US 11,943,209 B2
Rekeying a security association SA
Sandeep Kampati, Bangalore (IN); Bharath Soma Satya Meduri, Bangalore (IN); Dharmanandana Reddy Pothula, Bangalore (IN); and De Sheng, Shanghai (CN)
Assigned to HUAWEI TECHNOLOGIES CO., LTD., Shenzhen (CN)
Filed by HUAWEI TECHNOLOGIES CO., LTD., Guangdong (CN)
Filed on May 17, 2021, as Appl. No. 17/321,499.
Application 17/321,499 is a continuation of application No. PCT/CN2019/117884, filed on Nov. 13, 2019.
Claims priority of application No. 201831042955 (IN), filed on Nov. 15, 2018.
Prior Publication US 2021/0273928 A1, Sep. 2, 2021
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/061 (2013.01) [H04L 63/0245 (2013.01); H04L 63/029 (2013.01); H04L 63/0435 (2013.01)] 34 Claims
OG exemplary drawing
 
1. A method for rekeying a security association (SA) in a network system including a first network device and a second network device, comprising:
establishing an Internet Key Exchange (IKE) tunnel and an Internet Protocol Security (IPSec) tunnel between the first network device and the second network device; and
negotiating to rekey a SA by:
sending, by the first network device, a first rekey request to the second network device for rekeying a SA, wherein the first rekey request carries a first Security Parameter Index (SPI) and a cryptographic suite associated with the first network device;
receiving, by the first network device, a first rekey response from the second network device, wherein the first rekey response carries a second SPI and does not carry a cryptographic suite associated with the second network device when there is no change in a cryptographic suite associated with the second network device; and
wherein:
when the SA is an IPSec SA which is a child SA of an IKE SA, the first rekey request does not carry a Traffic Selector (TS) payload carrying flow information associated with the first network device when there is no change in a flow information associated with the first network device; wherein the first rekey response does not carry a TS payload associated with the second network device when there is no change in a flow information associated with the second network device; and
wherein rekeying, by the first network device, the SA without changing flow information associated with the SA.