End-to-End Resource Reservation Authentication in Packet Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing resource reservation protocols in packet-switched networks require point-to-point authentication at every node, increasing processing burden and slowing down resource reservation, which is inadequate for timely data delivery in applications like videoconferencing and IP telephony.
Innovation Solution
Implementing end-to-end resource reservation authentication, where message integrity values are calculated and inserted in resource reservation messages at the source and destination nodes, reducing the need for authentication at intermediate hops.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If point-to-point authentication is performed at every node in the network path, then security and reliability of resource reservation are improved, but processing burden on nodes increases and resource reservation speed decreases
Solution Approach 1:
The authentication process is segmented into two distinct phases: path authentication (performed once by the source node to verify the entire path to destination) and message authentication (performed only at destination for resource reservation messages). This segmentation eliminates the need for every intermediate node to perform authentication operations, thereby reducing processing burden while maintaining security through the path authentication phase.
2Reliability
If point-to-point authentication is performed at every node, then message integrity is verified at each hop, but the number of authentication operations increases and processing time increases
Solution Approach 1:
Path authentication is performed as a preliminary action before resource reservation messages are exchanged. The source node authenticates the entire path to the destination node in advance, establishing security credentials that can be reused for subsequent message authentication. This preliminary authentication eliminates the need for repeated authentication operations at each hop, reducing processing time while maintaining message integrity verification.
3Reliability
If security relationships are established between every node in the path, then comprehensive security coverage is achieved, but device complexity and processing burden increase
Solution Approach 1:
The path authentication mechanism serves multiple functions: it verifies the integrity of the entire network path, establishes security credentials for intermediate nodes, and enables subsequent message authentication. By making the path authentication universal and applicable to the entire path, the system achieves comprehensive security coverage without requiring each node to independently manage complex security relationships with every other node.
Data Source
AI summary
A network device constructs an outgoing resource reservation message and determines an authentication value, using, for example, a cryptographic algorithm and at least a portion of the outgoing message. The network device identifies a destination node for the message and inserts the authentication value in the message. The network device sends the message across a network to the destination node for authentication at the destination node using the authentication value.