Method, system and apparatus for data encryption

Abstract

Techniques and mechanisms to reduce double-encryption of packets transmitted using an encrypted tunnel. The techniques described herein include determining that a portion of a packet is already encrypted, identifying a non-encrypted portion of the packet, and selectively encrypting the non-encrypted portion of the packet prior to transmission over the encrypted tunnel. In this way, potentially private or sensitive data of the packet (e.g., information in a packet header) that is not encrypted can be encrypted using an encryption protocol of the encrypted tunnel, but encrypted data of the packet (e.g., a payload) can be spared unnecessary double-encryption. By reducing (or eliminating) the amount of data of the packet that is double-encrypted, the time taken by a computing device to encrypt traffic of the encrypted tunnel can be reduced, and computing resources consumed can be reduced.

Description

[0001] Cross-reference to related applications

[0002] This application claims priority to U.S. Patent Application No. 17 / 002,170, filed August 25, 2020, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This disclosure generally relates to encrypting packets for transmission over encrypted tunnels such as Virtual Private Networks (VPNs). More specifically, these techniques involve optionally encrypting packets transmitted over encrypted tunnels. Background Technology

[0004] For various reasons, users of computing devices often expect to transmit various types of information across networks. For example, users of computing devices use networks to browse websites, access online services or applications, remotely access VPNs, and so on. While performing these types of activities is certainly desirable, many networks used for transmitting information are public networks, such as the Internet. These public networks are often insecure environments where the privacy of user data communications may be compromised.

[0005] To protect the confidentiality and privacy of data transmitted across networks by users of computing devices, data is typically encrypted during transmission to obfuscate it and prevent potentially malicious entities from obtaining it. For example, VPNs use a process called "tunneling" to extend a private network over a public network (e.g., the internet). The tunneling process involves encrypting the data before it is sent by the sending device, obfuscating the encrypted data as it is transmitted over the network, and then decrypting it at the receiving device at the VPN location to take action on the data.

[0006] Encrypted tunnels, such as VPN tunnels, have become widespread and offer numerous uses and advantages. However, the process of encrypting data for transmission through a tunnel is time-consuming and computationally intensive. Furthermore, some types of data packets transmitted through an encrypted tunnel may already be encrypted according to the protocol used to create the data packets to be transmitted. Therefore, encrypting data packets for transmission through an encrypted tunnel when they are already encrypted can be redundant. Attached Figure Description

[0007] The following is a detailed description with reference to the accompanying drawings. In the drawings, the leftmost number(s) of the reference numerals identify the figure in which the reference numeral first appears. The same reference numerals are used in different figures to indicate similar or identical items. The systems depicted in the drawings are not drawn to scale, and the components in the drawings may be depicted as not being drawn to scale with each other.

[0008] Figure 1A The system architecture diagram illustrates an environment in which a client device establishes an encrypted connection with a headend device. The client device determines that packets will be transmitted to the headend device via an encrypted tunnel, determines that the first part of the packet is encrypted, and encrypts the second part of the packet according to the encryption protocol of the encrypted tunnel.

[0009] Figure 1B The system architecture diagram illustrates an environment in which a client device sends encrypted packets to a headend device. The headend device determines that the first part is encrypted using an initial encryption protocol, and the second part is encrypted using an encryption tunnel's encryption protocol. The headend device then decrypts the second part using the encryption protocol and decrypts the first part using the initial encryption protocol.

[0010] Figure 2 An example of a data packet is shown, which is encrypted using an initial encryption protocol and then encrypted again using an encryption protocol associated with the encryption tunnel to generate an encryption tunnel data packet.

[0011] Figure 3 A flowchart of an example method for a first device is shown, which determines that a first portion of a packet is encrypted and a second portion of the packet is unencrypted, encrypts the second portion of the packet using an encryption protocol of an encryption tunnel, and sends the packet over the network and via the encryption tunnel to a second device.

[0012] Figure 4 A flowchart of an example method for a first device is shown, which is used to receive a packet sent via an encrypted tunnel from a second device, determine that a first portion of the packet is encrypted using a first encryption protocol, and a second portion of the packet is encrypted using a second encryption protocol of the encrypted tunnel, and decrypt the packet according to the two encryption protocols.

[0013] Figure 5 This is a computer architecture diagram that illustrates the computer hardware architecture used to implement server devices, which can be used to implement aspects of the various technologies presented in this article. Detailed Implementation

[0014] Overview

[0015] Various aspects of the invention are set forth in the independent claims, and preferred features are set forth in the dependent claims. A feature of one aspect may be applied to any aspect alone or in combination with other aspects.

[0016] This disclosure generally relates to encrypting packets for transmission over encrypted tunnels, such as Virtual Private Network (VPN) networks. More specifically, these techniques involve selectively encrypting portions of packets transmitted over encrypted tunnels, thereby at least partially avoiding double encryption of the packets.

[0017] A method of implementing the techniques described herein may include creating an encrypted tunnel between a first device and a second device over a network to transmit encrypted data over the network, and determining whether to send packets over the network to the second device within the encrypted tunnel. Furthermore, these techniques include determining that a first portion of the packets is encrypted, and determining that a second portion of the packets is not encrypted. Additionally, these techniques include encrypting the second portion of the packets using an encryption protocol associated with the encrypted tunnel, and using the encrypted tunnel to send the packets over the network to the second device.

[0018] Another method of implementing the techniques described herein may include creating an encrypted tunnel with a source device over a network to transmit encrypted data over the network, and receiving packets sent from the source device over the encrypted tunnel. Furthermore, the method may include determining that a first portion of the packet is encrypted using a first encryption protocol associated with the encrypted tunnel, and decrypting the first portion of the packet according to the first encryption protocol. Additionally, the method may include determining that a second portion of the packet is encrypted using a second encryption protocol, and decrypting the second portion of the packet according to the second encryption protocol.

[0019] Furthermore, the techniques described herein can be executed by a system and / or device having a non-transitory computer-readable medium storing computer-executable instructions that, when executed by one or more processors, perform the methods described above.

[0020] Example Implementation

[0021] Encrypted tunneling has become widespread in society, and users of devices frequently use it to securely transmit data across various types of insecure networks, such as the internet, for a variety of reasons. A common use of encrypted tunneling is in VPNs, where traffic is encrypted by the device within a private network and transmitted over the internet to various destinations, ensuring the security of encrypted data even when transmitted over insecure networks. Encrypted tunneling allows users to perform numerous activities that enable them to work remotely from their offices, such as: privately browsing the internet, accessing private or sensitive data stored in another location (e.g., bank account information, health information, etc.), and accessing confidential business information stored on their employer's private network.

