Encrypted Meta-Information Handling in Multiplexed Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In an all-encrypted and multiplexed communication environment, middleboxes struggle to effectively handle meta-information for packet treatment due to the limitations of existing signaling methods, particularly Deep Packet Inspection (DPI) and Shallow Packet Inspection (SPI), which are not applicable for encrypted and multiplexed traffic, leading to issues with packet misidentification and unintended treatment.
Innovation Solution
A system and method where the receiver entity encrypts meta-information using a connection-specific key and initialization vector, allowing the network entity to decrypt and process packets accordingly, ensuring that only the intended packets receive specific treatments, thus preventing misassociation and ensuring secure, connection-specific meta-information handling.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If end-to-end encryption is implemented for communication privacy, then security is improved, but meta-information visibility to middleboxes deteriorates
Solution Approach 1:
The patent segments the packet structure into encrypted payload and unencrypted header fields. The header contains meta-information (protocol type, port numbers, flow identifiers) that remains visible to middleboxes, while the payload is encrypted for privacy. This segmentation allows simultaneous achievement of communication privacy and meta-information visibility.
Solution Approach 2:
The patent introduces an intermediary mechanism where the sender entity inserts encrypted flow identifiers into the packet header. These encrypted identifiers act as intermediaries that middleboxes can read and process to apply QoS policies without being able to decrypt the actual communication content, thus resolving the contradiction between privacy and visibility.
2Productivity
If traffic multiplexing is implemented for resource sharing, then productivity is improved, but packet identification accuracy deteriorates
Solution Approach 1:
The patent applies local quality by assigning unique flow identifiers and marking specific header fields differently for each multiplexed stream. Each stream within the multiplexed connection has distinct identification characteristics in the packet header, allowing middleboxes to accurately identify and differentiate packets belonging to different streams despite sharing the same connection.
Solution Approach 2:
The patent adds another dimension to packet identification by incorporating flow identifiers and protocol type information into the packet header structure. This additional dimensional information in the header allows middleboxes to distinguish between multiplexed streams using criteria beyond just the connection five-tuple, thereby maintaining identification accuracy in multiplexed environments.
3Adaptability or versatility
If Deep Packet Inspection is used for packet treatment, then packet handling capability is improved, but applicability to encrypted traffic deteriorates
Solution Approach 1:
The patent extracts the meta-information and flow identification functionality from the encrypted payload and places it in the unencrypted packet header. This extraction allows middleboxes to perform packet treatment and QoS policies based on header information that remains visible, while the encrypted payload maintains its privacy properties. DPI can thus operate effectively without compromising encryption.
4Reliability
If connection-specific encryption is implemented for security, then reliability is improved, but system complexity increases
Solution Approach 1:
The patent implements a universal encryption approach where the same encryption mechanism and flow identifier format are used across all packet types and connection scenarios. The sender entity consistently inserts encrypted flow identifiers in the same manner regardless of the specific connection characteristics, simplifying the implementation while maintaining connection-specific security through the encryption of flow identifiers.
Data Source
AI summary
It is provided a system comprising a sender entity, a receiver entity, and a network entity interposed between the sender entity and the receiver entity. The receiver entity is configured to send a connection request to the sender entity, and to further send to the sender entity at least one encrypted meta-information for said connection. The sender entity is configured to insert the at least one encrypted meta-information into at least one packet of the connection. The network entity is configured to decrypt the at least one meta-information and to process the at least one packet on the basis of the decrypted at least one meta-information.