Encrypted Segment Segmentation for Reliable Network Transmission
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In overlay networks, when jumbo packets are sent and one or more packets are lost during transmission, the destination host cannot decrypt the entire payload successfully due to missing segments, leading to inefficient re-transmission of the entire payload.
Innovation Solution
The sender host encrypts segments of the payload individually, each including an encryption header and authentication value, allowing the destination host to decrypt and reassemble the segments independently, and only re-transmit the missing segments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire payload is encrypted as a single unit with a single authentication value, then security is maintained, but packet loss causes complete re-transmission of all data
Solution Approach 1:
The patent divides the payload into multiple segments, each encrypted independently with its own authentication value. This segmentation allows the system to maintain security while enabling selective re-transmission of only lost segments rather than the entire payload, resolving the contradiction between reliability and productivity.
2Ease of operation
If jumbo packets are segmented into multiple packets, then MTU compliance is achieved, but packet loss causes re-transmission of entire payload instead of just lost segments
Solution Approach 1:
The patent applies segmentation both for MTU compliance and for enabling selective re-transmission. Each segment is independently encrypted and authenticated, allowing the destination to identify and request only the lost segments, thereby reducing network bandwidth usage while maintaining MTU compliance.
Solution Approach 2:
The patent implements feedback mechanisms where the destination host sends acknowledgment information about received segments back to the source. This feedback enables the source to identify which segments were successfully delivered and which need re-transmission, optimizing bandwidth usage.
3Device complexity
If authentication value is placed in the last packet only, then packet structure is simplified, but missing any segment prevents signature verification
Solution Approach 1:
The patent distributes authentication values with each segment rather than concentrating them in the last packet. This maintains simplified packet structure while ensuring that each segment can be independently verified, so missing any segment doesn't prevent verification of received segments.
Data Source
AI summary
A first host receives a packet from a first compute node for a second compute node of a second host. The payload is larger than a maximum transmission unit size. The first packet is encapsulated with an outer header. The first host analyzes a length of at least a portion of the outer header in determining a size of an encrypted segment of the payload. Then, the first host forms a plurality of packets where each packet in the packets includes an encrypted segment of the payload, a respective encryption header, and a respective authentication value. The payload of the first packet is segmented to form a plurality of encrypted segments based on the size. The first host sends the packets to the second host and receives an indication that a packet was not received. A second packet including the encrypted segment is sent to the second compute node.