Dynamic rekeying of IPSec security associations
Certain embodiments described herein are relate to a method for dynamically rekeying a security association. The method includes establishing, by a destination tunnel endpoint (TEP), an in-bound security association with a source TEP, with a first security parameter index (SPI) value, for encrypting data packets communicated between the source TEP and the destination TEP. The method further includes rekeying, by the destination TEP, the in-bound security association, the rekeying including generating a second SPI value for replacing the first SPI value based on a trigger event relating to at least one of a real-time security score of the in-bound security association, a number of security associations assigned to a compute resource that the in-bound security resource is assigned to, an amount of load managed by the compute resource that the in-bound security resource is assigned to, and an indication received from an administrator.
1. A method for dynamically rekeying a security association, comprising:
establishing, by a destination tunnel endpoint (TEP), an in-bound security association with a source TEP, with a first security parameter index (SPI) value, for encrypting data packets communicated between the source TEP and the destination TEP;
rekeying, by the destination TEP, the in-bound security association, the rekeying including generating a second SPI value for replacing the first SPI value based on a trigger event relating to at least one of:
a real-time security score of the in-bound security association, wherein the real-time security score is based at least on a number of replay packets having the first SPI value that are received by the destination TEP or a number of times the destination TEP failed to decrypt encrypted packets including the first SPI value,
a number of security associations assigned to a compute resource that the in-bound security association is assigned to, or
a determination that the compute resource that the in-bound security association is assigned to has a highest amount of load of a plurality of compute resources;
receiving an encrypted packet from the source TEP, wherein the encrypted packet includes the second SPI value; and
processing, by the destination TEP, the encrypted packet based on the second SPI value.
2. The method of claim 1 , wherein the real-time security score is based further on:
an amount of time that has passed since the in-bound security association was established.
3. The method of claim 1 , wherein, prior to the rekeying:
the trigger event relates to the number of security associations assigned to the compute resource that the in-bound security association is assigned to being higher than a number of security associations assigned to an additional compute resource, and
the second SPI value is associated with the additional compute resource.
4. The method of claim 3 , wherein the trigger event relates to the number of security associations assigned to the compute resource that the in-bound security association is assigned to being higher than the number of security associations assigned to the other compute resource by at least two.
5. The method of claim 1 , wherein prior to the rekeying:
the trigger event relates to an amount of load managed by the compute resource that the in-bound security association is assigned to being higher than an amount of load managed by an additional compute resource at the destination TEP, and
the second SPI value is associated with the additional compute resource.
6. The method of claim 5 , wherein the trigger event relates to the amount of load managed by the compute resource that the in-bound security association is assigned to being higher than the amount of load managed by the other compute resource at the destination TEP by at least two times an amount of load associated with the in-bound security association prior to the rekeying.
7. The method of claim 1 , wherein the trigger event relates to the real-time security score of the in-bound security association.
8. The method of claim 1 , wherein the trigger event relates to at least one of:
the number of security associations assigned to the compute resource that the in-bound security association is assigned to, or
the determination that the compute resource that the in-bound security association is assigned to has the highest amount of load of the plurality of compute resources.
9. The method of claim 1 , wherein the trigger event relates to the number of security associations assigned to the compute resource that the in-bound security association is assigned to.
10. The method of claim 1 , wherein the trigger event relates to the determination that the compute resource that the in-bound security association is assigned to has the highest amount of load of the plurality of compute resources.
11. A computer system, comprising:
a memory comprising executable instructions; and
a processor in data communication with the memory and configured to execute the instructions to cause the computer system to:
establish, by a destination tunnel endpoint (TEP), an in-bound security association with a source TEP, with a first security parameter index (SPI) value, for encrypting data packets communicated between the source TEP and the destination TEP;
rekey, by the destination TEP, the in-bound security association, the rekeying including generating a second SPI value for replacing the first SPI value based on a trigger event relating to at least one of:
a real-time security score of the in-bound security association, wherein the real-time security score is based at least on a number of replay packets having the first SPI value that are received by the destination TEP or a number of times the destination TEP failed to decrypt encrypted packets including the first SPI value,
a number of security associations assigned to a compute resource that the in-bound security association is assigned to, or
a determination that the compute resource that the in-bound security association is assigned to has a highest amount of load of a plurality of compute resources;
receive an encrypted packet from the source TEP, wherein the encrypted packet includes the second SPI value; and
process, by the destination TEP, the encrypted packet based on the second SPI value.