[0022] As mentioned above, encrypted tunnels have become necessities in our daily lives, and their applications continue to expand and diversify. However, the encryption protocols used to encrypt data in these tunnels are very time-consuming and require significant computational resources from the device and any offloading hardware chips. Therefore, avoiding data encryption where possible may be advantageous, but encryption should still be used when necessary to protect private data.

[0023] In some cases, data to be transmitted through an encrypted tunnel may already be encrypted using another encryption protocol, such as data packets encrypted according to Hypertext Transfer Secure (HTTPS) or Secure Shell (SSH) protocols. However, the encryption protocol used for the encrypted tunnel may re-encrypt all packets, even though these packets have already been encrypted using another protocol and are therefore obfuscated to unauthorized parties. This double encryption of packets is disadvantageous because unnecessarily re-encrypting already encrypted data introduces unnecessary time delays and computational resource consumption. Therefore, when these data packets are already encrypted, it is advantageous to avoid re-encrypting data packets to be sent through an encrypted tunnel.

[0024] To address this issue, computing devices could attempt to implement split tunneling, where VPN users can route traffic from a specific application or device through an encrypted VPN tunnel, while traffic from other applications or devices can be transmitted through an unencrypted tunnel or even via the default Shortest Path First (SPF) routing protocol. However, encrypted traffic (e.g., HTTPS, SSH, etc.) still exposes some information about the data packets within the stream hidden by the encrypted tunnel; for example, the destination address of the traffic is visible in the body of the encrypted packets (e.g., part of a Transmission Control Protocol (TCP) data stream or a Quick UDP Internet Connection (QUIC) data stream). Therefore, simply routing encrypted traffic (e.g., HTTPS, SSH, etc.) through an unencrypted tunnel might expose private or sensitive information about the data stream, but routing encrypted traffic through an encrypted tunnel would result in double encryption of the packets, which is time-consuming and CPU-intensive.

[0025] This disclosure describes techniques and mechanisms for reducing double encryption of packets transmitted using an encrypted tunnel. These techniques include determining that portions of a packet are already encrypted, identifying unencrypted portions of the packet, and selectively encrypting the unencrypted portions of the packet for transmission over the encrypted tunnel. In this way, potentially private or sensitive data in unencrypted packets (e.g., information in the packet header) is encrypted using the encryption protocol of the encrypted tunnel, but data in already encrypted packets (e.g., the payload) may not be double-encrypted. By reducing or eliminating the amount of double-encrypted data in data packets, the time spent and computational resources consumed in encrypted traffic over the encrypted tunnel can be reduced.

[0026] According to the techniques described herein, a computing device can establish an encrypted connection with another computing device for transmitting encrypted traffic back and forth over one or more networks, which can be public or insecure networks, such as the Internet. In some cases, the device can be a client device that establishes an encrypted tunnel with a headend device using an encryption protocol, such as a VPN. The client device may be running one or more applications that attempt to communicate with the headend device using various types of traffic. In some examples, the application (or other program) may simply want to use the encrypted tunnel to transmit unencrypted traffic (e.g., HTTP traffic), which is unencrypted, so that all data is encrypted using the encryption protocol of the encrypted tunnel.

[0027] However, in some cases, applications or programs running on client devices may wish to use communication protocols that encrypt data (e.g., HTTPS, SSH, etc.) to transmit data streams. When a VPN client (or a detection program managing an encrypted tunnel) receives encrypted data packets but intends to transmit them through the VPN tunnel, the VPN client can determine that at least a portion of the data packets in the stream are encrypted. For example, the detection program can determine, based on the packet header, that the packet is associated with a specific type of protocol—HTTPS, SSH, or another protocol that encrypts the data in the packet. In some cases, the detection program can analyze the packets and identify the encrypted and unencrypted portions of the packets.

[0028] The detection program can determine the size of the unencrypted portion of a packet, such as the number of bytes. For example, if the packet's payload is encrypted and the packet's header is not, the detection program can determine how many bytes in the header are unencrypted. The detection program can determine the size of the unencrypted portion based solely on a predefined format for the packet type (e.g., HTTPS headers have a predefined size). The detection program can identify the unencrypted portion of the packet, and client devices (e.g., VPN proxies or other programs) can selectively encrypt the unencrypted portion of the packet using the encryption protocol of the encrypted tunnel, while avoiding encryption of the already encrypted portion of the packet. The packet can then be transmitted through the encrypted tunnel, thus obfuscating private data and preventing it from being detected by unauthorized parties, but reducing the double encryption of the packet's data.

[0029] In some cases, the encryption protocol of an encrypted tunnel can encrypt only the unencrypted portion of a packet. However, in other cases, the encryption protocol can encrypt data blocks based on a predefined block size. In such cases, instead of padding or adding nonce data to the packet, the VPN client can encrypt enough data blocks to encrypt the unencrypted data, and because the block size is a multiple of the total size of the unencrypted data, a relatively small portion of the encrypted data may also be encrypted using the tunneling protocol of the encrypted tunnel.

[0030] While the techniques described herein pertain to establishing encrypted tunnels between client and headend devices, these techniques are equally applicable to one or more devices of any type that utilize encrypted tunnels in any way. Furthermore, these techniques are generally compatible with any type of tunneling protocol, such as Internet Protocol Security (IPsec), WireGuard, Point-to-Point Tunneling Protocol (PPTP), OpenVPN, SSTP, Internet Key Exchange version 1 (IKEv1), IKEv2, and / or any other encrypted tunneling protocol. Additionally, these techniques are applicable to any type of data that can be at least partially encrypted before being transmitted through an encrypted tunnel, such as HTTPS, SSH, and / or any other communication protocol.

[0031] Specific embodiments and implementations of this disclosure will now be described more fully below with reference to the accompanying drawings, in which various aspects are illustrated. However, these aspects may be implemented in many different forms and should not be construed as limiting oneself to the embodiments set forth herein. As stated herein, this disclosure covers variations of the embodiments. Similar numerals always refer to similar elements.

[0032] Figure 1AA system architecture diagram of environment 100 is shown, in which client device 106 establishes an encrypted connection with headend device 108. Client device 106 determines that packets will be transmitted to headend device 108 via an encrypted tunnel, determines that the first part of the packets is encrypted, and encrypts the second part of the packets according to the encryption protocol of the encrypted tunnel.

[0033] In some examples, client device 106 may communicate with headend device 108 to access backend services or applications managed by service network 102. Service network 102 may typically include, manage, or otherwise associate with one or more applications or services used by users of client device 106. Service network 102 may provide any type of application or service for use by users of client device 106. However, in other cases, headend device 108 may be associated with any type of computing device and used for any purpose.

