FAST RE-ESTABILISHMENT OF IKEV2 SECURITY ASSOCIATIONS FOR RECOVERY OF IPSEC GATEWAYS IN MOBILE NETWORK

摘要

IKEv2/IPsec has been widely deployed, such as in VPN and MIPv6, to support mutual authentication, access control and traffic protection in internet. IKEv2/IPsec gateways may maintain huge number of IKEv2/IPsec security associations. If gateway encounters failure or over-load, it will take a long time to reestablish security associations in another IKEv2/IPsec gateway. The major reason is that regular procedure of IKEv2 incurs long delay because of multiple signalling exchanges and complex computation especially in Diffie-Hellman exchange. In this paper, a new IKE SA re-establishment solution is proposed to reduce the overhead of computation and signalling by directly transferring IKE SA from old gateway to new gateway via independent IKE SA storage (stub bank). The most expensive Diffie-Hellman exchange and some of signalling can be avoided. Therefore, a huge amount of IKE/IPsec security associations can be reestablished in a short time. The applicability of this solution in mobile network is further analyzed as well.