Data Integrity Protection via Message Authentication Codes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data protection methods in AFDX and IEEE 802.3 networks are inadequate against malicious alterations by intelligent network equipment, as they rely solely on cyclic redundancy checks (CRC) which can be compromised by knowledgeable switches, necessitating costly and complex redundant pathways or different communication technologies.
Innovation Solution
Implementing a method that codes data using predefined rules, detects alterations, and restores altered data items, independent of communication means, using techniques such as different CRCs, encryption, and message authentication codes, ensuring data integrity and resistance to malicious corruption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If CRC checks are used for data integrity protection, then data transmission reliability is improved, but the system becomes vulnerable to malicious alterations by intelligent network equipment
Solution Approach 1:
The patent introduces a message authentication code (MAC) as an intermediary protection mechanism between the data and the network infrastructure. The MAC is calculated using a secret key that is shared between communicating endpoints but unknown to network equipment, creating a mediator that prevents malicious alteration while maintaining reliability
Solution Approach 2:
The patent applies preliminary anti-action by pre-calculating and attaching a MAC code to the data before transmission. This preliminary protective measure counteracts potential malicious alterations by network equipment before they can compromise data integrity, as the MAC was computed before the data could be tampered with
2Reliability
If redundant transmission pathways are implemented to protect against physical breakdowns, then network availability is improved, but system complexity and cost increase
Solution Approach 1:
The patent extracts the integrity protection function from the physical transmission pathway and places it at the data level through MAC authentication. This separation allows single-path transmission to achieve both availability and integrity protection, eliminating the need for redundant physical pathways while maintaining reliability
Solution Approach 2:
The patent implements self-service by enabling data to authenticate itself through the MAC code without requiring redundant transmission pathways. The data carries its own integrity verification mechanism, allowing the system to protect itself against malicious alteration using existing single-path transmission infrastructure
3Reliability
If different communication technologies are used to ensure data integrity, then protection against malicious alteration is improved, but implementation cost and complexity increase
Solution Approach 1:
The patent applies universality by implementing a MAC-based authentication mechanism that can be integrated into existing AFDX and Ethernet network infrastructure. This multi-functional approach provides both integrity verification and security authentication using standard network protocols, eliminating the need for separate dedicated protection systems
Data Source
AI summary
A method of transmitting data over a network, from a sending application to a receiving application, including: coding the data, by the sending application, by implementing a predefined rule; detecting alteration of at least one item of data transmitted, by the receiving application, by implementing the predefined rule; and in case an alteration of a data item is detected, restoring the altered data item. In the course of the coding, in the course of the alteration detection, and in the course of the restoration, a cyclic redundancy check or an encryption can be implemented.