[0034] In some examples, environment 100 may include a service network 102, which includes devices located in or within one or more data centers 104. Service network 102 may include one or more networks implemented using any feasible communication technology, such as wired and / or wireless methods and / or technologies. Service network 102 may include any combination of: Personal Area Network (PAN), Local Area Network (LAN), Campus Network (CAN), Metropolitan Area Network (MAN), Extranet, Intranet, Internet, Short-Range Wireless Communication Network (e.g., ZigBee, Bluetooth, etc.), Wide Area Network (WAN) (centralized and / or distributed) and / or any combination, arrangement, and / or aggregation thereof. Service network 102 may include devices, virtual resources, or other nodes that relay packets from one network segment to another via nodes in a computer network. Service network 102 may include multiple devices that utilize the network layer (and / or session layer, transport layer, etc.) in the OSI model for packet forwarding and / or utilize other layers.

[0035] One or more data centers 104 may be physical facilities or buildings spanning a geographical area, designated for storing networked devices as part of service network 102. Data center 104 may include a variety of networked devices, as well as redundant or backup components and infrastructure for power, data communication connectivity, environmental control, and various security devices. In some examples, data center 104 may include one or more virtual data centers, which are pools or collections of cloud infrastructure resources specifically designed for enterprise needs and / or cloud-based service provider needs. Typically, data center 104 (physical and / or virtual) can provide basic resources such as processors (CPU), memory (RAM), storage devices (disks), and networks (bandwidth). However, in some examples, devices in packet forwarding network 102 may not be located in the explicitly defined data center 104, but may be located in other locations or buildings.

[0036] In some cases, client device 106 may expect or request access to application 114 hosted on servers 112A, 112B through 112N (where “N” is any integer). Application 114 may include any type of application 114, such as a web-based application, a service managed by a cloud service provider, data storage or services for an enterprise network, and / or any other type of application 114.

[0037] Client device 106 and headend device 108 can establish a communication connection through one or more networks 110. Networks 110 may include any feasible communication technology, such as wired and / or wireless methods and / or technologies. Network 126 may include any combination of the following: Personal Area Network (PAN), Local Area Network (LAN), Campus Network (CAN), Metropolitan Area Network (MAN), Extranet, Intranet, Internet, Short-range Wireless Communication Network (e.g., ZigBee, Bluetooth, etc.), Wide Area Network (WAN) (centralized and / or distributed) and / or any combination, arrangement, and / or aggregation thereof. Client device 106 and headend device 108 can communicate through network 110 using any type of protocol (e.g., Transmission Control Protocol / Internet Protocol (TCP / IP) for managing connections to and over the Internet).

[0038] However, client device 106 and headend device 108 can establish an encrypted tunnel 116 at "1" through network 110 to send and receive encrypted data through network 110. The encrypted tunnel 116 can be established by, for example, a VPN client running on the client device and / or headend device 108. The encrypted tunnel 116 can be established using any type of tunneling protocol, such as (but not limited to) Internet Protocol Security (IPsec), WireGuard, Point-to-Point Tunneling Protocol (PPTP), OpenVPN, SSTP, Internet Key Exchange version 2 (IKEv2), and / or any other encrypted tunneling protocol. In this way, data can be encrypted using the encryption protocol of the encrypted tunnel 116 before being sent by client device 106 and / or headend device 108 through network 110. The encrypted tunnel 116 can be established between client device 106 and headend device 108 using any handshake or establishment technique known in the art.

[0039] At point “2”, client device 106 can determine that packet 118 with the encrypted first portion 120 will be sent through the encrypted tunnel. For example, an application or program running on client device 106 can expect to transmit data through encrypted tunnel 116, and the application or program can be configured to transmit data using HTTPS, SSH, and / or any other secure / encrypted communication protocol.

[0040] In some examples, one or more detection programs can be used to determine whether packet 118 has a first portion 120 encrypted with an initial encryption protocol. For example, the detection program could be a Network-Based Application Recognition (NBAR) type program, which may include features for protocol discovery. Protocol discovery provides a simple method to discover application protocol packets 118 transmitted through the interfaces of client device 106 and headend device 108. The NBAR program can perform protocol discovery on packet 118 and classify packet 118 as a specific protocol. Protocol discovery can be enabled on the tunnel interface and the physical interface on which the tunnel interface is configured, and packets 118 designated to the tunnel interface can be counted on both interfaces. On the physical interface, packets 118 can be classified and counted based on encapsulation, and on the tunnel interface, packets 118 can be classified and counted based on protocol (e.g., Layer 7 protocol).

[0041] In some cases, the determination that packet 118 has a first portion 120 encrypted with an initial encryption protocol can be performed by inferring the protocol based on the packet's port. For example, a detection program can identify data packet 118 with a destination port of 443, which is typically used for HTTPS, and determine that packet 118 uses an encryption protocol that at least protects the body of packet 118 like HTTPS. As another example, a detection program can determine that packet 118 has a destination port of 22, which is typically used for SSH, and determine that packet 118 uses an encryption protocol that at least protects the body of packet 118 like SSH.

[0042] Typically, Part 120 can be encrypted using any initial encryption protocol, such as Secure Sockets Layer (SSL), Transport Layer Security (TLS), Datagram Transport Layer Security (DTLS), and / or any other encryption protocol. Therefore, Part 120 can be encrypted according to any encryption protocol used for a particular communication protocol (e.g., HTTP over TLS, HTTP over SSL, etc.).

[0043] Therefore, at “2”, the detection program running on client device 106 can determine that packet 118 has a first portion 120 that has been encrypted with the initial encryption protocol based on the protocol type and / or through shallow packet processing (e.g., NBAR). For example, the detection program can determine that the first portion 120 has been encrypted based on the processing of packet 118. In another example, the detection program can simply determine that the protocol type of packet 118 is such that the first portion 120 of packet 118 is encrypted (e.g., HTTPS, SSH, etc.). In some cases, the first portion 120 of packet 118 may include at least the body and / or payload of packet 118. Therefore, the detection program can analyze packet 118 and detect that the first portion 120 of the packet is encrypted with the initial encryption protocol, and / or can determine the protocol type of packet 118 and infer or determine that the first portion 120 of packet 118 is encrypted (e.g., SSH encrypts a predefined size or portion of packet 118, HTTPS encrypts a predefined size or portion of packet 118, etc.).

