I only heard this term today, but it was explained to me as a point-to-point VPN (so, two routers with a VPN tunnel established between them) and a firewall configured to only allow certain hosts to talk to certain other hosts (per their ip address); is this correct?
Do you think you're referring to an IPSEC Child Security Association (SA)? It's described by the specifications as a child and even has some related notification types.
To expand, Child SAs are created for policy-based IPSEC VPNs as a result of how they are implemented by routers. If you have the following configuration for a tunnel, two Child SAs are created within each router, and each SA has its own cryptographic state:
VPN VPN Router A ---------IPSEC------ Router B / \ | / \ | / \ | 192.0.2.0/24 198.51.100.0/24 203.0.113.0/24
Policy-Based VPN Child SAs (possible; won't always exist):
- 192.0.2.0/24 <-> 203.0.113.0/24
- 198.51.100.0/24 <-> 203.0.113.0/24
Fits the description, but not sure of the context of your question.