Context-Based Adaptive Encryption for Cloud Resource Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In compute cloud environments, setting up an encrypted tunnel between virtual machines or containers for compliance often leads to resource over-utilization due to unnecessary double encryption or potential compliance issues when not using encryption at all.
Innovation Solution
A network-based appliance with a mechanism that selectively uses an out-of-band encryption channel, integrated with the network layer stack, analyzes packet context using a packet parser to determine if additional encryption is needed, dispatching packets through an encrypted channel only when necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an encrypted tunnel is set up between hosts for compliance purposes, then security compliance is improved, but computational and memory resources are wasted due to unnecessary double encryption
Solution Approach 1:
The patent applies local quality by making the encryption channel selective rather than universal. The system evaluates each packet individually and applies encryption only to specific packets that require it, rather than encrypting all traffic uniformly. This is achieved through a packet parser that analyzes packet attributes and a dispatcher that routes packets to appropriate channels (encrypted or non-encrypted) based on their specific needs.
Solution Approach 2:
The patent changes the parameter of encryption application from a static all-or-nothing approach to a dynamic selective approach. The system monitors packet attributes (such as protocol type, source/destination, sensitivity level) and adjusts the encryption parameter accordingly - applying encryption to some packets while leaving others unencrypted. This parameter change allows the system to maintain security compliance while reducing unnecessary computational overhead.
2Reliability
If all data is sent through the encrypted channel, then security compliance is ensured, but resource utilization increases due to unnecessary encryption of already encrypted data
Solution Approach 1:
The patent applies partial action by implementing selective encryption rather than complete encryption of all data streams. The packet parser evaluates each packet and determines whether encryption is necessary based on specific criteria. Only the necessary portion of data traffic receives encryption processing, while other packets are transmitted through non-encrypted channels, thereby achieving compliance without the excessive resource consumption of universal encryption.
3Productivity
If an encrypted channel is not used, then resource utilization is reduced, but compliance issues may arise
Solution Approach 1:
The patent applies segmentation by dividing the data traffic into separate streams - encrypted and non-encrypted - based on packet characteristics. The dispatcher creates distinct transmission paths for different types of packets. This segmentation allows the system to maintain encrypted channels for compliance-critical traffic while using non-encrypted channels for other traffic, thereby satisfying compliance requirements without unnecessarily encrypting all data and wasting resources.
Data Source
AI summary
A network-based appliance includes a mechanism to set-up and selectively use an “out-of-band” encryption channel. The mechanism comprises a packet parser, and a packet dispatcher, and it is integrated with an existing network layer stack that typically is not visible to host applications. In lieu of simply encrypting all data it receives, the mechanism instead analyzes one or more attributes, e.g., protocol type, application type, current encryption strength, content payload, etc., associated with a packet transmission to determine whether further encryption is required. The evaluation may include a deep packet inspection (DPI) when the information at the network layer (e.g., IP address, port number, etc.) is not sufficient to determine if the payload in the packet needs to be further encrypted. Based on the result of the analysis, packets are dispatched to the encryption channel as and when necessary. When additional encryption is not necessary, however, packet(s) are instead dispatched through an ordinary non-encrypted channel.