Generating a secure key exchange authentication request using a security parameter index transform
Embodiments of the present disclosure provide systems and methods for generating a secure key exchange (SKE) Authentication Request using a Security Parameter Index (SPI) Transform to provide secure data transfer in a computing environment. A disclosed method comprises receiving an SKE SA Initialization Response message at a local key manager (LKM) executing on an initiator node to initiate a secure communication between an initiator channel on the initiator node and a responder channel on a responder node. The LKM creates an SPI based on an SPI Transform using an SA Index and SPI Transform values, and the LKM builds the SKE Authentication Request message, which comprises the SPI, a set of cryptographic keys, and a list of encryption algorithms supported by the initiator channel. The LKM sends the SKE Authentication Request message to the responder channel on the responder node using the initiator channel.
1. A method comprising:
receiving, from a responder channel on a responder node, a Secure Key Exchange (SKE) Security Association (SA) Initialization Response message at a local key manager (LKM) executing on an initiator node to initiate a secure communication between an initiator channel on the initiator node and the responder channel;
obtaining a selected Security Parameter Index (SPI) Transform, an SA Index, and SPI Transform values;
creating an SPI based on the SPI Transform using the SA Index and the SPI Transform values;
building an SKE Authentication Request message based on the SKE SA Initialization Response message and the SPI, wherein the SKE Authentication Request message comprises the SPI, a set of cryptographic keys, and a list of encryption algorithms; and
transmitting the SKE Authentication Request message from the LKM to the responder channel on the responder node using the initiator channel.
2. The method of claim 1 , wherein obtaining the SA Index and the SPI Transform values further comprises registering the initiator channel with the LKM executing on the initiator node, and wherein the initiator channel selects the SPI Transform and provides the SPI Transform values, and the LKM registers the selected SPI Transform and the SPI Transform values.
3. The method of claim 2 , further comprises using a random number generator to generate the SPI Transform values, at the initiator channel on the initiator node, wherein the SPI Transform values comprise a random SPI base, a random SPI shift, or a SPI mask.
4. The method of claim 1 , wherein obtaining the selected SPI Transform, the SA Index and the SPI Transform values further comprises sending, via the initiator channel, the SA Index as part of a Start LKM message to the LKM.
5. The method of claim 1 , further comprises creating, at the LKM executing on the initiator node, an SA between the initiator node and the responder node pair responsive to receiving an Start LKM message.
6. The method of claim 5 , wherein obtaining the selected SPI Transform, the SA Index and SPI Transform values, creating the SPI, and building the SKE SA Initialization Request message are performed responsive to receiving the Start LKM message.
7. The method of claim 1 , further comprises deriving the set of cryptographic keys, and building the list of encryption algorithms based on the Initialization Response message.
8. The method of claim 1 , further comprises performing state and verification checks of the received SKE SA Initialization Response message based on an SA between the initiator node and the responder node pair.
9. The method of claim 1 , wherein receiving the SKE SA Initialization Response message at the LKM executing on the initiator node further comprises receiving the SKE SA Initialization Response message from the responder channel on the responder node at the initiator channel, and transmitting the SKE Authentication Response message to the LKM with an SA Index message providing the SA Index by the initiator channel.
10. The method of claim 1 , wherein creating the SPI based on the SPI Transform using the SA Index and the SPI Transform values further comprises computing two or more transformations, each transformation comprising a combination of two or more of a SPI mask, a SPI shift, a generated random number, a transformation result, or a SPI base, and the SA Index.
11. A system, comprising:
a processor; and
a memory, wherein the memory includes a computer program product configured to perform operations for generating a secure key exchange (SKE) Authentication Request using a Security Parameter Index (SPI) Transform, the operations comprising:
receiving, from a responder channel on a responder node, a SKE SA Initialization Response message at a local key manager (LKM) executing on an initiator node to initiate a secure communication between an initiator channel on the initiator node and the responder channel;
obtaining, a selected SPI Transform, an SA Index, and Security Parameter Index (SPI) Transform values;
creating an SPI based on the SPI Transform using the SA Index and the SPI Transform value;
building an SKE Authentication Request message based on the SKE SA Initialization Response message and the SPI, wherein the SKE Authentication Request message comprises the SPI, a set of cryptographic keys, and a list of encryption algorithms; and
transmitting the SKE Authentication Request message from the LKM to the responder channel on the responder node using the initiator channel.
12. The system of claim 11 , wherein obtaining the selected SPI Transform, the SA Index and the SPI Transform values further comprises sending, via the initiator channel, the SA Index as part of a Start LKM message to the LKM on the initiator node.
13. The system of claim 11 , wherein creating the SPI based on the SPI Transform using the SA Index and the SPI Transform values further comprises computing two or more transformations, each transformation comprising a combination of two or more of a SPI mask, a SPI shift, a generated random number, a transformation result, or a SPI base, and the SA Index.
14. The system of claim 11 , wherein obtaining the SA Index and the SPI Transform values further comprises registering the initiator channel with the LKM executing on the initiator node, and wherein the initiator channel selects the SPI Transform and provides the SPI Transform values, and the LKM registers the selected SPI Transform and the SPI Transform values.
15. The system of claim 14 , further comprises using a random number generator to generate the SPI Transform values, at the initiator channel on the initiator node, wherein the SPI Transform values comprise a random SPI base, a random SPI shift, or a SPI mask.
16. A computer program product for generating a secure key exchange (SKE) Authentication Request using a Security Parameter Index (SPI) Transform, the computer program product comprising:
a computer-readable storage medium having computer-readable program code embodied therewith, the computer-readable program code executable by one or more computer processors to perform an operation comprising:
receiving, from the responder channel on a responder node, a SKE SA Initialization Response message at a local key manager (LKM) executing on an initiator node to initiate a secure communication between an initiator channel on the initiator node and the responder channel;
obtaining, a selected SPI Transform, an SA Index, and Security Parameter Index (SPI) Transform values;
creating an SPI based on the SPI Transform using the SA Index and the SPI Transform value;
building an SKE Authentication Request message based on the SKE SA Initialization Response message and the SPI, wherein the SKE Authentication Request message comprises the SPI, a set of cryptographic keys, and a list of encryption algorithms; and
transmitting the SKE Authentication Request message from the LKM to the responder channel on the responder node using the initiator channel.
17. The computer program product of claim 16 , wherein obtaining the selected SPI Transform, the SA Index and the SPI Transform values further comprises sending, via the initiator channel, the SA Index as part of a Start LKM message to the LKM on the initiator node.
18. The computer program product of claim 16 , wherein creating the SPI based on the SPI Transform using the SA Index and the SPI Transform values further comprises computing two or more transformations; wherein each transformation comprising a combination of two or more of a SPI mask, a SPI shift, a generated random number, a transformation result, or a SPI base, and the SA Index.
19. The computer program product of claim 16 , wherein obtaining the SA Index and the SPI Transform values further comprises registering the initiator channel with the LKM executing on the initiator node, and wherein the initiator channel selects the SPI Transform and provides the SPI Transform values, and the LKM registers the selected SPI Transform and the SPI Transform values.
20. The computer program product of claim 19 , further comprises using a random number generator to generate the SPI Transform values, at the initiator channel on the initiator node, wherein the SPI Transform values comprise a random SPI base, a random SPI shift, and a SPI mask.