Methods and systems for internet key exchange re-authentication optimization
A method for Internet Key Exchange (IKE) re-authentication optimization includes sending, by a first network device and a second network device, a notification, which contains new Security Parameters Index (SPI) for new security association (SA), and sending, by the first network device alone, an OLD_SPI notification to map SPI of Internet Protocol Security (IPsec) (Authentication Header (AH)/Encapsulating Security Payload (ESP)) with the old IPSec SA.
1. A method, comprising:
sending, by a first network device and to a second network device, an initial reauthentication request message when a time for an initial authentication associated with the first network device expires and when a first cryptographic suite associated with the first network device is not changed, wherein the initial reauthentication request message comprises a first notification message carrying a first security parameters index (SPI) value;
receiving, by the first network device, from the second network device, and in response to sending the initial reauthentication request message, an initial reauthentication response message, wherein the initial reauthentication response message carries a second notification message, and wherein the second notification message carries a second SPI value; and
reauthenticating, by the first network device and according to the first SPI value and the second SPI value, a security association associated with the first network device when the first cryptographic suite and a second cryptographic suite associated with the second network device are not changed, wherein the first cryptographic suite is the same as the second cryptographic suite.
2. The method of claim 1 , further comprising establishing an Internet Key Exchange (IKE) tunnel and an Internet Protocol Security (IPSec) tunnel between the first network device and the second network device.
3. The method of claim 1 , wherein either the first notification message or the second notification message indicates that the security association is not changed.
4. The method of claim 1 , wherein the security association comprises either a first Internet Key Exchange (IKE) security association or a first Internet Protocol Security (IPSec) security association.
5. The method of claim 4 , further comprising:
deleting the first IKE security association and creating a second IKE security association when the security association is the first IKE security association, wherein a first SPI is an initiator SPI deployed as an initiator cookie for the second IKE security association, and wherein a second SPI is deployed as a responder cookie for the second IKE security association; and
deleting the first IPSec security association and creating a second IPSec security association when the security association is the first IPSec security association, wherein the first IPSec security association is a child security association of the first IKE security association, wherein the first SPI is deployed as a first inbound SPI in the first network device for the second IPSec security association and is deployed as a second outbound SPI in the second network device for the second IPSec security association, and wherein the second SPI is deployed as a second inbound SPI in the second network device for the second IPSec security association and is deployed as a first outbound SPI in the first network device for the second IPSec security association.
6. The method of claim 1 , further comprising:
sending, to the second network device, a reauthentication request message comprising a first authentication notification payload when a security association payload and a traffic selector payload are not changed; and
receiving, from the second network device, a reauthentication response message comprising a second authentication notification payload when the second cryptographic suite is not changed.
7. The method of claim 6 , wherein either the first authentication notification payload or the second authentication notification payload indicates that the security association payload and the traffic selector payload are not changed.
8. The method of claim 6 , wherein the reauthentication request message further comprises a first SPI notification message comprising a first SPI to identify a first Internet Key Exchange (IKE) security association or a first Internet Protocol Security (IPSec) security association at the first network device.
9. The method of claim 8 , wherein the reauthentication request message instructs the second network device to identify a first IKE security association using the first SPI notification message to identify the security association on the second network device.
10. The method of claim 6 , further comprising:
creating, using a create child security association exchange message, a first Internet Protocol Security (IPSec) security association that is a first child security association of an Internet Key Exchange (IKE) security association; and
deleting, using the create child security association exchange message, a second IPSec security association,
wherein a first SPI is deployed as a first inbound SPI in the first network device for the first IPSec security association and is deployed as a first outbound SPI in the first network device for the first IPSec security association,
wherein a second SPI is deployed to identify the second IPSec security association that is a second inbound SPI of a second security association and is a second outbound SPI of the second security association in the second network device, and
wherein a third SPI is deployed as a third inbound SPI in the second network device for the first IPSec security association and is deployed as a third outbound SPI in the first network device for the first IPSec security association.
11. A method, comprising:
sending, by a first network device and to a second network device, a reauthentication request message when a time for an initial authentication associated with the first network device expires and when a first cryptographic suite associated with the first network device is not changed, wherein the reauthentication request message comprises a first security parameters index (SPI) value, and wherein the reauthentication request message is encrypted by first Internet Key Exchange (IKE) security association keys comprising a security association, a keying payload, a nonce, a certificate, a certificate request, an optional identity response, an initiator payload, an authentication payload, traffic selectors of initiators and responders, or an Internet Protocol Security (IPSec) security association payload;
receiving, by the first network device, from the second network device, and in response to sending the reauthentication request message, a reauthentication response message encrypted by the first IKE security association keys, wherein the reauthentication response message comprises a second SPI value; and
reauthenticating, by the first network device and according to the reauthentication request message comprising the first SPI value and the reauthentication response message comprising the second SPI value, the security association associated with the first network device when there is no change in the first cryptographic suite associated with the first network device and in a second cryptographic suite associated with the second network device, wherein the first cryptographic suite is the same as the second cryptographic suite.
12. The method of claim 11 , further comprising establishing an IKE tunnel and an IPSec tunnel between the first network device and the second network device.
13. The method of claim 11 , further comprising:
deleting a first IKE security association and creating a second IKE security association when the security association is the first IKE security association, wherein a first SPI is an initiator SPI deployed as an initiator cookie for the second IKE security association, and wherein a second SPI is deployed as a responder cookie for the second IKE security association; and
deleting a first IPSec security association and creating a second IPSec security association when the security association is the first IPSec security association, wherein the first IPSec security association is a child security association of the first IKE security association, wherein the first SPI is deployed as a first inbound SPI in the first network device for the second IPSec security association and is deployed as a second outbound SPI in the second network device for the second IPSec security association, and wherein the second SPI is deployed as a second inbound SPI in the second network device for the second IPSec security association and is deployed as a first outbound SPI in the first network device for the second IPSec security association.
