thread at the local gateway periodically examines the one or more array elements of the timestamp array;

wherein the bit being set indicates that the DPD timer thread has not examined the first array element in a previous examination iteration.

6. The method of claim 2 , wherein:

prior to examining the bit, placing the encrypted packet in a decryption queue for decryption using a decryption key indicated by the identified inbound SA.

7. The method of claim 1 , wherein each SA of the one or more first pairs of inbound-outbound SAs indicates the first tunnel ID, and wherein each SA of the one or more second pairs of inbound-outbound SAs indicates the second tunnel ID.

8. A computer system, comprising:

a memory comprising executable instructions; and

a processor in data communication with the memory and configured to execute the instructions to cause the computer system to perform a method, comprising:

establishing, at a local gateway, a first tunnel and a second tunnel with the peer gateway by engaging with the peer gateway in tunnel creation according to a security protocol, wherein establishing the first tunnel comprises setting a first tunnel ID for the first tunnel, and wherein establishing the second tunnel comprises setting a second tunnel ID for the second tunnel; and

establishing, at the local gateway, one or more first security tunnels on the first tunnel and one or more second security tunnels on the second tunnel, wherein:

the one or more first security tunnels are associated with one or more first pairs of inbound-outbound security associations (SAs) with the peer gateway, the one or more first pairs of inbound-outbound SAs including one or more first inbound SAs, wherein each of the one or more first inbound SAs indicates the first tunnel ID, and

the one or more second security tunnels are associated with one or more second pairs of inbound-outbound SAs with the peer gateway, the one or more second pairs of inbound-outbound SAs including one or more second inbound SAs, wherein each of the one or more second inbound SAs indicates the second tunnel ID;

performing dead peer detection (DPD) for the first tunnel based on the one or more first inbound SAs indicating the first tunnel ID; and

performing DPD for the second tunnel based on the one or more second inbound SAs indicating the second tunnel ID.

9. The computer system of claim 8 , wherein the method further comprises:

receiving an encrypted packet from the peer gateway, the encrypted packet including a security parameter index (SPI) value;

identifying an inbound SA from the one or more first inbound SAs based on the SPI value;

determining that the identified inbound SA indicates the first tunnel ID corresponding to the first tunnel;

based on determining that the identified inbound SA indicates the first tunnel ID corresponding to the first tunnel, examining a bit in a bitmap, the bit corresponding to a first array element in a timestamp array associated with the first tunnel, wherein:

the timestamp array comprises one or more array elements;

each of the one or more array elements corresponds to a different tunnel established between the local gateway and the peer gateway;

the first array element corresponds to the first tunnel;

determining whether to record a timestamp in the first array element based on whether the bit is set;

upon determining the bit is not set, recording the timestamp in the first array element, the timestamp indicating a time at which the encrypted packet was received; and

upon determining the bit is set, refraining from recording the timestamp in the first array element.

10. The computer system of claim 9 , wherein:

a DPD timer thread at the local gateway periodically examines the one or more array elements of the timestamp array; and

an examination of each of the one or more elements is used in determining whether to cause a notification to be transmitted to the peer gateway for checking whether the peer gateway is responsive.

11. The computer system of claim 10 , wherein:

the bit not being set indicates that the DPD timer thread has examined the first array element in a previous examination iteration; and

recording the timestamp in the first array element comprises setting the bit.

12. The computer system of claim 9 , wherein:

a DPD timer thread at the local gateway periodically examines the one or more array elements of the timestamp array;

wherein the bit being set indicates that the DPD timer thread has not examined the first array element in a previous examination iteration.

13. The computer system of claim 9 , wherein the method further comprises:

prior to examining the bit, placing the encrypted packet in a decryption queue for decryption using a decryption key indicated by the identified inbound SA.

14. The computer system of claim 8 , wherein each SA of the one or more first pairs of inbound-outbound SAs indicates the first tunnel ID, and wherein each SA of the one or more second pairs of inbound-outbound SAs indicates the second tunnel ID.

15. A non-transitory computer readable medium having instructions stored thereon that, when executed by a computer system, cause the computer system to perform a method comprising:

establishing, at a local gateway, a first tunnel and a second tunnel with the peer gateway by engaging with the peer gateway in tunnel creation according to a security protocol, wherein establishing the first tunnel comprises setting a first tunnel ID for the first tunnel, and wherein establishing the second tunnel comprises setting a second tunnel ID for the second tunnel; and

establishing, at the local gateway, one or more first security tunnels on the first tunnel and one or more second security tunnels on the second tunnel, wherein:

the one or more first security tunnels are associated with one or more first pairs of inbound-outbound security associations (SAs) with the peer gateway, the one or more first pairs of inbound-outbound SAs including one or more first inbound SAs, wherein each of the one or more first inbound SAs indicates the first tunnel ID, and

the one or more second security tunnels are associated with one or more second pairs of inbound-outbound SAs with the peer gateway, the one or more second pairs of inbound-outbound SAs including one or more second inbound SAs, wherein each of the one or more second inbound SAs indicates the second tunnel ID;

performing dead peer detection (DPD) for the first tunnel based on the one or more first inbound SAs indicating the first tunnel ID; and

performing DPD for the second tunnel based on the one or more second inbound SAs indicating the second tunnel ID.

16. The non-transitory computer readable medium of claim 15 , wherein the method further comprises:

receiving an encrypted packet from the peer gateway, the encrypted packet including a security parameter index (SPI) value;

identifying an inbound SA from the one or more first inbound SAs based on the SPI value;

determining that the identified inbound SA indicates the first tunnel ID corresponding to the first tunnel;

based on determining that the identified inbound SA indicates the first tunnel ID corresponding to the first tunnel, examining a bit in a bitmap, the bit corresponding to a first array element in a timestamp array associated with the first tunnel, wherein:

the timestamp array comprises one or more array elements;

each of the one or more array elements corresponds to a different tunnel established between the local gateway and the peer gateway;

the first array element corresponds to the first tunnel;

determining whether to record a timestamp in the first array element based on whether the bit is set;

upon determining the bit is not set, recording the timestamp in the first array element, the timestamp indicating a time at which the encrypted packet was received; and

upon determining the bit is set, refraining from recording the timestamp in the first array element.

17. The non-transitory computer readable medium of claim 16 , wherein:

a DPD timer thread at the local gateway periodically examines the one or more array elements of the timestamp array; and

an examination of each of the one or more elements is used in determining whether to cause a notification to be transmitted to the peer gateway for checking whether the peer gateway is responsive.

18. The non-transitory computer readable medium of claim 17 , wherein:

the bit not being set indicates that the DPD timer thread has examined the first array element in a previous examination iteration; and

recording the timestamp in the first array element comprises setting the bit.

19. The non-transitory computer readable medium of claim 16 , wherein:

a DPD timer thread at the local gateway periodically examines the one or more array elements of the timestamp array;

wherein the bit being set indicates that the DPD timer thread has not examined the first array element in a previous examination iteration.

20. The non-transitory computer readable medium of claim 16 , wherein the method further comprises:

prior to examining the bit, placing the encrypted packet in a decryption queue for decryption using a decryption key indicated by the identified inbound SA.

21. The non-transitory computer readable medium of claim 15 , wherein each SA of the one or more first pairs of inbound-outbound SAs indicates the first tunnel ID, and wherein each SA of the one or more second pairs of inbound-outbound SAs indicates the second tunnel ID.