Cipher Engine Segmentation for Packet Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing packet networks, such as MPLS-TP, lack enhanced security measures to protect against cyber attacks, particularly during overload situations and malfunctions where end-to-end data paths cannot be treated as direct wired connections.
Innovation Solution
The implementation of a method and system that provides end-to-end encryption and authentication of data packets across complex network topologies, utilizing a cipher engine and key manager to synchronize cyber security functions with packet switching operations, ensuring high robustness against cyber attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If end-to-end encryption and authentication are implemented in packet networks, then security against cyber attacks is improved, but device complexity increases due to separate cipher engines and key management systems
Solution Approach 1:
The system segments the network functionality by separating packet handling operations from cyber security functions. Packet engines handle routing and forwarding while cipher engines handle encryption and authentication. This segmentation allows each component to be optimized independently, managing complexity through functional separation while maintaining high security standards.
Solution Approach 2:
A key management system acts as an intermediary between packet engines and cipher engines, coordinating security operations without requiring direct complex interactions between the cryptographic components and network routing components. This intermediary layer simplifies the overall system architecture by centralizing key distribution and security policy management.
2Adaptability or versatility
If packet networks are used instead of direct wired connections, then flexibility is improved, but data integrity deteriorates due to packet manipulation capabilities
Solution Approach 1:
The encryption and authentication operations are performed continuously on all data packets passing through the network without interruption to the data flow. This ensures that data integrity is maintained throughout the entire transmission path, from source to destination, while preserving the flexible packet routing capabilities of the network.
Solution Approach 2:
The harmful manipulation capabilities of packet networks are counteracted by extracting and applying cryptographic protections. Encryption extracts the data payload and transforms it into protected form, while authentication mechanisms extract and verify data integrity, removing the vulnerability to packet manipulation while maintaining network flexibility.
3Device complexity
If cipher engines are integrated with packet engines, then device complexity is reduced, but security robustness deteriorates due to potential intrusion points
Solution Approach 1:
The system maintains separate cipher engines distinct from packet engines, creating isolated security zones. This segmentation prevents potential security breaches in the packet handling subsystem from compromising the cryptographic operations, and vice versa. Each subsystem can be secured and monitored independently, enhancing overall security robustness.
Solution Approach 2:
Communication between packet engines and cipher engines occurs through a controlled intermediary interface that limits information exchange to only what is necessary for operation. This intermediary layer reduces the attack surface by preventing direct access between subsystems and minimizing potential intrusion points while maintaining coordinated operation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
To provide secure communication over end-to-end data paths or segments of end-to-end paths in a timed deterministic packet network comprising a plurality of packet engines (61 -64) that perform packet handling, cipher engines (71-74) are provided separately from the packet engines. The cipher engines (71 -74) are operative to perform at least one cyber security function. A cipher engine and key manager (44) provides central control for the plurality of cipher engines (71 -74). A centralized packet flow path manager, PFPM (42), may set up endpoint nodes and intermediate transit nodes of the end-to-end data paths of the packet network.