Encrypted Network Routing with QoS Header Copying
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In critical systems, the introduction of encryption devices between private and public networks complicates network control, as routers cannot guarantee quality of service or supervise paths due to lack of knowledge about encrypted data streams, leading to uncontrolled congestion when primary paths fail.
Innovation Solution
A method that allocates a class of service to data streams, marks packets with QoS information using the DSCP field, and configures encryption devices to copy this information in clear form, allowing routers to filter and redirect packets based on required service levels, ensuring guaranteed throughput and quality of service while maintaining confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If encryption devices are introduced to secure data transmission between private and public networks, then data confidentiality is improved, but network control capability deteriorates because routers cannot access QoS information of encrypted streams
Solution Approach 1:
The patent segments the data stream into two distinct parts: encrypted payload data and unencrypted QoS header information. The encryption device processes only the data portion while leaving the header containing QoS parameters (such as service class, bandwidth requirements, latency constraints) in clear text. This segmentation allows routers to access control information without compromising data confidentiality, as they can read the header to make routing decisions while the actual data remains encrypted throughout the public network transmission.
2Reliability
If complete encryption is applied to all data streams, then security level is improved, but router ability to supervise and control transmission paths deteriorates due to lack of visibility into application types and QoS requirements
Solution Approach 1:
The patent extracts QoS control information from the encrypted data stream and places it in a separate, unencrypted header section. This extracted information includes service class identifiers, bandwidth requirements, latency constraints, and other QoS parameters. By taking out this control information from the encrypted payload and placing it in accessible headers, routers can supervise transmission paths, detect application types, and control traffic flow without requiring decryption capabilities, thus maintaining high security levels while enabling effective path supervision.
3Reliability
If routers implement dynamic routing protocols to assign secondary paths when primary paths fail, then network reliability is improved, but congestion control deteriorates because routers lack knowledge of application constraints and required throughput
Solution Approach 1:
The patent implements preliminary action by embedding QoS information in packet headers before encryption, including service class identifiers and throughput requirements. When dynamic routing is needed due to path failure, routers can read these pre-positioned QoS parameters from the unencrypted headers and make informed decisions about secondary path selection. This preliminary placement of control information enables routers to perform congestion control and path selection based on actual application requirements rather than generic routing rules, thus maintaining both network reliability and congestion control efficiency.
Data Source
Figure 1
Figure 2
AI summary
The invention relates to a method for controlling the routing of a data stream through a meshed and encrypted network, comprising at least the following steps: a) tagging each data packet with the value of the class of service thereof, said tagging being inserted into a QoS field of the header of said packet; b) configuring the encryption device (102a, 102b, 102c) to encrypt the entirety of said data packet, thus producing an encrypted packet, and to generate a new header associated with said encrypted packet and comprising at least one recopy of said QoS field; c) configuring the routers (103a, 103b, 103c) to delete the packets having a specific QoS field value and not coming from or sent to the local private network (A, B, C) to which the router is directly connected.