Randomized SPI for distributed IPsec
A method and computer readable software for providing randomized Security Parameter Index (SPI) for distributed Internet Protocol security (IPsec) are disclosed. In one embodiment a method includes designating each IPsec node with a unique node identifier, the IPsec node; performing a hash function on a random SPI to provide a randomized SPI; and assigning the randomized SPI to an IPsec tunnel associated with an IPsec node.
1. A method for providing randomized Security Parameter Index (SPI) for distributed Internet Protocol security (IPsec) in a cellular telecommunications network, comprising:
designating each IPsec node with a unique node identifier, the IPsec node ID;
performing a hash function on a random SPI to provide a randomized SPI, wherein the random SPI is a generated number over SPI space, the random SPI having a length corresponding to a full space available for use by the SPI space, and wherein the hashing is performed using a known hash collision resistant algorithm;
assigning the randomized SPI to an IPsec tunnel associated with the each IPsec node,
splitting an IPsec subsystem into multiple IPsec virtual nodes, each a logical unit that will be associated with a set of IPsec tunnels, and
distributing tunnels associated with a subsystem among all the nodes;
wherein the randomized SPI is generated uniformly to ensure statistically uniform distribution of SPIs over IPsec nodes,
wherein a plurality of the IPsec nodes are eNodeB s in a Long Term Evolution (LTE) telecommunications network,
wherein the IPsec tunnels provide traffic security between the eNodeBs and an LTE core network; and
wherein the multiple IPsec virtual nodes are thereby configured to act in an active-active failover configuration in an LTE telecommunications network.
2. The method of claim 1 , further comprising assigning to a load balancer a node associated with the incoming IPsec packet, then forwarding the packet to the IPsec node.
3. A non-transitory computer-readable medium containing instructions for randomized Security Parameter Index (SPI) for distributed Internet Protocol security (IPsec), which, when executed, cause a system to perform steps comprising:
designating each IPsec node with a unique node identifier, the IPsec node;
performing a hash function on a random SPI to provide a randomized SPI wherein the random SPI is a generated number over SPI space, the random SPI having a length corresponding to a full space available for use by the SPI space, and wherein the hashing is performed using a known hash collision resistant algorithm;
assigning the randomized SPI to an IPsec tunnel associated with the each IPsec node;
splitting an IPsec subsystem into multiple IPsec virtual nodes, each a logical unit that will be associated with a set of IPsec tunnels, and
distributing tunnels associated with a subsystem among all the nodes;
wherein the randomized SPI is generated uniformly to ensure statistically uniform distribution of SPIs over IPsec nodes,
wherein a plurality of the IPsec nodes are eNodeB s in a Long Term Evolution (LTE) telecommunications network,
wherein the IPsec tunnels provide traffic security between the eNodeBs and an LTE core network; and
wherein the multiple IPsec virtual nodes are thereby configured to act in an active-active failover configuration in an LTE telecommunications network.
4. The computer-readable medium of claim 3 , further comprising instructions assigning to a load balancer a node associated with the incoming IPsec packet, then forwarding the packet to the IPsec node.