AI-Guided QUIC Handshake Decryption for DPI Traffic Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Deep Packet Inspection (DPI) systems face challenges in managing QUIC traffic due to high CPU consumption and throughput degradation caused by the need to decrypt every QUIC data packet flow, especially with the increasing use of encrypted QUIC protocols, leading to unnecessary overhead and delays in network traffic management.
Innovation Solution
Implementing an Artificial Intelligence (AI) model to predict the relevancy of decrypting encrypted QUIC initial handshake packets based on User Equipment (UE) context, server context, and flow context parameters, allowing selective decryption only when necessary, thereby reducing unnecessary CPU usage and optimizing DPI system performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If all QUIC data packet flows are decrypted to enable application detection, then detection accuracy is improved, but CPU consumption increases significantly
Solution Approach 1:
The patent applies partial action by decrypting only a subset of QUIC flows that are predicted to be relevant based on AI/ML analysis of handshake packets, rather than decrypting all QUIC flows. This selective approach maintains detection accuracy for target applications while significantly reducing CPU consumption by avoiding unnecessary decryption of unrelated traffic.
Solution Approach 2:
The patent performs preliminary analysis of QUIC handshake packets using AI/ML models before committing to full decryption. By examining encrypted handshake data for patterns indicative of target applications, the system prepares ahead of time to decrypt only when necessary, thus improving detection efficiency while minimizing CPU overhead.
2Measurement precision
If all QUIC data packet flows are decrypted for Deep Packet Inspection, then traffic management accuracy is improved, but system throughput decreases
Solution Approach 1:
The system decrypts only the necessary portion of QUIC flows for DPI based on AI/ML predictions, rather than decrypting all flows. This partial decryption approach maintains traffic management accuracy for relevant applications while preserving system throughput by avoiding processing delays on unrelated traffic.
Solution Approach 2:
The patent extracts and analyzes specific features from encrypted QUIC handshake packets using AI/ML models to identify potential target applications. By extracting only the necessary information from handshakes and decrypting only when needed, the system maintains management accuracy while preventing throughput degradation from universal decryption.
3Measurement precision
If decryption of every QUIC flow is performed to identify SNI, then application identification completeness is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary AI/ML analysis of encrypted QUIC handshake packets to predict whether the flow contains target applications before proceeding to decryption and SNI extraction. This preliminary filtering action ensures that decryption is performed only when likely to yield relevant results, maintaining identification completeness for target apps while reducing overall processing time.
Solution Approach 2:
The system applies partial decryption by processing only those QUIC flows that the AI/ML model predicts are relevant to target applications. This approach maintains identification completeness for applications of interest while minimizing processing delays by avoiding full decryption of unrelated traffic.
Data Source
AI summary
The present disclosure relates to field of telecommunication network and discloses method and apparatus e.g., network entity for network traffic management. The network entity may be associated with a Deep Packet Inspection System (DPI), the network entity receives an encrypted Quick User Datagram Protocol (UDP) Internet Connection (QUIC) data packet flow from a source. Further, network entity predicts using an Artificial Intelligence (AI) model, a relevancy of decryption for an encrypted QUIC initial handshake packet of the QUIC data packet flow based on at least one of pre-stored User Equipment (UE) context parameters, pre-stored server context parameters and flow context parameters of the encrypted QUIC data packet flow. The network entity decrypts the encrypted QUIC initial handshake packet based on the relevancy of the decryption being predicted to be useful. The present disclosure helps to optimize Deep Packet Inspection (DPI) operation.