US 11,888,982 B2
Rekeying a security association SA
Sandeep Kampati, Bangalore (IN); De Sheng, Shanghai (CN); Dharmanandana Reddy Pothula, Bangalore (IN); and Bharath Soma Satya Meduri, Bangalore (IN)
Assigned to HUAWEI TECHNOLOGIES CO., LTD., Shenzhen (CN)
Filed by HUAWEI TECHNOLOGIES CO., LTD., Guangdong (CN)
Filed on May 16, 2021, as Appl. No. 17/321,494.
Application 17/321,494 is a continuation of application No. PCT/CN2019/117878, filed on Nov. 13, 2019.
Claims priority of application No. 201831042965 (IN), filed on Nov. 15, 2018.
Prior Publication US 2021/0273799 A1, Sep. 2, 2021
Int. Cl. H04L 29/06 (2006.01); H04L 9/08 (2006.01); H04L 9/40 (2022.01)
CPC H04L 9/0891 (2013.01) [H04L 63/029 (2013.01); H04L 63/164 (2013.01)] 30 Claims
OG exemplary drawing
 
1. A method for rekeying a security association (SA) applied in a network system including a first network device and a second network device, wherein an Internet Key Exchange (IKE) tunnel and an Internet Protocol Security (IPSec) tunnel are established between the first network device and the second network device, the method comprising:
determining, by the first network device, whether there is a change in a cryptographic suite associated with the first network device;
sending, by the first network device, a first rekey request to the second network device for rekeying the SA when there is no change in the cryptographic suite associated with the first network device, wherein the first rekey request carries a first Security Parameter Index (SPI) and does not carry the cryptographic suite associated with the first network device;
receiving, by the first network device, a first rekey response from the second network device, wherein the first rekey response carries a second SPI and does not carry a cryptographic suite associated with the second network device when there is no change in the cryptographic suite associated with the second network device;
rekeying, by the first network device, the SA according to the first SPI and the second SPI when there is no change in the cryptographic suite associated with the first network device and there is no change in the cryptographic suite associated with the second network device.