GRE Tunneling Packet Decryption at Intermediate Routers

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current techniques for transporting packets through intermediate routers in VPNs require re-encryption and re-encapsulation, leading to wastage of computing resources and network congestion, reducing throughput.

Innovation Solution

Intermediate network nodes process packets without re-encryption and re-encapsulation by generating a copy, decrypting it to identify the destination, updating the outer IP header, and routing the packet, thereby eliminating unnecessary encryption and encapsulation steps.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If re-encryption and re-encapsulation are performed at intermediate routers, then security is maintained, but computing resources are wasted and network congestion increases

Engineering Contradiction:

ImprovesecurityVSAvoidnetwork throughput

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent segments the encryption process by introducing a key management router that handles key distribution separately from intermediate routers. Intermediate routers receive pre-shared keys and can decrypt/encrypt packets without needing to perform full re-encryption, thus maintaining security while reducing computational overhead and improving network throughput.

Inventive Principle:

Principle #1Segmentation

2Reliability

If re-encryption and re-encapsulation are performed at intermediate routers, then security is maintained, but computing resources are wasted

Engineering Contradiction:

ImprovesecurityVSAvoidcomputing resources

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The key management router performs preliminary key distribution to intermediate routers before packet transmission. Intermediate routers receive and store pre-shared keys, enabling them to perform lightweight decryption and re-encryption operations rather than full cryptographic processing, thus conserving computing resources while maintaining security.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If re-encryption and re-encapsulation are performed at intermediate routers, then security is maintained, but network congestion increases

Engineering Contradiction:

ImprovesecurityVSAvoidnetwork delay

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent extracts the complex key management functionality from intermediate routers and concentrates it in a dedicated key management router. Intermediate routers are relieved of key management overhead and can focus on efficient packet forwarding with simplified decryption/encryption operations, reducing processing time and network delay while maintaining security.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentEP3758305B1GRE tunneling with reduced packet encryption at intermediate routers

Publication Date: 2023.06.14 JUNIPER NETWORKS INC

Figure 1A
Figure 1B
Figure 1C

AI summary

A network node may receive a packet having an inner internet protocol (IP) header and an outer IP header. The inner IP header may be encrypted. The network node may generate a copy of the packet to obtain a copied packet. The network node may perform decryption on one of the packet or the copied packet to identify a recipient address of the inner IP header. The network node may update the outer IP header of the other of the packet or the copied packet to obtain an updated packet with an updated outer IP header. A destination address of the updated outer IP header may be updated to a tunnel endpoint of a receiving network node that is associated with the recipient address. The network node may route the updated packet according to the updated outer IP header.