Encrypted Packet Header Routing With Key-Aware Relay Paths
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In conventional communication systems, the header of a packet containing information about the source and destination is often unencrypted, allowing attackers or relay nodes to identify the communication partners, compromising confidentiality.
Innovation Solution
A communication device encrypts the packet header using shared encryption keys among the transmission, receiving, and relay nodes, ensuring only the next relay destination is known to each node, while managing encryption keys based on residual quantities to maintain confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the header of packets is left unencrypted for easy routing, then routing efficiency is improved, but confidentiality of communication partners is compromised
Solution Approach 1:
The packet header is segmented into multiple parts: unencrypted routing information (next hop address) and encrypted destination information. This allows relay nodes to efficiently forward packets using unencrypted next-hop addresses while keeping the final destination encrypted, thus resolving the contradiction between routing efficiency and confidentiality.
Solution Approach 2:
Different parts of the header have different encryption states: the next-hop address field is unencrypted for efficient local routing decisions, while the destination address field remains encrypted to protect communication partner confidentiality. This local differentiation resolves the contradiction by applying encryption selectively where needed.
2Loss of information
If encryption is applied to all header fields for confidentiality, then confidentiality is improved, but routing efficiency deteriorates
Solution Approach 1:
The header is divided into routing-critical fields (next-hop address) that remain unencrypted and confidentiality-critical fields (destination address) that are encrypted. This segmentation allows routing operations to proceed efficiently on unencrypted data while maintaining confidentiality on encrypted data.
Solution Approach 2:
Encryption is applied locally only to the destination address field rather than the entire header, allowing relay nodes to perform efficient routing decisions on unencrypted next-hop information while the destination remains confidentially encrypted.
3Measurement precision
If relay nodes can decrypt headers to identify destinations, then packet delivery accuracy is improved, but unauthorized access to communication information increases
Solution Approach 1:
The header information is segmented into next-hop routing data (unencrypted, visible to relay nodes) and final destination data (encrypted, hidden from relay nodes). This ensures packet delivery accuracy is maintained through unencrypted next-hop information while unauthorized access to communication partner information is prevented through encryption of the destination.
Solution Approach 2:
Different security levels are applied to different parts of the header: next-hop addresses have no encryption (local routing needs) while destination addresses have strong encryption (confidentiality needs), resolving the contradiction between delivery accuracy and security.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
According to an arrangement, a communication device (100a) includes a deciding unit (105), an encrypting unit (106), a packet generating unit (104), and a sending unit. The key sharing unit (101) shares encryption keys with a plurality of external communication devices. The deciding unit (105), based on residual quantities of the encryption keys, decides on a route for sending transmission data. The encrypting unit (106) encrypts, for each external communication device of one or more external communication devices included in the route, a header in which the external communication device is set as a destination, using an encryption key shared with the external communication device. The packet generating unit (104) generates a packet that includes the transmission data and one or more encrypted headers. The sending unit sends the generated packet along the route.