[0044] In some cases, in order to determine the size of the encrypted first portion 120 of data packet 118, the creator of packet 118 may actively identify the size of the encrypted first portion 120 using, for example, an additional IP options header, a Differential Service Code Point (DSCP) tag or value and / or another technique, such that the client device 106 can identify the tag or value to determine the size of the first portion 120.

[0045] At point “3”, the detection program running on client device 106 can identify the unencrypted second portion 122 of the packet. For example, the detection program can determine that the second portion 122 of packet 118 (e.g., the header of packet 118) is not encrypted. In some cases, protocols such as SSH, HTTPS, etc., can encrypt the body or payload of packet 118 (e.g., the first portion 120), but may not encrypt the header, which includes the destination address, source address, and / or other fields. However, packet 118 encrypted using an encryption protocol (e.g., Internet Protocol (IP) version 4, IPv6, etc.) may not have an encrypted header and / or other portions (e.g., the second portion 122). Therefore, client device 106 can determine that the second portion 122 of packet 118 is unencrypted based on the protocol type used to encrypt the first portion 120 of packet 118, based on the processing of packet 118, and / or in any other way.

[0046] At point “4”, client device 106 may use an encryption tunneling protocol (e.g., IPsec, WireGuard, PPTP, OpenVPN, SSTP, IKEv2, etc.) for establishing encryption tunnel 116 to encrypt the second portion 122 of the packet. However, client device 106 (e.g., a VPN gateway and / or any other program associated with encryption tunnel 116) may avoid encrypting the already encrypted first portion 120, or at least avoid encrypting most of the first portion 120. In this way, the unencrypted second portion 122 can be encrypted using the encryption tunneling protocol to obfuscate information that may be sensitive or private data, at least in the header of packet 118. However, instead of simply encrypting the entire packet 118 and thus doubly encrypting the first portion 120, doubly encrypting the first portion 120 (or most of the first portion 120) is avoided to reduce the time and computational power required to encrypt packet 118. In this way, packet 118 is encrypted except for the potential overlay header, such that the information in packet 118 is hidden when transmitted through network 110.

[0047] In some cases, client device 106 can determine the size of the second part 122 and ensure that the second part 122 is encrypted using the encrypted tunnel 116 protocol. For example, a detection program can analyze packet 118 and determine the size of the second part 122 (e.g., number of bytes), and / or determine or infer the size of the second part 122 based on the packet's protocol type and / or standard (e.g., IP packets have headers of a predefined size, HTTPS / SSH packets have headers of a predefined size, etc.). In some cases, the encryption protocol can encrypt data blocks of the second part 122 according to a predefined block size. In such cases, instead of padding or adding random number data to packet 118, the VPN client can encrypt enough data blocks to encrypt the unencrypted data of the second part 122, and because the block size is a multiple of the total size of the unencrypted data, a relatively small portion of the first part 120 may also be encrypted using the tunneling protocol of encrypted tunnel 116.

[0048] In some cases, the overlay technique used to transmit packet 118 can be extended to indicate how much of packet 118 is selected for encryption, such as the size of the second part 122. For example, the tunneling protocol used for the encryption tunnel 116 can have additional fields in the overlay header that indicate the number of bytes of packet 118 (starting from byte 0 in the header) that have been encrypted. In this way, the headend device 108 can determine the number of bytes of packet 118 in the second part 122 that has been encrypted using the encryption tunneling protocol based on the values ​​included in the fields of the overlay header. Therefore, the client device 106 can insert a value or marker in the fields of the overlay header of packet 118 that indicates to the headend device 108 the number of bytes or the size of packet 118 that has been encrypted using the encryption tunnel 116. At “5”, the client device 106 can use the encryption tunnel 116 to send packet 118 to the headend device 108 over network 110.

[0049] Figure 1B A system architecture diagram of environment 100 is shown, in which client device 106 sends encrypted packets 118 to headend device 108, and headend device 108 determines that a first portion 120 is encrypted using an initial encryption protocol, and a second portion 122 is encrypted using the encryption protocol of encryption tunnel 116. Headend device 106 then decrypts the second portion 122 using the encryption protocol and decrypts the first portion 120 using the initial encryption protocol.

[0050] At "6", the headend device 108 can receive packet 118 from the client device 106 via network 110 in encrypted tunnel 116. At "7", the headend device 108 can determine that packet 118 has been partially encrypted using the encrypted tunnel 116 protocol. For example, the headend device 108 can identify a value or marker from an additional field covering the header indicating the number of encrypted bytes in packet 118 (starting from byte 0 in the header). In this way, the headend device 108 can determine the number of bytes in the second part 122 of packet 118 that has been encrypted using the encrypted tunnel protocol based on the values ​​included in the fields covering the header.

[0051] At position "8", headend device 108 can decrypt the second portion 122 of data packet 118 encrypted using the encryption tunneling protocol of encryption tunnel 116. For example, headend device 108 can determine the size of the second portion 122 of packet 118 encrypted using the encryption tunneling protocol from the header of packet 118, and encrypt the second portion 122 using the encryption tunneling protocol of encryption tunnel 116.

[0052] At position "9", headend device 108 can provide packet 118 to one or more destination devices indicated by the destination address in the packet 118 header (and / or forward packet 118 to the next hop in the path), such as one or more servers 112. Packet 118 can be partially decrypted because the first part 120 of packet 118 can still be encrypted using the initial encryption protocol (e.g., TLS, DTLS, SSL, etc.).

[0053] At "10", application 114 can use an initial encryption protocol such as TLS, DTLS, or SSL to decrypt the first part 120 of packet 118. Then, application 114 is able to analyze the payload of data packet 118 and take appropriate action based on the content of packet 118.

[0054] Figure 2 An example environment 200 is shown, which includes data packets that are encrypted using an initial encryption protocol and then encrypted using an encryption protocol associated with the encryption tunnel to generate encryption tunnel data packets.

[0055] As shown in the figure, the raw data packet 202 may include: a payload, a TCP header, one or more extended headers, and an internal IP header. In the illustrative example, the raw data packet 202 may have a first encrypted portion 206 encrypted using an initial encryption protocol (e.g., SSL, TSL, DTSL, etc.). The raw data packet 202 can then be encapsulated to create a tunnel data packet 204.

[0056] The original data packet 202 can be encapsulated to create a tunnel data packet 204. The tunnel data packet 204 can, in some cases, be an IPsec packet. As shown, the tunnel data packet 204 may include an Encapsulating Security Payload (ESP) tail and an ESP authorizer, and may also include an ESP header, an extended header, and an external IP header. As shown, the tunnel data packet 204 may have a second encryption portion 208, which includes an ESP header, an internal IP header, and an internal extended header. However, the second encryption portion 208 may not overlap with (or may substantially not overlap with) the first encryption portion 206 to reduce the double encryption of the tunnel data packet 204. In this example, the second encryption portion 208 may be encrypted using IPsec, and the overlay header may be an external IP header and any extended header. However, the tunnel data packet 204 is merely illustrative, and any part of the tunnel data packet 204 can be encrypted and can similarly use any protocol other than IPsec.

