Granted Patent B2

US 12,261,780 · App. 17/688,994 · Granted Mar 25, 2025

Inventors: Changhong Shen (Shanghai, CN); Chingsung Lin (Fremont, CA); Yubei Cao (Cupertino, CA); Sandy X. Chang (Palo Alto, CA)

Assignee: CISCO TECHNOLOGY, INC.

H04L47/225H04L47/27H04L47/34H04L63/0227

Abstract

Claims (81)

1. A network node comprising one or more processors and one or more computer-readable non-transitory storage media coupled to the one or more processors and including instructions that, when executed by the one or more processors, cause the network node to perform operations comprising:

receiving a packet associated with a session;

performing a sequence-based anti-replay check;

determining that the sequence-based anti-replay check rejected the packet;

performing a time-based anti-replay check;

performing a selective anti-replay check; and

determining whether to dynamically adjust a time-based anti-replay window size based on performing at least one of the following checks:

the sequence-based anti-replay check,

the time-based anti-replay check, and

the selective anti-replay check.

2. The network node of claim 1 , the operations further comprising:

determining that the packet was rejected by the time-based anti-replay check;

determining that the packet was accepted by the selective anti-replay check;

rejecting the packet; and

increasing the time-based anti-replay window size.

3. The network node of claim 1 , the operations further comprising:

determining that the packet was rejected by the selective anti-replay check;

rejecting the packet; and

decreasing the time-based anti-replay window size.

4. The network node of claim 1 , wherein performing the sequence-based anti-replay check comprises:

determining a sequence number associated with the packet;

rejecting the packet in the event the sequence number is less than a lowest sequence number in an anti-replay window; and

accepting the packet in the event the sequence number is greater than the lowest sequence number in the anti-replay window.

5. The network node of claim 1 , wherein performing the time-based anti-replay check comprises determining whether a time tick delay associated with the session is within a time-based anti-replay window.

6. The network node of claim 1 , wherein performing the selective anti-replay check comprises determining whether a quantity of duplicate packets received outside of an anti-replay window and within a predetermined amount of time exceeds a predetermined threshold.

7. The network node of claim 1 , wherein:

the network node is a software-defined wide area network (SD-WAN) edge router; and

the session is an Internet Protocol Security (IPSec) Security Associations (SA) session.

8. A method, comprising:

receiving, by a network node, a packet associated with a session;

performing, by the network node, a sequence-based anti-replay check;

determining, by the network node, that the sequence-based anti-replay check rejected the packet;

performing, by the network node, a time-based anti-replay check;

performing, by the network node, a selective anti-replay check; and

determining, by the network node, whether to dynamically adjust a time-based anti-replay window size based on performing at least one of the following checks:

the sequence-based anti-replay check,

the time-based anti-replay check, and

the selective anti-replay check.

9. The method of claim 8 , further comprising:

determining, by the network node, that the packet was rejected by the time-based anti-replay check;

determining, by the network node, that the packet was accepted by the selective anti-replay check;

rejecting, by the network node, the packet; and

increasing, by the network node, the time-based anti-replay window size.

10. The method of claim 8 , further comprising:

determining, by the network node, that the packet was rejected by the selective anti-replay check;

rejecting, by the network node, the packet; and

decreasing, by the network node, the time-based anti-replay window size.

11. The method of claim 8 , wherein performing the sequence-based anti-replay check comprises:

determining a sequence number associated with the packet;

rejecting the packet in the event the sequence number is less than a lowest sequence number in an anti-replay window; and

accepting the packet in the event the sequence number is greater than the lowest sequence number in the anti-replay window.

12. The method of claim 8 , wherein performing the time-based anti-replay check comprises determining whether a time tick delay associated with the session is within a time-based anti-replay window.

13. The method of claim 8 , wherein performing the selective anti-replay check comprises determining whether a quantity of duplicate packets received outside of an anti-replay window and within a predetermined amount of time exceeds a predetermined threshold.

14. The method of claim 8 , wherein:

the network node is a software-defined wide area network (SD-WAN) edge router; and

the session is an Internet Protocol Security (IPSec) Security Associations (SA) session.

15. One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause the processor to perform operations comprising:

receiving a packet associated with a session;

performing a sequence-based anti-replay check;

determining that the sequence-based anti-replay check rejected the packet;

performing a time-based anti-replay check;

performing a selective anti-replay check; and

determining whether to dynamically adjust a time-based anti-replay window size based on performing at least one of the following checks:

the sequence-based anti-replay check,

the time-based anti-replay check, and

the selective anti-replay check.

16. The one or more computer-readable non-transitory storage media of claim 15 , the operations further comprising:

determining that the packet was rejected by the time-based anti-replay check;

determining that the packet was accepted by the selective anti-replay check;

rejecting the packet; and

increasing the time-based anti-replay window size.

17. The one or more computer-readable non-transitory storage media of claim 15 , the operations further comprising:

determining that the packet was rejected by the selective anti-replay check;

rejecting the packet; and

decreasing the time-based anti-replay window size.

18. The one or more computer-readable non-transitory storage media of claim 15 , wherein performing the sequence-based anti-replay check comprises:

determining a sequence number associated with the packet;

rejecting the packet in the event the sequence number is less than a lowest sequence number in an anti-replay window; and

accepting the packet in the event the sequence number is greater than the lowest sequence number in the anti-replay window.

19. The one or more computer-readable non-transitory storage media of claim 15 , wherein performing the time-based anti-replay check comprises determining whether a time tick delay associated with the session is within a time-based anti-replay window.

20. The one or more computer-readable non-transitory storage media of claim 15 , wherein performing the selective anti-replay check comprises determining whether a quantity of duplicate packets received outside of an anti-replay window and within a predetermined amount of time exceeds a predetermined threshold.

Assignments (1)

Continuity (2)

References Cited (12)