Abstract: A method, system and storage medium wherein reachability information is exchanged over IPsec tunnels by means of a dynamic routing protocol, but instead of incorporating it into the normal routing table, it is incorporated into the IPsec data structures SPD and SAD by performing a set of steps.1 Thereby, disadvantages of prior art efforts to establish compatibility between IPsec and dynamic routing, for instance IIPtran (RFC 3884), are overcome in that compatibility is established without modifying the processing of datagrams by IPsec.2 This may be implemented by extending the routing daemon so that it supports inserting or removing entries in the SPD and SAD using the PF KEY API.3 Further embodiments feature cryptographically signing and filtering advertised reachability information, redistribution of reachability information between the dynamic routing in the base network and the overlay network, a new routing protocol tailored specifically to IPsec and load sharing over multiple IPsec tunnels.

Abstract: The invention relates to a method for incorporating data network reachability information into an SPD or SAD for instance, wherein the data network reachability information is received from other data processing apparatuses. SPD and SAD are data structures defined by the IPsec standard. The invention further relates to a corresponding system and storage medium.