[0057] As shown in the figure, tunnel data packet 204 may include an external IP header that includes an indicator 214 indicating the size of the second encrypted portion. This indicator may be in the external IP header of tunnel data packet 204 (e.g., an overlay header for IPsec) and / or in the extended header of tunnel data packet 204. Indicator 214 may include a value or flag indicating the size of the second encrypted portion 208 of tunnel data packet 204, so that the receiving device can determine how many tunnel data packets 204 need to be decrypted using the tunnel encryption protocol.

[0058] Figure 3 and Figure 4 The flowcharts show example methods 300 and 400, which illustrate at least partially the methods described by... Figure 1A , Figure 1B and Figure 2 This document describes various aspects of the functions performed by the devices (e.g., client device 106, headend device 108, etc.) described herein. Figure 3 and Figure 4 The described logical operation can be implemented as (1) a sequence of actions or program modules implemented by a computer running on a computing system, and / or (2) interconnected machine logic circuits or circuit modules within the computing system.

[0059] The implementation of the various components described herein is a matter of choice depending on the performance and other requirements of the computing system. Therefore, the logical operations described herein are referred to differently as operations, structural devices, actions, or modules. These operations, structural devices, actions, and modules can be implemented using software, firmware, special-purpose digital logic, and any combination thereof. It should also be understood that more advanced technologies can be implemented... Figure 3 and Figure 4 The operations shown and described herein may include more or fewer operations. These operations may also be performed in parallel or in an order different from that described herein. Some or all of these operations may also be performed by components other than those specifically identified. Although the techniques described in this disclosure are referenced to specific components, in other examples, these techniques may be implemented with fewer components, more components, different components, or any configuration of components.

[0060] Figure 3 A flowchart of an example method 300 for a first device is shown. This example method 300 determines that a first portion of a packet is encrypted and a second portion of the packet is unencrypted, encrypts the second portion of the packet using an encryption protocol of an encryption tunnel, and sends the packet over the network via the encryption tunnel to a second device. In some cases, the steps of method 300 can be performed by the first device (e.g., client device 106), which includes one or more processors and one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform the operations of method 300.

[0061] At 302, the first device can establish an encrypted tunnel with the second device via the network to transmit encrypted data over the network. For example, client device 106 can establish an encrypted tunnel 116 with headend device 108 via network 110 to transmit encrypted packets or data over network 110. For example, client device 106 and headend device 108 can perform a handshake according to an encrypted tunnel protocol.

[0062] At 304, the first device can determine whether to send a packet to the second device via the network in an encrypted tunnel. For example, the client device 106 can generate packet 118 or receive a data packet, which will be sent to the headend device 108 via the network 110 in an encrypted tunnel 116.

[0063] At 306, the first device can determine that the first portion of the packet is encrypted. For example, client device 106 can determine that the payload of packet 118 is encrypted. In some cases, client device 106 can determine that the first portion 120 of packet 118 is encrypted by recognizing an indicator in the header of packet 118 that indicates the size of the encrypted first portion 120 of packet 118. In some cases, client device 106 can determine the protocol type of packet 118 (e.g., SSH, HTTPS, etc.) and determine the encrypted first portion 120 of packet 118 based on that specific protocol type and a predefined size of the encrypted packet.

[0064] At 308, the first device can determine that the second portion of the packet is not encrypted. For example, client device 106 can determine that the second portion 122 of packet 118 is not encrypted (e.g., shallow processing, NBAR, etc.). In some cases, the second portion 122 may include the unencrypted header of packet 118.

[0065] At 310, the first device may encrypt the second portion of the packet using an encryption protocol associated with the encrypted tunnel. For example, client device 106 may use an encryption protocol of encrypted tunnel 116 (e.g., IPsec, WireGuard, PPTP, OpenVPN, SSTP, IKEv2, and / or any other encrypted tunneling protocol) to encrypt the second portion 122 of packet 118. In some cases, method 300 may also include determining whether to avoid encrypting the encrypted first portion 120 of packet 118 (using the tunneling protocol), and / or avoiding encryption of the encrypted first portion 120 of packet 118.

[0066] At 312, the first device can use an encrypted tunnel to send packets to the second device over the network. For example, client device 106 can use encrypted tunnel 116 to send packet 118 to headend device 108 over network 110.

[0067] In some cases, method 300 may also include encapsulating packet 118 in an overlay packet according to an overlay protocol, and filling the overlay header fields of the overlay packet with an indication of the size of the second part of the packet. In such an example, sending the packet includes sending the overlay packet to a second device.

[0068] Although these techniques are described as being performed by the client device 106 to send packet 118 to the headend device 108, these techniques are equally applicable to the headend device 108 sending packet 118 to the client device 106 (and / or any other device known in the art for transmitting packets).

[0069] Figure 4A flowchart of an example method 400 for a first device is shown. This example method 400 involves receiving a packet transmitted via an encrypted tunnel from a second device, determining that a first portion of the packet is encrypted using a first encryption protocol, and a second portion of the packet is encrypted using a second encryption protocol of the encrypted tunnel, and decrypting the packet according to both encryption protocols. In some cases, these techniques can be implemented by a system (e.g., one or more devices), such as headend device 108, a server, combinations thereof, and / or any other device (e.g., a hardware offload chip and / or any other device). The techniques of method 400 can be implemented by a system including one or more processors.

[0070] In section 402, the system can create an encrypted tunnel with the source device via the network to transmit encrypted data over the network. For example, headend device 108 can establish an encrypted tunnel 116 with client device 106 via network 110 to transmit encrypted packets or data over network 110. For example, client device 106 and headend device 108 can perform a handshake according to an encrypted tunnel protocol.

[0071] At 404, the system can receive packets sent from the source device over the network in an encrypted tunnel. For example, the system can receive packet 118 sent from client device 106 over network 110 in encrypted tunnel 116.

[0072] At 406, the system can determine that the first portion of the packet is encrypted using a first encryption protocol associated with the encrypted tunnel. For example, the headend device 108 can identify an indicator indicating the size of the first portion 122 of packet 118 from the overlay header of packet 118.

[0073] At 408, the system can decrypt the first part of the packet according to the first encryption protocol. For example, the headend device 108 can use an encryption protocol such as TLS, DTLS, SSL, etc., of the encrypted tunnel 116 to decrypt the second part 122.

