Simplifying IKE process in a gateway to enable datapath scaling using a two tier cache configuration

• US 9,473,298 B2
• Filed: 01/08/2015
• Issued: 10/18/2016
• Est. Priority Date: 08/15/2013
• Status: Active Grant

• Current Assignee: Blue Cedar Networks, Inc.
• Original Assignee: Blue Cedar Networks, Inc.
• Inventors: Wante, Kenneth J.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Zoubair, Noura
• Application Number:
  US14/592,711
• Publication Number:
  US 20150121076A1
• Time in Patent Office: 649 Days
• Field of Search: 713/171, 713/189, 713/192, 370/469
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 61/2517 using port numbers
• CPC Class Codes: H04L 61/2528 Translation at a proxy
• CPC Class Codes: H04L 61/2592 using tunnelling or encapsulation
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5061 Pools of addresses
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 76/12 Setup of transport tunnels

Abstract

Computational complexity, specifically, cryptographic operations, is removed from the IKE(Internet Key Exchange) process in a VPN gateway appliance, thereby enabling scaling of the number of datapaths that can be managed by a single IKE process. A two-tier cache configuration enables necessary cryptographic operations on packets in the gateway but does so without placing additional computational burdens on the IKE process. One cache containing security association data is local to the IPSec component of the datapath instance. The second cache is higher level and is populated by IKE with security association data upon completion of IKE Phase 2 negotiations. The local cache is searched first for security policy data and if found is used to encrypt/decrypt the data packet. If not found locally, the IKE centralized cache is searched and if found, the local cache is updated with the security association data.

Claims

1. A method of communicating through a virtual private network (VPN) tunnel between a first application (app) on a device and a Virtual Private Network (VPN) gateway having an Internet Key Exchange (IKE) which performs cryptographic operations on data packets comprising:

transmitting from the gateway a first range of ports to the first app, wherein the first app uses a port in the first port range as a source port for data transmission from the first app to the VPN gateway, wherein the first port range comprises a plurality of ports not included in a second port range transmitted to a second app having a same internally unique IP address as the first app;

receiving, at the VPN gateway, data packets from the first app; and

determining, at the VPN gateway, that the data transmission originated from the first app based on the source port;

searching a local cache in an IPSec component of a datapath for security associations for the data packet;

searching a security policy and security association cache for security associations for the data packet; and

performing cryptographic operations on the data packet using the security associations outside of the IKE process in the gateway.

2. A method as recited in claim 1 further comprising:

extracting the security parameter index from a header of the data packet.

3. A method as recited in claim 1 further comprising:

populating the security policy and security association cache in IKE with security association data negotiated by IKE during an IKE Phase 2 stage.

4. A method as recited in claim 1 further comprising:

updating the local cache with security association data when there is a miss in the local cache and a hit in the security policy and security association cache for security association data.

5. A method as recited in claim 1 further comprising:

determining whether a data packet is an IPSec data packet or a non-IPSec data packet.

6. A method as recited in claim 5 further comprising:

hashing the packet header to obtain a security parameter index if the packet is a non-IPSec data packet.

8. A method as recited in claim 1 wherein said searching of a security policy and security association cache is performed if there is a miss in searching of the local cache in the IPSec component of the datapath.

9. A method as recited in claim 1 wherein a subsequent data packet received by the gateway having a second security parameter index that is the same as the security parameter index of the first received data packet obtains security association data from the local cache and that is the same as security association data for the first received data packet.

7. A method as recited in claim l further comprising routing the data packet to a datapath in the gateway.