Patent ID: 8892884

Claim:
A key engine unit for managing IPsec Security Associations in an IP network, comprising: a receiver configured to receive a PF_KEY message from a key management application in the IP network; a non-transitory storage medium configured to store Security Associations in a Security Association Database, the Security Association Database partitioned into discrete domains; a transmitter configured to send a response message to the key management application; one or more processing circuits, operatively connected to the receiver, transmitter, and non-transitory storage medium, the one or more processing circuits configured to: determine whether the received PF_KEY message contains a domain extension header, and, if so: use the domain extension header to identify a domain in the Security Association Database; apply instructions contained in the PF_KEY message to the identified domain; wherein the Security Association Database comprises a common domain; wherein the one or more processing circuits are configured to apply the instructions contained in the PF_KEY message to the common domain in response to the domain extension header being absent from the received PF_KEY message.