[0074] At 410, the system can determine that the second part of the packet is encrypted using a second encryption protocol, and at 412, the system can decrypt the second part of the packet according to the second encryption protocol. In some cases, the headend device 108 can decrypt the first part (e.g., IPsec, Wireguard, etc.), but different devices (e.g., server 112 running application 114) can decrypt the second part of packet 118 (e.g., the first part 120 is encrypted by an initial encryption protocol such as TLS, DTLS, SSL, etc.).

[0075] As described above, the two or more encrypted portions of packet 118 may not be decrypted by the same device or at the same device, but may be decrypted by various devices in the device system. That is, the steps of method 400 may or may not be performed by a single device, but may or may not be performed by different devices in the system. In some cases, the headend device 108 may perform all the steps of method 400, while in other examples, at least some of the steps may be performed by the application 114 running on server 112 (e.g., steps 410 and / or 412 may be performed by server 112 and / or another device).

[0076] Figure 5 An example computer architecture is shown, illustrating a device capable of executing program components to perform the functions described above. The computer architecture is... Figure 5 The text appears to be a mix of Chinese characters and symbols, making it difficult to translate accurately. Figure 5 Any type of computer 500 is illustrated, such as a conventional server computer, workstation, desktop computer, laptop computer, tablet computer, network device, e-reader, smartphone, or other computing device, and can be used to execute any of the software components presented herein. In some examples, the computer may correspond to client device 106, headend device 108, and / or any other device described herein, and may include personal devices (e.g., smartphones, tablets, wearable devices, laptops, etc.), network devices (e.g., servers, switches, routers, hubs, bridges, gateways, modems, repeaters, access points), and / or any other type of computing device capable of running any type of software and / or virtualization technology.

[0077] Computer 500 includes a substrate 502 (or “motherboard”), which is a printed circuit board, to which multiple components or devices may be connected via a system bus or other electrical communication paths. In one illustrative configuration, one or more central processing units (“CPU”) 504 operate in conjunction with a chipset 506. CPU 504 may be a standard programmable processor that performs arithmetic and logical operations required for the operation of computer 500.

[0078] The CPU 504 performs operations by manipulating switching elements that distinguish and change these states, transitioning from one discrete physical state to the next. Switching elements typically include: electronic circuitry that maintains one of two binary states (e.g., flip-flops), and electronic circuitry that provides an output state based on a logical combination of the states of one or more other switching elements (e.g., logic gates). These basic switching elements can be combined to create more complex logic circuits, including registers, adders / subtractors, arithmetic logic units, floating-point units, and so on.

[0079] Chipset 506 provides an interface between CPU 504 and the remaining components and devices on substrate 502. Chipset 506 can provide an interface to RAM 508, which serves as the main memory in computer 500. Chipset 506 can also provide an interface to computer-readable storage media such as read-only memory (“ROM”) 510 or non-volatile RAM (“NVRAM”), which stores basic routines that facilitate the startup of computer 500 and the transfer of information between various components and devices. Depending on the configuration described herein, ROM 510 or NVRAM can also store other software components required for the operation of computer 500.

[0080] Computer 500 can operate in a networked environment by using logical connections to remote computing devices and computer systems via a network (e.g., network 110). Chipset 506 may include functionality for providing network connectivity via NIC 512 (e.g., a Gigabit Ethernet adapter). NIC 512 enables computer 500 to connect to other computing devices via network 110. It should be understood that multiple NICs 512 may be present in computer 500 to connect the computer to other types of networks and remote computer systems.

[0081] Computer 500 can be connected to storage device 518, which provides non-volatile storage for the computer. Storage device 518 can store operating system 520, programs 522, and data, which have been described in more detail herein. Storage device 518 can be connected to computer 500 via storage controller 514 connected to chipset 506. Storage device 518 may include one or more physical storage units. Storage controller 514 can interface with physical storage units via interfaces such as Serial Attached SCSI (“SAS”), Serial Advanced Technology Connect (“SATA”), Fibre Channel (“FC”), or other types of interfaces used for physical connections and data transfer between the computer and physical storage units.

[0082] Computer 500 can store data on storage device 518 by transforming the physical state of physical storage units to reflect the stored information. In different embodiments of this specification, the specific transformation of the physical state may depend on various factors. Examples of these factors may include, but are not limited to, the technology used to implement the physical storage units, whether storage device 518 is characterized as a primary storage device or a secondary storage device, etc.

[0083] For example, computer 500 can issue instructions via storage controller 514 to store information in storage device 518 by altering the magnetic properties of a specific location within a disk drive unit, the reflection or refraction properties of a specific location in an optical storage unit, or the electrical properties of a specific capacitor, transistor, or other discrete component in a solid-state storage unit. Other transformations of the physical medium are also possible without departing from the scope and spirit of this specification; the foregoing examples are provided for illustrative purposes only. Computer 500 can also read information from storage device 518 by detecting the physical state or characteristics of one or more specific locations within the physical storage unit.

[0084] In addition to the aforementioned high-capacity storage device 518, computer 500 can also access other computer-readable storage media to store and retrieve information, such as program modules, data structures, or other data. Those skilled in the art will understand that a computer-readable storage medium is any available medium that provides non-transitory storage of data and can be accessed by computer 500. In some examples, operations performed by client device 106 and / or headend device 108 and / or any components included therein can be supported by one or more devices similar to computer 500. In other words, some or all of the operations performed by client device 106 and / or headend device 108 and / or any components included therein can be performed by one or more computer devices 500.

[0085] By way of example and not limitation, computer-readable storage media can include volatile and non-volatile, removable and non-removable media implemented in any method or technology. Computer-readable storage media include, but are not limited to, RAM, ROM, erasable programmable ROM (“EPROM”), electrically erasable programmable ROM (“EEPROM”), flash memory or other solid-state memory technologies, compact disc ROM (“CD-ROM”), digital versatile disc (“DVD”), high-definition DVD (“HD-DVD”), BLU-RAY or other optical storage devices, magnetic tape cassettes, magnetic tape, disk storage devices or other magnetic storage devices, or any other medium that can be used to store desired information in a non-transitory manner.

[0086] As briefly described above, storage device 518 may store operating system 520 for controlling the operation of computer 500. According to one embodiment, the operating system includes a LINUX operating system. According to another embodiment, the operating system includes a WINDOWS® SERVER operating system from MICROSOFT Corporation of Redmond, Washington. According to yet another embodiment, the operating system may include a UNIX operating system or a variant thereof. It should be understood that other operating systems may also be used. Storage device 518 may store other systems or applications and data used by computer 500.