14. The method of claim 11 , wherein the security association comprises an IKE security association or an IPSec security association.
15. A first network device comprising:
a memory configured to store instructions; and
at least one processor coupled to the memory and configured to execute the instructions to cause the first network device to:
send, to a second network device coupled to the first network device, an initial reauthentication request message when a time for an initial authentication associated with the first network device expires and when a first cryptographic suite associated with the first network device is not changed, wherein the initial reauthentication request message comprises a first notification message carrying a first security parameters index (SPI) value;
receive, from the second network device and in response to sending the initial reauthentication request message, an initial reauthentication response message, wherein the initial reauthentication response message carries a second notification message, and wherein the second notification message carries a second SPI value; and
reauthenticate, according to the first SPI value and the second SPI value, a first security association associated with the first network device when the first cryptographic suite and a second cryptographic suite associated with the second network device are not changed, wherein the first cryptographic suite is the same as the second cryptographic suite.
16. The first network device of claim 15 , wherein either the first notification message or the second notification message indicates that the first security association is not changed.
17. The first network device of claim 15 , wherein the first security association comprises a first Internet Key Exchange (IKE) security association or a first Internet Protocol Security (IPSec) security association.
18. The first network device of claim 17 , wherein the at least one processor is further configured to execute the instructions to cause the first network device to:
delete the first IKE security association and create a second IKE security association when the first security association is the first IKE security association, wherein a first SPI is an initiator SPI deployed as an initiator cookie for the second IKE security association, and wherein a second SPI is deployed as a responder cookie for the second IKE security association; and
delete the first IPSec security association and create a second IPSec security association when the first security association is the first IPSec security association, wherein the first IPSec security association is a child SA of the first IKE security association, wherein the first SPI is deployed as a first inbound SPI in the first network device for the second IPSec security association and is deployed as a second outbound SPI in the second network device for the second IPSec security association, and wherein the second SPI is deployed as a second inbound SPI in the second network device for the second IPSec security association and is deployed as a first outbound SPI in the first network device for the second IPSec security association.
19. The first network device of claim 15 , wherein the at least one processor is further configured to execute the instructions to cause the first network device to:
send, to the second network device, a reauthentication request message comprising a first authentication notification payload when a security association payload and a traffic selector payload are not changed; and
receive, from the second network device, a reauthentication response message comprising a second authentication notification payload when the second cryptographic suite is not changed.
20. The first network device of claim 19 , wherein either the first authentication notification payload or the second authentication notification payload indicates that the first security association and the traffic selector payload are not changed.
21. The first network device of claim 19 , wherein the reauthentication request message further comprises a third notification message comprising an SPI to identify an Internet Key Exchange (IKE) security association or an Internet Protocol Security (IPSec) security association at the first network device.
22. The first network device of claim 19 , wherein the at least one processor is further configured to execute the instructions to cause the first network device to:
create, using a create child security association exchange message, a first Internet Protocol Security (IPSec) security association that is a child security association of an Internet Key Exchange (IKE) security association; and
delete, using the create child security association exchange message, a second IPSec security association,
wherein a first SPI is deployed as a first inbound SPI in the first network device for the first IPSec security association and is deployed as a first outbound SPI in the first network device for the first IPSec security association,
wherein a second SPI is deployed to identify the second IPSec security association that is a second inbound SPI of a second security association and is a second outbound SPI of the second security association in the second network device, and
wherein a third SPI is deployed as a third inbound SPI in the second network device for the first IPSec security association and is deployed as a third outbound SPI in the first network device for the first IPSec security association.
23. A first network device comprising:
a memory configured to store instructions; and
at least one processor coupled to the memory and configured to execute the instructions to cause the first network device to:
send, to a second network device coupled to the first network device, a reauthentication request message when a time for an initial authentication associated with the first network device expires and when a first cryptographic suite associated with the first network device is not changed, wherein the reauthentication request message comprises a first security parameters index (SPI) value, and wherein the reauthentication request message is encrypted by Internet Key Exchange (IKE) security association keys of a security association, a keying payload, a nonce, a certificate, a certificate request, an optional identity response, an initiator identity payload, an authentication payload, traffic selectors of initiators and responders, or an Internet Protocol Security (IPSec) payload;
receive, from the second network device and in response to sending the reauthentication request message, a reauthentication response message encrypted by the IKE security association keys, wherein the reauthentication response message comprises a second SPI value; and
reauthenticate, according to the reauthentication request message comprising the first SPI value and the reauthentication response message comprising the second SPI value, the security association associated with the first network device when the first cryptographic suite and a second cryptographic suite associated with the second network device are not changed, wherein the first cryptographic suite is the same as the second cryptographic suite.
24. The first network device of claim 23 , wherein the at least one processor is further configured to execute the instructions to cause the first network device to:
delete a first IKE security association and create a second IKE security association when the security association is the first IKE security association, wherein a first SPI is an initiator SPI deployed as an initiator cookie for the second IKE security association, and wherein a second SPI is deployed as a responder cookie for the second IKE security association; and
delete a first IPSec security association and create a second IPSec security association when the security association is the first IPSec security association, wherein the first IPSec security association is a child SA of the first IKE security association, wherein the first SPI is deployed as a first inbound SPI in the first network device for the second IPSec security association and is deployed as a second outbound SPI in the second network device for the second IPSec security association, and wherein the second SPI is deployed as a second inbound SPI in the second network device for the second IPSec security association and is deployed as a first outbound SPI in the first network device for the second IPSec security association.
25. The first network device of claim 23 , wherein the security association comprises an IKE security association or an IPSec security association.