End-to-End Cryptographic Context via Inline Messages
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computing environments, the repeated decryption and re-encryption of network packets by intermediary network devices lead to excessive consumption of computing resources and increased latency, particularly in cloud-based systems where traffic passes through multiple proxies, causing delays and load increases.
Innovation Solution
Establishing an end-to-end cryptographic context using in-line messages between a service node and network devices, allowing traffic to remain encrypted and bypass unnecessary decryption and re-encryption by intermediary nodes, thereby switching to a 'bit-pump mode' for direct transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network devices decrypt and re-encrypt traffic at each intermediary node, then security validation can be performed, but computing resources are excessively consumed and latency increases
Solution Approach 1:
The service node performs validation of the service before establishing the end-to-end cryptographic context with network devices. This preliminary validation ensures security requirements are met before encrypted traffic bypasses intermediate decryption steps, resolving the contradiction by prioritizing validation upfront rather than at each network node.
Solution Approach 2:
The patent extracts the decryption and re-encryption operations from intermediate network devices by establishing an end-to-end cryptographic context. The service node directly communicates encryption/decryption operations with endpoint devices, removing the computational burden from intermediate network devices while maintaining security through validated service nodes.
2Reliability
If separate cryptographic contexts are created between each network device, then intermediate security can be maintained, but traffic delay and load increase
Solution Approach 1:
The patent merges multiple separate cryptographic contexts into a single end-to-end cryptographic context that spans from the service node through intermediate network devices to the endpoint device. This single context allows traffic to remain encrypted end-to-end without being decrypted at intermediate nodes, eliminating the time loss associated with repeated decryption and re-encryption while maintaining security through the validated service node.
3Reliability
If traffic is encrypted end-to-end through multiple proxies, then security is improved, but computational overhead increases
Solution Approach 1:
The service node acts as an intermediary that is validated before establishing the end-to-end cryptographic context. This validated intermediary enables the system to maintain end-to-end encryption through multiple proxies while reducing computational overhead at intermediate network devices, as they no longer need to perform decryption and re-encryption operations.
Data Source
AI summary
Described embodiments provide systems and methods for establishing an end-to-end cryptographic context. A service node may be located intermediary between a client and server which provides a service to the client. At least one network device may be located intermediary between the service node and the server. The service node may obtain information for validating the service. The service node may establish an end-to-end cryptographic context between the service node and server through the network device(s). A first network device of the network device(s) may share a cryptographic context with the service node, which existed prior to establishment of the end-to-end cryptographic context. The service node may transmit a message to the network device encrypted using the first cryptographic context. The encrypted message may inform the first network device to pass through traffic that is encrypted using the end-to-end cryptographic context.