Encrypted Packet Duplication Across Tunnels Without Redundant Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network devices waste computing resources by redundantly encrypting and decrypting multiple copies of the same packet over multiple tunnels, leading to unnecessary processing overhead.
Innovation Solution
A transmitting network device encrypts a packet once and duplicates it, encapsulating each copy with a tunneling protocol to include the same virtual tunnel endpoints, allowing the receiving network device to identify duplicates by decapsulating the packets without decryption, thus conserving resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple copies of an encrypted packet are transmitted via multiple tunnels, then reliability of data transmission is improved, but computing resources are wasted due to redundant encryption and decryption operations
Solution Approach 1:
The transmitting network device performs encapsulation with tunnel identifiers before transmission, enabling the receiving device to identify and filter duplicate packets at the tunnel layer before decryption occurs. This preliminary identification action prevents redundant decryption operations, resolving the contradiction between transmission reliability and computing resource consumption
2Measurement precision
If the receiving network device decrypts each packet to identify duplicates, then duplicate detection accuracy is improved, but processing time is increased due to redundant decryption operations
Solution Approach 1:
The tunnel identifier is extracted from the encapsulated packet structure and used as a standalone identification key. The receiving device compares these extracted identifiers to detect duplicates, eliminating the need to decrypt packets for identification purposes. This extraction approach maintains identification accuracy while reducing processing time
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
A network device may receive, from a transmitting network device, a packet, wherein the packet includes a first outer internet protocol (IP) header, a Generic Routing Encapsulation (GRE) header, a second outer IP header, an Encapsulating Security Payload (ESP) header, and an inner packet, wherein the inner packet is encapsulated by the ESP header, the ESP header is encapsulated by the second outer IP header, the second outer IP header is encapsulated by the GRE header, and the GRE header is encapsulated by the first outer IP header. The network device may decapsulate the packet to remove the first outer IP header and the GRE header from the packet. The network device may decrypt, after decapsulating the packet, the packet to identify the inner packet. The network device may cause one or more actions associated with the inner packet to be performed.