Secure association sharing in multi-source and multi-destination environments

Abstract

This disclosure describes techniques and mechanisms for providing initialization vector (IV) uniqueness and extending rekeying windows for network devices that perform secure association sharing in multi-source and multi-destination environments. The techniques may apply to existing hardware of the network devices. The techniques may enable the network devices to execute in a non-XPN mode and establish secure tunnels corresponding to secure association sessions. The techniques may utilize software to partition extra bits included in packet headers. The network devices may perform a process to update a loop count value utilizing a portion of the extra bits, thereby exponentially extending the rekeying windows. Further, by utilizing a portion of the extra bits, the system may ensure IV uniqueness for the secure association session between network devices in the multi-source and multi-destination environment.