Fragmented Enciphered IP Packet Deciphering Without Reassembly
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The reassembly of fragmented IP packets, especially those encrypted and tunneled, is a time-consuming and resource-intensive process due to varying MTUs and additional security headers, leading to increased latency and overhead in network communication.
Innovation Solution
A poly-tuple look-up in an IPSEC engine with cache memory is used to decipher fragmented IP packets, where the deciphering state is saved and reused for subsequent frames, allowing forwarding of deciphered fragments without full reassembly, utilizing a 4-tuple comprising identity, protocol, and IP addresses for efficient processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If fragmented IP packets are fully reassembled and decrypted before forwarding, then data security and integrity are maintained, but network latency and processing overhead increase significantly
Solution Approach 1:
The patent applies segmentation by maintaining cipher state separately for each fragment rather than requiring complete reassembly. Each fragment is processed independently with its own cipher state context, allowing parallel processing and forwarding of individual fragments while maintaining security. This divides the monolithic decryption process into manageable segments that can be handled separately.
Solution Approach 2:
The patent implements preliminary action by pre-computing and storing cipher states for each fragment in advance. The cipher state is saved after processing each fragment and reused when subsequent fragments arrive, eliminating the need to re-process previous fragments. This preliminary preparation of cipher states significantly reduces processing time during actual packet forwarding.
2Reliability
If fragmented packets are reassembled before decryption, then encryption integrity is preserved, but processing complexity and resource consumption increase
Solution Approach 1:
The system segments the decryption process by maintaining independent cipher states for each fragment. Instead of reassembling all fragments and then decrypting, the system processes each fragment separately with its own cipher state context, reducing processing complexity while maintaining encryption integrity through proper state management.
Solution Approach 2:
The patent introduces an intermediary mechanism - the cipher state cache - that mediates between encrypted fragments and the decryption process. This intermediary stores and manages cipher states, allowing fragments to be processed in any order without requiring full reassembly, thereby simplifying the overall processing complexity while preserving security.
3Stability of the object's composition
If complete packet reassembly is performed, then proper ordering is ensured, but network throughput decreases due to time-consuming defragmentation
Solution Approach 1:
The patent applies preliminary action by pre-computing cipher states and storing them in a cache for each fragment. When fragments arrive, the system retrieves pre-computed states rather than recalculating them, enabling rapid processing and forwarding. This preliminary preparation maintains proper ordering through state continuity while dramatically improving network throughput by eliminating time-consuming reassembly operations.
Solution Approach 2:
The system uses copying by replicating and storing cipher states in a cache memory structure. Each fragment's cipher state is copied and stored for rapid retrieval, allowing multiple fragments to be processed efficiently without re-computation. This copying mechanism preserves ordering information while enabling high-speed parallel processing that increases network throughput.
Data Source
AI summary
The deciphering of fragmented enciphered IP packets is performed without requiring reassembly of the fragments. fragmented packets. When a first frame is deciphered a characteristic poly-tuple is saved against the state of the cipher, particularly an output vector. When the next frame comes in, the cipher would continue on from that previously saved state after a look-up of the poly-tuple. Each frame would then be sent on, deciphered, but still representing a fragment of the original packet. The poly-tuple employed for the look-up includes the identity and protocol fields from the IP header and at least one of the source IP address and the destination IP address. The deciphering process may commence with the combination of input data with an initializing vector and proceed by combining input data with a vector fed back from the output of the deciphering engine. The saved cipher state is employed as the initializing vector for the next frame.