Encrypted Packet Integrity Signaling for Low-Overhead Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In high-data-rate communication networks like NR and LTE, the overheads for encryption and integrity protection are significant, especially for low-end devices, and existing methods expose packets to easy tampering and eavesdropping due to explicit integrity and encryption indications, leading to security vulnerabilities.
Innovation Solution
A method where a sending end indicates the integrity protection status of packets through an encrypted and integrity-protected ciphertext, reducing the need for full-packet encryption and integrity protection, while ensuring the receiving end can detect tampering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full packet encryption and integrity protection is applied, then data security is improved, but computational overhead and processing complexity increase significantly
Solution Approach 1:
The patent segments the packet into different parts with different security treatments. The first indication information is encrypted and integrity-protected to indicate security status, while the second indication information remains plaintext. This selective encryption approach reduces computational overhead compared to full-packet encryption while maintaining essential security functions.
Solution Approach 2:
Different parts of the packet are assigned different security qualities. The first indication information receives full encryption and integrity protection, the second indication information is left in plaintext format. This local differentiation optimizes the balance between security and computational efficiency by applying strong protection only where necessary.
2Ease of operation
If explicit integrity and encryption indications are provided in plaintext, then receiving end can easily identify packet security status, but packets become vulnerable to tampering and eavesdropping
Solution Approach 1:
Instead of providing security status indications in plaintext (traditional approach), the patent inverts the approach by encrypting the first indication information. The receiving end decrypts this encrypted indication to determine security status, thereby maintaining ease of identification while eliminating the security vulnerability of plaintext exposure.
Solution Approach 2:
The encrypted first indication information acts as an intermediary that conveys security status without exposing sensitive information. The receiving end uses the decryption key to translate this encrypted intermediary into actionable security status information, thereby mediating between security requirements and operational needs.
3Reliability
If encryption and integrity protection are applied to all packets, then security is enhanced, but processing time and energy consumption increase
Solution Approach 1:
The patent applies partial encryption and integrity protection only to the first indication information rather than the entire packet. This partial action approach provides sufficient security for the critical security status indication while avoiding the excessive processing time and energy consumption that would result from encrypting the entire packet.
Data Source
Figure 1~3
Figure 4~7
Figure 8~11
AI summary
This application discloses a data processing method and apparatus, a network-side device, and a terminal device, and belongs to the field of communication technologies. The data processing method in embodiments of this application includes: a sending end sends a first packet to a receiving end, where the first packet carries a first indication, the first indication indicates whether the first packet is integrity protected, and the first indication is a ciphertext, or the first indication is an integrity-protected ciphertext.