Efficient security parameter index selection in virtual private networks

摘要

A solution is provided for manual configuration of SPIs without requiring time-consuming checks for overlapping allocations between multiple customers by utilizing a unique decryption process. In this process, the data available in the incoming encrypted packets is considered to uniquely identify the different traffic streams even with overlapping SPIs. The destination address, SPI, and source address parameters present in the outer header of received encrypted packets may be hashed to yield an index, which may be used for searching a security association database to uniquely identify the properties of the security association. Using this process, customer administrators can configure manual SPIs without concern for any overlap or duplication by other customer administrators.