Patent ID: 11943209
Assignee: HUAWEI TECHNOLOGIES CO., LTD.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 31:
32. A network device operating as a first network device for rekeying a security association (SA) in a network system comprising the first network device and a second network device, the first network device the network device comprising computer instructions that when executed by a processor, cause the first network device to:
establish an Internet Key Exchange (IKE) and an Internet Protocol Security (IPSec) tunnel between the first network device and the second network device
send a first rekey request to the second network device for rekeying a SA, wherein the first rekey request carries a first Security Parameter Index (SPI) and does not carry a cryptographic suite associated with the first network in the case of that there is no change in a cryptographic suite associated with the first network device;
receive a first rekey response from the second network device, wherein the first rekey response carries a second SPI and does not carry a cryptographic suite associated with the second network device in the case of there is no change in a cryptographic suite associated with the second network device;
rekey the SA according to the first SPI and the second SPI, wherein:
when the SA is an IPSec SA which is a child SA of an IKE SA, the first rekey request does not carry a Traffic Selector (TS) payload carrying flow information associated with the first network device; wherein the first rekey response does not carry a TS payload carrying flow information associated with the second network device; and
rekeying, by the first network device, the SA without changing the flow information associated with the first network device and the flow information associated with the second network device.