12. The computer system of claim 11 , wherein the real-time security score is based further on:
an amount of time that has passed since the in-bound security association was established.
13. The computer system of claim 11 , wherein prior to the rekeying:
the trigger event relates to the number of security associations assigned to the compute resource that the in-bound security association is assigned to being higher than a number of security associations assigned to an additional compute resource, and
the second SPI value is associated with the additional compute resource.
14. The computer system of claim 13 , wherein the trigger event relates to the number of security associations assigned to the compute resource that the in-bound security association is assigned to being higher than the number of security associations assigned to the other compute resource by at least two.
15. The computer system of claim 11 , wherein prior to the rekeying:
the trigger event relates to an amount of load managed by the compute resource that the in-bound security association is assigned to being higher than an amount of load managed by an additional compute resource at the destination TEP, and
the second SPI value is associated with the additional compute resource.
16. The computer system of claim 15 , wherein the trigger event relates to the amount of load managed by the compute resource that the in-bound security association is assigned to being higher than the amount of load managed by the other compute resource at the destination TEP by at least two times an amount of load associated with the in-bound security association prior to the rekeying.
17. A non-transitory computer readable medium having instructions stored thereon that, when executed by a computer system, cause the computer system to perform a method comprising:
establishing, by a destination tunnel endpoint (TEP), an in-bound security association with a source TEP, with a first security parameter index (SPI) value, for encrypting data packets communicated between the source TEP and the destination TEP;
rekeying, by the destination TEP, the in-bound security association, the rekeying including generating a second SPI value for replacing the first SPI value based on a trigger event relating to at least one of:
a real-time security score of the in-bound security association, wherein the real-time security score is based at least on a number of replay packets having the first SPI value that are received by the destination TEP or a number of times the destination TEP failed to decrypt encrypted packets including the first SPI value,
a number of security associations assigned to a compute resource that the in-bound security association is assigned to, or
a determination that the compute resource that the in-bound security association is assigned to has a highest amount of load of a plurality of compute resources;
receiving an encrypted packet from the source TEP, wherein the encrypted packet includes the second SPI value; and
processing, by the destination TEP, the encrypted packet based on the second SPI value.
18. The non-transitory computer readable medium of claim 17 , wherein the real-time security score is based further on:
an amount of time that has passed since the in-bound security association was established.
19. The non-transitory computer readable medium of claim 17 , wherein, prior to the rekeying:
the trigger event relates to the number of security associations assigned to the compute resource that the in-bound security association is assigned to being higher than a number of security associations assigned to an additional compute resource, and
the second SPI value is associated with the additional compute resource.
20. The non-transitory computer readable medium of claim 19 , wherein the trigger event relates to the number of security associations assigned to the compute resource that the in-bound security association is assigned to being higher than the number of security associations assigned to the other compute resource by at least two.
21. The non-transitory computer readable medium of claim 17 , wherein prior to the rekeying:
the trigger event relates to an amount of load managed by the compute resource that the in-bound security association is assigned to being higher than an amount of load managed by an additional compute resource at the destination TEP, and
the second SPI value is associated with the additional compute resource.
22. The non-transitory computer readable medium of claim 21 , wherein the trigger event relates to the amount of load managed by the compute resource that the in-bound security association is assigned to being higher than the amount of load managed by the other compute resource at the destination TEP by at least two times an amount of load associated with the in-bound security association prior to the rekeying.
23. The non-transitory computer readable medium of claim 17 , wherein the trigger event relates to the real-time security score of the in-bound security association.
24. The non-transitory computer readable medium of claim 17 , wherein the trigger event relates to at least one of:
the number of security associations assigned to the compute resource that the in-bound security association is assigned to, or
the determination that the compute resource that the in-bound security association is assigned to has the highest amount of load of the plurality of compute resources.