Patent ID: 11943209
Assignee: HUAWEI TECHNOLOGIES CO., LTD.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 33:
34. A network device for rekeying a security association (SA) in a network system comprising a first network device and a second network device, an Internet Key Exchange (IKE) and an Internet Protocol Security (IPSec) tunnel are established between the first network device and the second network device, wherein the network device is configured as the second network device and comprises a receiving module, a sending module, and a rekey module; wherein:
the receiving module is configured to receive a first rekey request from the first network device for rekeying a SA, wherein the first rekey request carries a first Security Parameter Index (SPI) and does not carry a cryptographic suite associated with the first network in the case of that there is no change in a cryptographic suite associated with the first network device;
the sending module is configured to sending a first rekey response to the first network device, wherein the first rekey response carries a second SPI and does not carry a cryptographic suite associated with the second network device in the case of there is no change in a cryptographic suite associated with the second network device; and
the rekey module is configured to rekey the SA according to the first SPI and the second SPI; wherein:
when the SA is an IPSec SA which is a child SA of an IKE SA, the first rekey request does not carry a Traffic Selector (TS) payload carrying flow information associated with the first network device; wherein the first rekey response does not carry a TS payload carrying flow information associated with the second network device; and
rekeying, by the first network device, the SA without changing the flow information associated with the first network device and the flow information associated with the second network device.