Encrypted Session Packet Capture Using QUIC Header Markings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication networks face challenges in identifying and processing data streams from multiple applications due to encryption and multiplexing, particularly in the context of vehicle data services like eCall, where different types of data require distinct handling, and existing methods based on IP addresses are inadequate.
Innovation Solution
A method for discriminating messages from terminal equipment by adding attributes to information packets, allowing network devices to identify and process them based on application-specific markings, even in encrypted sessions using protocols like QUIC, by modifying parameters such as the 'spin bit' and 'Reserved Bits' in the QUIC header.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is applied to data streams for security, then confidentiality is improved, but the ability to identify and process specific data streams is worsened
Solution Approach 1:
The patent segments the identification problem by separating the encrypted data payload from identifiable metadata. Specifically, it extracts and identifies data streams based on unencrypted header information (source IP, destination IP, source port, destination port, protocol type) while the actual content remains encrypted. This allows network devices to perform flow identification and processing without decrypting the confidential payload.
Solution Approach 2:
The patent introduces an intermediary approach by using a network device (such as a gateway or router) that acts as a mediator between the encrypted data streams and the processing system. This intermediary device can inspect unencrypted header fields, identify specific data streams, and apply processing rules without compromising the encrypted nature of the actual data content, thus maintaining both security and identifiability.
2Productivity
If multiple data streams are multiplexed in a single connection, then bandwidth efficiency is improved, but the ability to differentiate and process individual streams is worsened
Solution Approach 1:
The patent applies local quality by assigning unique identification characteristics to specific segments (data streams) within the multiplexed connection. Each data stream is identified by its specific combination of header fields (source/destination IPs and ports, protocol type), allowing the network device to differentiate and apply processing rules to individual streams while they travel through the shared multiplexed connection.
Solution Approach 2:
The patent employs preliminary action by pre-configuring the network device with identification criteria for different data streams before the actual data transmission occurs. The device is预先 programmed with rules to recognize specific patterns in unencrypted header information, enabling it to automatically differentiate and process individual streams within the multiplexed connection without requiring real-time complex analysis.
3Ease of manufacture
If IP-based flow identification is used, then implementation simplicity is improved, but accuracy in identifying specific applications is worsened
Solution Approach 1:
The patent merges multiple identification parameters into a comprehensive data stream identification system. Instead of relying solely on IP addresses, it combines source IP, destination IP, source port, destination port, and protocol type to create a more precise identification framework. This multi-parameter approach maintains relative implementation simplicity while significantly improving application identification accuracy compared to IP-based methods alone.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
The invention relates to a method for capturing a packet from an encrypted session established between a terminal unit and a data server, said packet comprising a datum for determining a security key used for the encryption of the packet, the method being implemented by a device routing the packet between the terminal unit and the data server and comprising analysis of a plurality of packets transmitted by the terminal unit and destined for the server, identification of a cooperation packet from among the plurality of analyzed packets, said cooperation packet comprising the determining datum corresponding to a security key used for the encryption of packets transmitted by the terminal unit to the data server prior to the terminal unit sending said cooperation packet, and decryption of the received cooperation packet using a security key corresponding to the determining datum from the identified cooperation packet.