Client Proxy Header Authentication Without Tunnel Overhead
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In zero-trust architectures, the high performance overheads caused by tunnel encapsulation and decapsulation processes, as well as encryption and decryption, are significant issues for terminal devices and gateway devices due to the need for additional tunnel encryption and decryption to carry authentication information.
Innovation Solution
A client proxy apparatus intercepts negotiation packets and adds authentication information to the transport layer packet header, eliminating the need for additional tunnel encapsulation and decryption for sessions meeting encryption strength requirements, while maintaining link security and authentication through the transport layer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If tunnel encapsulation and decryption are performed to carry authentication information, then link security and authentication are ensured, but processing overheads increase significantly
Solution Approach 1:
The patent combines authentication information with existing transport layer packet headers (such as TCP options or IP headers) instead of using separate tunnel encapsulation. This merging approach allows authentication data to be carried within the existing packet structure, eliminating the need for additional tunnel encryption and decryption operations while maintaining security and authentication capabilities.
Solution Approach 2:
The patent makes the transport layer packet header serve multiple functions: both its original data transmission function and the additional function of carrying authentication information. By embedding authentication data in fields like TCP options or IP header extensions, the same packet structure accomplishes both transport and authentication tasks, reducing overall processing overhead.
2Adaptability or versatility
If additional tunnel encapsulation is established to carry authentication information, then authentication capability is improved, but device complexity increases
Solution Approach 1:
The patent merges authentication functionality into the existing transport layer protocol structure rather than creating a separate tunnel protocol. By using existing header fields (TCP options, IP headers) to carry authentication information, the system avoids the complexity of establishing and managing additional tunnel protocols while maintaining comprehensive authentication capability.
3Loss of information
If tunnel encapsulation is used for all application packets, then authentication information can be carried, but processing time increases
Solution Approach 1:
The patent performs authentication information embedding during the initial packet header construction phase, before packets enter the main processing pipeline. By pre-placing authentication data in transport layer headers at the source, subsequent routing and processing stages can operate without additional authentication-related processing delays.
Solution Approach 2:
The patent combines authentication information transmission with the existing packet forwarding process by embedding auth data in transport headers. This eliminates separate authentication processing steps and allows authentication information to be transmitted alongside regular data without adding processing time.
Data Source
AI summary
An access control method, performed by a client proxy apparatus running on a terminal device, includes intercepting a first negotiation packet. The first negotiation packet is from a first application client on the terminal device and is used to perform negotiation to establish a first session. The first session is between the first application client and a first server. The first session meets an encryption strength requirement. The method also includes adding authentication information corresponding to the first application client to a transport layer packet header of the first negotiation packet to obtain a modified first negotiation packet. The method further includes sending the modified first negotiation packet to a gateway device.