Methodology for Achieving Highly Scalable and Distributed Secured Connectivity per IPSEC Tunnel
Methods, systems and computer readable media are disclosed for providing scalable and secured connectivity per Internet Protocol Security (IPSEC) tunnel. In one embodiment a method includes spreading Encapsulating Security Payload (ESP) encryption for a same IPSEC tunnel across multiple backend application servers; and processing application flows using decrypted packets by embedding the Application Server instance-id in ESP and application packets for correlation with application packet flows.
1 . A method for providing scalable and secured connectivity per Internet Protocol Security (IPSEC) tunnel, comprising:
spreading Encapsulating Security Payload (ESP) encryption for a same IPSEC tunnel across multiple backend application servers; and
processing application flows using decrypted packets by embedding the Application Server instance-id in ESP and application packets for correlation with application packet flows.
2 . The method of claim 1 wherein spreading Encapsulating Security Payload (ESP) encryption for a same IPSEC tunnel across multiple backend application servers includes using multiple equal number of security associations (SAs) as a number of backend Applications servers.
3 . The method of claim 2 further comprising rekeying to add more sets of pair of security association scaling and to add more backend application servers.
4 . The method of claim 3 further comprising feeding Application-Data to the Application-server hosting the application flows for this application-data packet.
5 . The method of claim 4 wherein feeding Application-Data to the Application-server hosting the application flows includes embedding the server-instance-id in a TE-Id for GTPU packets.
6 . The method of claim 4 wherein feeding Application-Data to the Application-server hosting the application flows includes embedding the server-instance-id in a verification-tag for SCTP packets.
7 . The method of claim 1 further comprising using a load balancer to host sets of Virtual IP-address (VIP) to distribute the traffic to backend-servers.
8 . A system for providing scalable and secured connectivity per Internet Protocol Security (IPSEC) tunnel, comprising:
an IPSEC control element exchanging IPSEC signaling with a peer;
a traffic load balancer in communication with the IPSEC control element and receiving IPSEC ESP packets from the peer;
a plurality of Application servers in communication with the IPSEC control element and in communication with the load balancer;
wherein the system spreads Encapsulating Security Payload (ESP) encryption for a same IPSEC tunnel across the plurality of backend application servers; and
wherein the system processes application flows using decrypted packets by embedding the Application Server instance-id in ESP and application packets for correlation with application packet flows.
9 . The system of claim 8 wherein spread of Encapsulating Security Payload (ESP) encryption for a same IPSEC tunnel across the plurality of backend application servers includes using multiple equal number of security associations (SAs) as a number of backend Applications servers.
10 . The system of claim 9 further comprising rekeying to add more sets of pair of security association scaling and to add more backend application servers.
11 . The system of claim 10 further comprising feeding Application-Data to the Application-server hosting the application flows for this application-data packet.
12 . The system of claim 11 wherein feeding Application-Data to the Application-server hosting the application flows includes embedding the server-instance-id in a TE-Id for GTPU packets.
13 . The system of claim 11 wherein feeding Application-Data to the Application-server hosting the application flows includes embedding the server-instance-id in a verification-tag for SCTP packets.
14 . The system of claim 8 further comprising a load balancer used to host sets of Virtual IP-address (VIP) to distribute the traffic to backend-servers.
15 . A non-transitory computer-readable medium containing instructions for providing scalable and secured connectivity per Internet Protocol Security (IPSEC) tunnel which, when executed, cause the system to perform steps comprising:
spreading Encapsulating Security Payload (ESP) encryption for a same IPSEC tunnel across multiple backend application servers; and
processing application flows using decrypted packets by embedding the Application Server instance-id in ESP and application packets for correlation with application packet flows.
16 . The non-transitory computer-readable medium of claim 15 wherein instructions for spreading Encapsulating Security Payload (ESP) encryption for a same IPSEC tunnel across multiple backend application servers includes instructions for using multiple equal number of security associations (SAs) as a number of backend Applications servers.
17 . The non-transitory computer-readable medium of claim 16 further comprising instructions for rekeying to add more sets of pair of security association scaling and instructions for to add more backend application servers.
18 . The non-transitory computer-readable medium of claim 17 further comprising instructions for feeding Application-Data to the Application-server hosting the application flows for this application-data packet.
19 . The method of claim 18 wherein the instructions for feeding Application-Data to the Application-server hosting the application flows includes instructions for embedding the server-instance-id in a TE-Id for GTPU packets or wherein the feeding Application-Data to the Application-server hosting the application flows includes instructions for embedding the server-instance-id in a verification-tag for SCTP packets.
20 . The non-transitory computer-readable medium of claim 15 further comprising instructions for using a load balancer to host sets of Virtual IP-address (VIP) to distribute the traffic to backend-servers.