Traffic Flow Identifiers for Encrypted Network Load Balancing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Service providers face challenges in load balancing encrypted traffic flows due to the leakage of information that compromises privacy and the degradation of Equal Cost Multiple Paths (ECMP) effectiveness, especially with increasing use of encryption methods like MACsec and IPsec, which obscure necessary header information for flow identification.
Innovation Solution
Customer edge devices generate and change flow identifiers based on packet headers and additional values, such as nonces, before encrypting and encapsulating packets, allowing the service provider network to maintain load balancing while protecting against passive attackers by ensuring consistent and secure flow identification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If flow identifiers are generated based on packet header fields for load balancing, then load balancing effectiveness is improved, but traffic analysis security is worsened due to information leakage
Solution Approach 1:
The patent applies preliminary action by generating flow identifiers before encryption occurs. The flow ID is computed from packet header fields (source IP, destination IP, source port, destination port) and inserted into the encapsulation before the packets are encrypted and sent through the network. This allows the service provider to perform load balancing based on flow information while the actual packet content remains encrypted, preventing traffic analysis while maintaining effective load balancing.
Solution Approach 2:
The patent uses an intermediary approach by introducing a flow identifier field as a mediator between the packet header information and the encrypted payload. This flow ID serves as a separate identifier that carries flow information without exposing the actual packet content or enabling traffic analysis. The flow ID is inserted into the encapsulation structure (such as VXLAN, GRE, or IPsec encapsulation) as a distinct field that can be used for load balancing decisions without compromising security.
2Object-affected harmful factors
If encryption is applied to protect traffic, then security is improved, but flow identification capability is worsened due to obscured header information
Solution Approach 1:
The patent applies segmentation by separating the flow identification function from the encrypted packet payload. Instead of trying to identify flows through encrypted packet contents, the system segments the identification task by extracting flow characteristics (source IP, destination IP, ports) before encryption and encoding them into a separate flow identifier field. This allows the network to maintain flow identification capability while the actual traffic remains encrypted and protected.
Solution Approach 2:
The patent performs the flow identification action preliminarily, before encryption occurs. By computing the flow identifier from the packet headers before the encryption step, the system preserves flow identification capability while the subsequent encryption protects the packet content. This timing ensures that the flow ID is available for load balancing decisions without requiring decryption of the packet payload.
3Object-affected harmful factors
If flow identifiers are changed dynamically, then traffic analysis resistance is improved, but packet ordering and latency consistency are worsened
Solution Approach 1:
The patent applies preliminary action by computing and inserting the flow identifier before encryption and packet transmission. The flow ID is determined based on the packet's header fields at the time of encapsulation, ensuring that packets belonging to the same flow receive consistent identification throughout their transmission. This preliminary determination prevents flow identifier changes that would disrupt packet ordering or increase latency, while still providing security through the encrypted payload.
Data Source
AI summary
A network device receives packets for one or more traffic flows to be sent into a network. The network device computes a flow identifier for each of the one or more traffic flows based on information contained in one or more headers of the packets for each of the one or more traffic flows and based on at least one value that is changed on an ongoing basis. The packets for each of the one or more traffic flows are encrypted to produce encrypted packets for each of the one or more traffic flows. An encapsulation is added to the encrypted packets for the one or more traffic flows. The flow identifier is included in a field of the encapsulation for a corresponding traffic flow.