[0087] In one embodiment, storage device 518 or other computer-readable storage medium is encoded with computer-executable instructions that, when loaded into computer 500, transform the computer from a general-purpose computing system into a special-purpose computer capable of implementing the embodiments described herein. As described above, these computer-executable instructions transform computer 500 by specifying how CPU 504 transitions between states. According to one embodiment, computer 500 has access to a computer-readable storage medium storing computer-executable instructions that, when executed by computer 500, perform the various processes described above with respect to Figures 1-4. Computer 500 may also include a computer-readable storage medium thereon storing instructions for performing any other computer-implemented operations described herein.

[0088] Computer 500 may also include one or more input / output controllers 516 for receiving and processing input from multiple input devices, such as keyboards, mice, touchpads, touchscreens, electronic pens, or other types of input devices. Similarly, input / output controllers 516 may provide output to a display, such as a computer monitor, flat panel display, digital projector, printer, or other types of output device. It should be understood that computer 500 may not include all the components shown in FIG8 and may include... Figure 5 Other components not explicitly shown in the document, or those that can be utilized with Figure 5 The architecture shown is completely different.

[0089] As described herein, computer 500 may include client device 106, headend device 108, and / or any other device. Computer 500 may include one or more hardware processors 504 (processors) configured to execute one or more stored instructions. The processors 504 may include one or more cores. Furthermore, computer 500 may include one or more network interfaces configured to provide communication between computer 500 and other devices, such as the communication performed by client device 106 or headend device 108 as described herein. The network interfaces may include devices configured to couple to personal local area networks (PANs), wired and wireless local area networks (LANs), wired and wireless wide area networks (WANs), etc. For example, the network interface may include interfaces with Ethernet, Wi-Fi, etc. TM Compatible devices.

[0090] Program 522 may include any type of program or process to perform the techniques described in this disclosure for selectively encrypting unencrypted portions of packets for transmission over an encrypted tunnel, wherein the packets are at least partially encrypted. For example, program 522 may cause computer 500 to perform techniques for communication, for determining the encrypted portions of packets, identifying the unencrypted portions of packets, and selectively encrypting the unencrypted portions of packets before transmission over the encrypted tunnel. In this way, the encryption protocol of the encrypted tunnel will be used to encrypt potentially private or sensitive data (e.g., information in the packet header) of the packets, but the encrypted data (e.g., the payload) of the packets can avoid unnecessary double encryption. By reducing (or eliminating) the amount of data in double-encrypted packets, the time spent by the computing device on encrypted traffic over the encrypted tunnel can be reduced, and the computational resources consumed can be reduced. Furthermore, program 522 may include instructions to cause computer 500 to perform specific techniques for receiving packets over the encrypted tunnel and decrypting portions of the packets using different encryption protocols.

[0091] In summary, this paper describes techniques and mechanisms for reducing double encryption of packets transmitted via encrypted tunnels. The techniques described herein include identifying the encrypted portions of a packet, recognizing the unencrypted portions of the packet, and selectively encrypting the unencrypted portions of the packet before transmission through the encrypted tunnel. In this way, the encrypted protocol of the encrypted tunnel is used to encrypt potentially private or sensitive data (e.g., information in the packet header) of the packet, while the encrypted data (e.g., the payload) of the packet can avoid unnecessary double encryption. By reducing (or eliminating) the amount of data in double-encrypted packets, the time spent by computing devices on encrypted traffic via the encrypted tunnel can be reduced, and the computational resources consumed can be decreased.

[0092] While the invention has been described with reference to specific examples, it should be understood that the scope of the invention is not limited to these specific examples. Since other modifications and variations to suit specific operational requirements and environments will be readily apparent to those skilled in the art, the invention is not to be considered limited to the examples chosen for purposes of disclosure, but rather covers all changes and modifications that do not depart from the true spirit and scope of the invention.

[0093] Although this application describes embodiments with specific structural features and / or methodological actions, it should be understood that the claims are not necessarily limited to the specific features or actions described. Rather, the specific features and actions are merely illustrative embodiments falling within the scope of the claims of this application.

Claims

1. A method for data encryption, comprising: An encrypted tunnel is created between the first and second devices via the network to transmit encrypted data over the network; At the first device, it is determined that packets will be sent to the second device via the network in the encrypted tunnel; At the first device, it is determined that the first portion of the packet is encrypted; At the first device, it is determined that the second portion of the packet is not encrypted; Identify the number of the first bytes in the second part of the group; The second byte number identifies the block size, and the encryption protocol encrypts data at that block size. The block size is determined to be a multiple of the third byte number, wherein the third byte number is greater than or equal to the first byte number; At the first device, the third byte number, including the second portion of the packet, is encrypted using the encryption protocol associated with the encrypted tunnel; as well as Using the encrypted tunnel, the packet is sent from the first device to the second device through the network.

2. The method of claim 1, further comprising at least one of the following operations: Determine to avoid encrypting the first encrypted portion of the packet; or Avoid encrypting the first encrypted portion of the packet.

3. The method according to claim 1 or 2, wherein: Determining that the first portion of the packet is encrypted includes determining that the payload of the packet is encrypted; and Determining at the first device that the second portion of the packet is not encrypted includes identifying the unencrypted header of the packet.

4. The method according to claim 1 or 2, further comprising: Determine the protocol type of the packet; Identify the first predefined portion of the encrypted packet according to the protocol type; as well as Identify the second predefined portion of the unencrypted packet based on the protocol type. The first portion is determined at least in part based on the first predefined portion, and the second portion is determined at least in part based on the second predefined portion.

5. The method according to claim 1 or 2, wherein, Determining that the first portion of the packet is encrypted includes identifying an indicator from the packet header that indicates the size of the encrypted first portion of the packet.

6. The method according to claim 1 or 2, further comprising: The packet is encapsulated in an overlay packet according to the overlay protocol; as well as The fields of the overlay header of the overlay group are filled with an indication of the size of the second part of the group. Sending the packet includes sending the overlay packet to the second device.

7. The method according to claim 1 or 2, wherein: The first part of the packet is encrypted using at least one of the following: Secure Sockets Layer (SSL) protocol; Transport Layer Security (TLS) protocol; Datagram Transport Layer Security (DTLS) protocol; Hypertext Transfer Security Protocol (HTTPS); or Secure Shell Protocol (SSH); and The encryption protocol includes at least one of the following: Internet Protocol Security (IPsec) protocol; WireGuard; OpenVPN protocol; Transport Layer Security (TSL) protocol; or Secure Sockets Layer (SSL) protocol.

