Bend-in-the-Wire Adjacency Management for High-Throughput IPsec
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network communication methods, such as bump-in-the-stack (BITS) and bump-in-the-wire (BITW), face limitations in throughput performance and SWaP efficiency, with BITS being inefficient in throughput and BITW being inefficient in terms of size, weight, and power usage, while also being complex and costly to implement.
Innovation Solution
The bend-in-the-wire system decouples service translation from routers by using a translation device that communicates only with a primary router, prepending an interface identifier to data transmissions, translating them without altering the prepended field, and maintaining adjacency states, thereby enabling high-throughput and scalable solutions without disrupting traditional router management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If bump-in-the-stack (BITS) architecture is used to provide IPsec services, then flexibility and security are improved, but throughput performance deteriorates
Solution Approach 1:
The patent introduces a translation device as an intermediary component that sits between the router and the IPsec service. This translation device handles the IPsec processing while the router maintains its high-performance data plane. The translation device translates packets between the router's native format and the format required by the IPsec service, allowing the router to achieve high throughput while the IPsec service provides security. This resolves the contradiction by separating the security function from the data forwarding path.
2Productivity
If bump-in-the-wire (BITW) architecture is used to provide IPsec services, then throughput performance is improved, but size, weight, and power efficiency deteriorates
Solution Approach 1:
The patent extracts the IPsec service from the router's hardware and places it in a separate translation device. This allows the router to maintain its streamlined, power-efficient architecture while still providing IPsec capabilities through the external translation device. The translation device handles the computationally intensive IPsec operations separately, allowing the router to operate with lower power consumption while maintaining high throughput performance.
3Reliability
If IPsec is implemented in all host devices to provide end-to-end security, then security is improved, but device complexity and implementation cost increase
Solution Approach 1:
The patent creates a universal translation device that can work with any router regardless of the specific IPsec implementation or protocol version. The translation device provides a standardized interface that handles multiple IPsec modes and protocols, allowing routers to provide security services without needing to implement complex IPsec functionality themselves. This universal approach simplifies router design while maintaining comprehensive security capabilities.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for translating network data transmissions begins with a data transmission received at a router. An interface identifier is prepended before a first field of the data transmission, forming a prepended field. The data transmission is transmitted to a translation device. The data transmission is translated without altering the prepended field. The translated data transmission is transferred back to the router. The interface identifier is removed. The translated data is transmitted while maintaining adjacency with an adjacent peer using the interface identifier.