Subscriber Session Message Processing via FQDN Cryptographic Substitution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing message processing systems that use clear text in Diameter messages to convey originator identities across network domains expose topological information, leading to security risks and increased system load due to the need for mapping tables, which consume memory and require complex synchronization.
Innovation Solution
A method that applies cryptographic operations to Fully Qualified Domain Names (FQDNs) and identifiers in messages to generate cryptographic values, substituting portions of the FQDNs, thereby hiding originator identities without the need for mapping tables, reducing system load and simplifying synchronization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If clear text FQDN is used in Diameter messages to convey originator identities, then message routing and validation can be performed, but topological information is exposed leading to security risks
Solution Approach 1:
The patent introduces a proxy agent as an intermediary between the home network and visited network. The proxy agent receives messages with internal FQDNs, replaces them with external FQDNs, and forwards the modified messages. This intermediary layer protects the internal network topology from exposure while maintaining message routing functionality.
Solution Approach 2:
The patent changes the parameter of the FQDN from internal (exposing topology) to external (hiding topology). By transforming the FQDN parameter through substitution with externally visible addresses, the system maintains routing capability while eliminating the security vulnerability of topology exposure.
2Ease of operation
If a mapping table is maintained at the DEA to restore internal host names in incoming messages, then proper addressing is enabled, but system load increases and memory resources are consumed
Solution Approach 1:
The patent extracts the need for mapping tables entirely from the system. Instead of maintaining complex mapping tables at the DEA to restore internal host names, the solution uses external FQDNs that can be directly used for addressing without requiring lookup operations or table maintenance.
Solution Approach 2:
The external FQDNs are designed to be self-sufficient for addressing purposes. They contain all necessary information for routing and identification without requiring additional mapping or translation operations, eliminating the need for complex table maintenance at the DEA.
3Reliability
If mapping table entries are replicated in non-volatile memory for security reasons, then security is enhanced, but synchronization complexity increases for redundant DEAs
Solution Approach 1:
The patent removes the mapping table from the system entirely, eliminating the security vulnerability and synchronization complexity associated with replicated mapping tables in non-volatile memory. The external FQDN approach provides security without requiring complex replication and synchronization mechanisms.
4Object-affected harmful factors
If the DEA is configured as the only point of contact into and out of the network domain at the Diameter application level, then topology hiding is achieved, but the number of sessions that can be handled is limited by mapping table capacity
Solution Approach 1:
The patent extracts the mapping table dependency from the DEA architecture. By using external FQDNs that do not require mapping tables, the system removes the capacity limitation on the number of sessions that can be handled, while maintaining the topology hiding capability provided by the proxy agent.
Data Source
AI summary
A technique for hiding topological information in a message that leaves a trusted network-domain is presented. The message pertains to a subscriber session and comprises a Fully Qualified Domain Name (FQDN) of a message originator. The originator is located in a first network domain, and the message is directed towards a destination in a second network domain. A method aspect comprises the steps of receiving the message, determining the FQDN comprised in the message and determining an identifier associated with the message. The identifier comprises at least one of a subscriber identifier, a session identifier and a destination identifier. Further, the method comprises applying a cryptographic operation on the FQDN and the identifier, or on information derived therefrom, to generate a cryptographic value. The message is then processed by substituting at least a portion of the FQDN with the cryptographic value prior to forwarding the message towards the second network domain.