8. A first device for data encryption, comprising: One or more processors; as well as One or more non-transitory computer-readable media storing computer-executable instructions, which, when executed by the one or more processors, cause the one or more processors to perform operations including: An encrypted tunnel is created with the second device over the network to transmit encrypted data over the network; Determine whether to send packets to the second device via the network in the encrypted tunnel; It is determined that the first portion of the packet is encrypted; It was determined that the second part of the packet was not encrypted; Identify the number of the first bytes in the second part of the group; The second byte number identifies the block size, and the encryption protocol encrypts data at that block size. The block size is determined to be a multiple of the third byte number, wherein the third byte number is greater than or equal to the first byte number; The third byte number, which includes the second portion of the packet, is encrypted using the encryption protocol associated with the encrypted tunnel; as well as The encrypted tunnel is used to send the packet to the second device through the network.

9. The first device according to claim 8, wherein the operation further comprises at least one of the following: Determine to avoid encrypting the first encrypted portion of the packet; or Avoid encrypting the first encrypted portion of the packet.

10. The first device according to claim 8 or 9, wherein: Determining that the first portion of the packet is encrypted includes determining that the payload of the packet is encrypted; and Determining at the first device that the second portion of the packet is not encrypted includes identifying the unencrypted header of the packet.

11. The first device according to claim 8 or 9, wherein the operation further comprises: Determine the protocol type of the packet; Identify the first predefined portion of the encrypted packet according to the protocol type; as well as Identify the second predefined portion of the unencrypted packet based on the protocol type. The first portion is determined at least in part based on the first predefined portion, and the second portion is determined at least in part based on the second predefined portion.

12. The first device according to claim 8 or 9, wherein, Determining that the first portion of the packet is encrypted includes identifying an indicator from the packet's header, the indicator indicating the size of the encrypted first portion of the packet.

13. The first device according to claim 8 or 9, wherein the operation further comprises: The packet is encapsulated in an overlay packet according to the overlay protocol; as well as The fields of the overlay header of the overlay group are filled with an indication of the size of the second part of the group. Sending the packet includes sending the overlay packet to the second device.

14. The first device according to claim 8 or 9, wherein: The first part of the packet is encrypted using at least one of the following: Secure Sockets Layer (SSL) protocol; Transport Layer Security (TLS) protocol; Datagram Transport Layer Security (DTLS) protocol; Hypertext Transfer Security Protocol (HTTPS); or Secure Shell Protocol (SSH); and The encryption protocol includes at least one of the following: Internet Protocol Security (IPsec) protocol; WireGuard; OpenVPN protocol; Transport Layer Security (TSL) protocol; or Secure Sockets Layer (SSL) protocol.

15. A system for data encryption, comprising: One or more processors; as well as One or more non-transitory computer-readable media storing computer-executable instructions, which, when executed by the one or more processors, cause the one or more processors to perform operations including: An encrypted tunnel is created between the source device and the network to transmit encrypted data over the network; Packets sent from the source device are received in the encrypted tunnel via the network; Identify an indicator from the overlay header of the packet, the indicator indicating the size of the first portion of the packet; Based at least in part on the indicator, it is determined that the first portion of the packet is encrypted using a first encryption protocol associated with the encrypted tunnel; Decrypt the first part of the packet according to the first encryption protocol; It is determined that the second part of the packet is encrypted using a second encryption protocol; as well as The second part of the packet is decrypted according to the second encryption protocol.

16. The system according to claim 15, wherein: Determining that the first portion of the packet is encrypted includes determining that the packet header is encrypted; and Determining that the second part of the packet is encrypted includes identifying the encrypted payload of the packet.

17. The system according to any one of claims 15 to 16, wherein, Determining that the first portion of the packet is encrypted includes identifying an indicator from the packet header that indicates the size of the encrypted first portion of the packet.

18. An apparatus for data encryption, comprising: Module for creating an encrypted tunnel between a first device and a second device over a network to transmit encrypted data over the network; A module for determining at the first device to send packets through the network to the second device in the encrypted tunnel; A module for determining at the first device that the first portion of the packet is encrypted; A module for determining at the first device that the second portion of the packet is not encrypted; A module for identifying the number of first bytes in the second part of the group; A module for identifying the second byte number of the block size, the encryption protocol encrypts data at the block size; A module for determining that a multiple of the block size corresponds to a third byte number, wherein the third byte number is greater than or equal to the first byte number; A module for encrypting the third byte number, including the second portion of the packet, at the first device using the encryption protocol associated with the encrypted tunnel; as well as Module for sending packets from the first device to the second device through the network using the encrypted tunnel.

19. The apparatus of claim 18, further comprising a module for performing at least one of the following operations: Determine to avoid encrypting the first encrypted portion of the packet; or Avoid encrypting the first encrypted portion of the packet.

20. The apparatus according to claim 18 or 19, wherein: Determining that the first portion of the packet is encrypted includes determining that the payload of the packet is encrypted; and Determining at the first device that the second portion of the packet is not encrypted includes identifying the unencrypted header of the packet.

21. The apparatus of claim 18 or 19, further comprising a module for performing the following operations: Determine the protocol type of the packet; Identify the first predefined portion of the encrypted packet according to the protocol type; and Identify the second predefined portion of the unencrypted packet based on the protocol type. in, The first portion is determined at least in part based on the first predefined portion, and the second portion is determined at least in part based on the second predefined portion.

22. The apparatus according to claim 18 or 19, wherein, Determining that the first portion of the packet is encrypted includes identifying an indicator from the packet header that indicates the size of the encrypted first portion of the packet.

23. The apparatus of claim 18 or 19, further comprising a module for performing the following operations: The packet is encapsulated in an overlay packet according to the overlay protocol; and The fields of the overlay header of the overlay group are filled with an indication of the size of the second part of the group. in, Sending the packet includes sending the overlay packet to the second device.

24. The apparatus according to claim 18 or 19, wherein: The first part of the packet is encrypted using at least one of the following: Secure Sockets Layer (SSL) protocol; Transport Layer Security (TLS) protocol; Datagram Transport Layer Security (DTLS) protocol; Hypertext Transfer Security Protocol (HTTPS); or Secure Shell Protocol (SSH); and The encryption protocol includes at least one of the following: Internet Protocol Security (IPsec) protocol; WireGuard; OpenVPN protocol; Transport Layer Security (TSL) protocol; or Secure Sockets Layer (SSL) protocol.

25. A computer program product comprising instructions that, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 1 to 7.

26. A computer-readable medium having instructions stored thereon, which, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 1 to 7.

Images