Patent ID: 11943209
Assignee: HUAWEI TECHNOLOGIES CO., LTD.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 10:
11. A method for rekeying a security association (SA) applied in a network system including a first network device and a second network device, comprising:
establishing an Internet Key Exchange (IKE) tunnel and an Internet Protocol Security (IPSec) tunnel between the first network device and the second network device;
negotiating to rekey a SA by:
receiving, by the second network device, a first rekey request from the first network device for rekeying a SA, wherein the first rekey request carries a first Security Parameter Index (SPI) and a cryptographic suite associated with the first network device;
determining, by the second network device, whether there is change in a cryptographic suite associated with the second network device;
sending, by the second network device, a first rekey response to the first network device, wherein the first rekey response carries a second SPI and does not carry a cryptographic suite associated with the second network device when there is no change in the cryptographic suite associated with the second network device; and
wherein:
when the SA is an IPSec SA which is a child SA of an IKE SA, the first rekey request does not carry a Traffic Selector (TS) payload carrying flow information associated with the first network device when there is no change in a flow information associated with the first network device; wherein the first rekey response does not carry a TS payload associated with the second network device when there is no change in a flow information associated with the second network device; and
the SA is rekeyed without changing flow information associated with the SA.