Group member recovery techniques
Techniques are presented for optimizing secure communications in a network. A first router receives from a second router an encrypted packet with an unknown security association. The first router examines the packet to determine whether the counter value is in a range of predicted counter values. Additionally, a key server is configured to provision routers that are part of a virtual private network. The key server selects a counter value that is part of a security association and calculates a key value. The key server sends the key value together with the security association to enable routers to exchange encrypted packets with each other in the virtual private network using the key value and the security association. The key server increments the counter value to a value within a range of counter values capable of being predicted by the routers.
1. A method comprising:
at a first router in a network, receiving from a second router in the network an encrypted packet associated with a virtual private network that has a security association unknown to the first router in a header of the encrypted packet
determining a counter value associated with the security association;
determining whether the counter value is in a range of predicted counter values; and
determining whether the encrypted packet is associated with the virtual private network based at least in part on whether the counter value is within the range of predicted counter values.
2. The method of claim 1 , further comprising discarding the packet if the determining indicates that the counter value is not in the range of predicted counter values.
3. The method of claim 1 , further comprising:
if the determining indicates that the counter value is in the range of predicted counter values:
forwarding the packet in the network; and
sending to a key server configured to provision the first router and the second router a request for updated security information.
4. The method of claim 1 , further comprising if the determining indicates that the counter value is in the range of predicted counter values, discarding the packet.
5. The method of claim 1 , further comprising:
storing information of the security association in a database of counter values; and
examining the database to determine a number of previous packets received with the same security association information.
6. The method of claim 5 , further comprising:
if the number of previous packets is greater than a predetermined threshold:
forwarding the packet in the network; and
sending to a key server configured to provision the first router and the second router a request for updated security information.
7. The method of claim 5 , further comprising discarding the packet if the number of previous packets is less than or equal to a predetermined threshold.
8. The method of claim 1 , wherein determining comprises determining the counter value by decoding the security association.
9. The method of claim 1 , wherein the security association includes a Security Parameter Index (“SPI”) value.
10. An apparatus comprising:
a plurality of ports configured to send and receive messages in a network; and
a processor coupled to the ports, and configured to:
receive from a router in the network an encrypted packet associated with a virtual private network that has an unknown security association apparatus in a header of the encrypted packet;
determine a counter value associated with the security association;
determine whether the counter value is in a range of predicted counter values; and
determine whether the encrypted packet is associated with the virtual private network based at least in part on whether the counter value is within a range of predicted counter values.
11. The apparatus of claim 10 , wherein the processor is further configured to discard the packet if the counter value is not in the range of predicted counter values.
12. The apparatus of claim 10 , wherein the processor is further configured to:
forward the packet in the network if the counter value is in the range of the predicted counter values; and
generate a request to be sent to a key server, the request for updated security information if the counter value is in the range of predicted counter values.
13. The apparatus of claim 10 , wherein the processor is further configured to:
store information of the security association in a database of counter values; and
examine the database to determine a number of previous packets received with the same security association information.
14. The apparatus of claim 13 , wherein the processor is further configured to:
forward the packet in the network if the number of previous packets is greater than a predetermined threshold; and
generate a request to be sent to a key server, the request for updated security information if the number of previous packets is greater than a predetermined threshold.
15. The apparatus of claim 13 , wherein the processor is further configured to discard the packet if the number of previous packets is less than or equal to a predetermined threshold.
16. The apparatus of claim 10 , wherein the processor is further configured to determine the counter value by decoding the security association.
17. One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor in a first router, cause the processor to perform operations comprising:
receiving from a second router in the network an encrypted packet associated with a virtual private network that has a security association unknown to the first router in a header of the encrypted packet;
determining a counter value associated with the security association;
determining whether the counter value is in a range of predicted counter values; and
determining whether the encrypted packet is associated with the virtual private network based at least in part on the determination of whether the counter value is within a range of predicted counter values.
18. The non-transitory computer readable storage media of claim 17 , further comprising instructions that cause the processor to discard the packet if it is determined that the counter value is not in the range of predicted counter values.
19. The non-transitory computer readable storage media of claim 17 , further comprising instructions that cause the processor to:
if it is determined that the counter value is in the range of predicted counter values: forward the packet in the network; and
send to a key server configured to provision the first router and the second router a request for updated security information.
20. The non-transitory computer readable storage media of claim 17 , further comprising instructions that cause the processor to:
store information of the security association in a database of counter values; and
examine the database to determine a number of previous packets received with the same security association information.