Dual Cryptographic Keying Cache Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In high-performance communication networks using packet switching technologies like DTLS, the frequent need to re-key cryptographic keys for secure communication leads to significant buffering requirements, which can be costly and resource-intensive, especially in hardware implementations supporting multiple Gigabit bandwidths.
Innovation Solution
Implementing a cache system for security association data that efficiently updates and accesses key information, allowing network nodes to use cached security association data for decrypting packets based on epoch numbers, reducing the need for large buffer sizes by overwriting DTLS memory with cache data when a cache window timer expires.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If DTLS is implemented in hardware to support high bandwidth, then performance and speed are improved, but buffer size requirements and device complexity increase significantly
Solution Approach 1:
The patent divides the security association data into two separate storage locations: a cache for frequently accessed data and a database for persistent storage. This segmentation allows the system to maintain high performance by accessing recent data from the cache while reducing overall buffer requirements by separating transient buffering needs from permanent storage needs.
Solution Approach 2:
The patent introduces a cache window timer that proactively manages when data should be transferred from the database to the cache. By performing this transfer in advance based on timer expiration rather than reacting to buffer fullness or data arrival, the system prevents buffering bottlenecks before they occur, allowing hardware implementations to operate at high speeds without requiring oversized buffers.
2Reliability
If packets are buffered during key re-computation window, then communication reliability is maintained, but device complexity and cost increase
Solution Approach 1:
The patent segments the security association data into cache and database portions, allowing the system to maintain communication reliability by keeping recent security data in the cache while avoiding the need for large buffers. The cache acts as a small, manageable buffer for recent data, eliminating the need for large buffer resources while maintaining reliability during key re-computation windows.
Solution Approach 2:
The patent uses the cache as a copy of the most recently accessed security association data from the database. This copying mechanism allows the system to maintain reliability by having up-to-date security data available without requiring large buffers, as the cache provides a simplified, recent copy that suffices for active communication needs.
3Stability of the object's composition
If security association data is stored in DTLS memory, then data persistence is ensured, but access speed during re-keying operations decreases
Solution Approach 1:
The patent segments security association data into two parts: persistent data stored in the database and recently accessed data cached in memory. This segmentation allows the system to ensure data persistence through the database while dramatically improving access speed by retrieving recent data from the cache, which is much faster than querying the database during re-keying operations.
Solution Approach 2:
The patent performs preliminary data transfer from the database to the cache based on timer expiration before actual data access is needed. This preliminary action ensures that when security association data is needed during re-keying operations, it is already available in the cache for rapid access, while the database maintains the persistent storage requirement.
Data Source
AI summary
A dual cryptographic keying system. In particular implementations, a method includes responsive to an initial session key negotiation, storing security association information for a tunnel in a security association memory; responsive to a session key renegotiation, storing security association information for the tunnel in a cache; decrypting received packets associated with the tunnel conditionally using the security association information in the cache or the security association information in the security association memory; and upon an expiration condition, overwriting the security association information, for the tunnel, in the security association memory with the security association information, for the tunnel, copied from the cache.