Hybrid Packet Structure for Secure Overlay Network Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security management for network communications between computing systems is cumbersome and difficult to deploy, especially in providing a cohesive inter-computing system security policy without modifying applications or networking device configurations.
Innovation Solution
A method that generates network packets with both encrypted and non-encrypted portions, where the encrypted portion contains data and private addressing information, and the non-encrypted portion includes public addressing information and group identifier information, allowing secure communication between computing systems by using a communication service that operates alongside the operating system to manage permissions and encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security technologies (VLANs, encryption) are deployed to secure network communications, then security is improved, but deployment complexity and management difficulty increase
Solution Approach 1:
The network address space is segmented into communication groups with unique group identifiers. Each group represents a security domain, allowing applications to be organized into logical security zones without requiring complex VLAN configurations or firewall rules. This segmentation enables simplified security management by grouping applications based on security requirements rather than physical network topology.
Solution Approach 2:
A virtual network interface introduces an intermediary layer between applications and the physical network. This virtual interface automatically performs encryption, decryption, and address translation between private application addresses and public network addresses. The intermediary handles security operations transparently, eliminating the need for complex security policy configurations on traditional networking devices.
2Reliability
If a cohesive inter-computing system security policy is implemented, then security management is improved, but modifications to applications and networking device configurations are required
Solution Approach 1:
The virtual network interface provides multiple security functions within a single component: encryption/decryption, address translation, group identifier verification, and packet routing. This multi-functional approach consolidates what would otherwise require separate configurations on firewalls, routers, and applications into a unified security mechanism that operates transparently across the system.
Solution Approach 2:
The virtual network interface automatically manages security operations without requiring manual configuration or intervention. It self-configures encryption keys, performs address translation, and enforces security policies based on group identifiers. This self-service capability eliminates the need to modify applications or configure traditional networking devices, as the security policy is implemented autonomously at the virtual interface layer.
3Reliability
If data and private addressing information are encrypted for security, then security is improved, but packet structure complexity increases
Solution Approach 1:
The network packet is segmented into distinct portions: an encrypted portion containing data and private addressing information, and an unencrypted portion containing public addressing information and group identifier. This segmentation allows the packet to carry both secure and routing information in a structured manner, with each portion serving a specific function without requiring complex overall packet structure.
Solution Approach 2:
The group identifier information is extracted from the encrypted portion and placed in an unencrypted field within the packet. This extraction enables receiving systems to identify the communication group and retrieve decryption keys without needing to decrypt the entire packet, simplifying the packet processing workflow while maintaining security for the sensitive data and private addressing information.
Data Source
AI summary
Described herein are systems, methods, and software to enhance secure communications between computing systems. In one implementation, a communication service identifies a communication request for a first application on a first computing system to transfer data to a second application on a second computing system. In response to the request, the communication service generates a packet, wherein the packet includes an encrypted portion for the data and private addressing associated with the first and second applications, and an unencrypted portion for group identifier information and public addressing information. Once the packet is generated, the packet is transferred to the second computing system.