Randomized SPI for distributed IPsec

1. A method for providing randomized Security Parameter Index (SPI) for distributed Internet Protocol security (IPsec) in a cellular telecommunications network, comprising:

designating each IPsec node with a unique node identifier;

performing a hash function on a random SPI to provide a randomized SPI, wherein the random SPI is a generated number over SPI space, the random SPI having a length corresponding to a full space available for use by the SPI space, and wherein the hashing is performed using a hash collision resistant algorithm;

assigning the randomized SPI to an IPsec tunnel associated with the each IPsec node;

splitting an IPsec subsystem into multiple IPsec virtual nodes, each of the multiple IPsec virtual node being a logical unit that will be associated with a set of IPsec tunnels, and

distributing tunnels associated with the split IPsec subsystem among the multiple IPsec virtual nodes,

wherein the multiple IPsec virtual nodes are thereby configured to act in a failover configuration in a cellular telecommunications network.

2. The method of claim 1 , further comprising assigning to a load balancer an IPsec node associated with the incoming IPsec packet, then forwarding the packet to the assigned IPsec node.

3. The method of claim 1 , further comprising generating the randomized SPI uniformly for statistically uniform distribution of SPIs over IPsec nodes.

4. The method of claim 1 , wherein a plurality of the IPsec nodes are eNodeBs in a Long Term Evolution (LTE) telecommunications network, and wherein the IPsec tunnels provide traffic security between the eNodeBs and an LTE core network.

5. The method of claim 1 , further comprising using a modulo operation on the randomized SPI to designate the unique node identifier.

6. The method of claim 1 , further comprising, at an IPsec terminating node, assigning the randomized SPI to the IPsec tunnel associated with the each IPsec node.

7. The method of claim 1 , further comprising, at an IPsec terminating node, splitting the IPsec subsystem into multiple IPsec virtual nodes each associated with a set of IPsec tunnels with a random SPI generated using random numbers having lengths equal to the full space available for use by the SPI space.

8. The method of claim 1 , wherein a first IPsec terminating node and a second IPsec terminating node are nodes in a Long Term Evolution (LTE) telecommunications network.

9. A non-transitory computer-readable medium containing instructions for randomized Security Parameter Index (SPI) for distributed Internet Protocol security (IPsec), which, when executed, cause a system to perform steps comprising:

designating each IPsec node with a unique node identifier;

performing a hash function on a random SPI to provide a randomized SPI wherein the random SPI is a generated number over SPI space, the random SPI having a length corresponding to a full space available for use by the SPI space, and wherein the hashing is performed using a hash collision resistant algorithm;

assigning the randomized SPI to an IPsec tunnel associated with the each IPsec node;

splitting an IPsec subsystem into multiple IPsec virtual nodes, each of the multiple IPsec virtual node being a logical unit that will be associated with a set of IPsec tunnels, and

distributing tunnels associated with the split IPsec subsystem among the multiple IPsec virtual nodes,

wherein the multiple IPsec virtual nodes are thereby configured to act in a failover configuration in a cellular telecommunications network.

10. The computer-readable medium of claim 9 , the steps further comprising assigning to a load balancer a node associated with the incoming IPsec packet, then forwarding the packet to the IPsec node.

11. The computer-readable medium of claim 9 , wherein a plurality of the IPsec nodes are eNodeBs in a Long Term Evolution (LTE) telecommunications network, and wherein the IPsec tunnels provide traffic security between the eNodeBs and an LTE core network.

12. The computer-readable medium of claim 9 , the steps further comprising using a modulo operation on the randomized SPI to designate the unique node identifier.

13. The computer-readable medium of claim 9 , the steps further comprising generating the randomized SPI uniformly to ensure statistically uniform distribution of SPIs over IPsec nodes.