Inline Key Exchange Using Path-Key Metadata in Network Packets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional network systems rely on centralized security servers for key distribution, which can lead to inefficiencies when network devices are unavailable, require excessive processing power due to frequent encryption and decryption, and lack direct connections, resulting in suboptimal network performance.
Innovation Solution
Implementing a method where each path in a network between two devices is associated with a path key, allowing network devices to encrypt and decrypt metadata within packets without the need for a centralized security server, enabling point-to-point payload key distribution and reducing processing power consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a centralized security server is used to distribute and update keys, then key management is centralized and simplified, but network performance deteriorates due to the server becoming a bottleneck and requiring excessive processing power for encryption and decryption at each intervening device
Solution Approach 1:
The patent extracts the payload encryption/decryption operation from the centralized security server model and places it only at the ingress and egress network devices. The payload key is embedded in metadata that only the egress device needs to decrypt, eliminating the need for intermediate devices to perform decryption operations, thus removing the processing bottleneck while maintaining centralized key distribution benefits
Solution Approach 2:
The patent introduces metadata as an intermediary carrier that transports the payload key through the network. This metadata structure allows the payload key to be securely transmitted through intermediate devices without requiring them to decrypt the actual payload, serving as a mediator that enables key distribution without the performance penalty of widespread decryption
2Stability of the object's composition
If keys are updated and a network device is unavailable during the update, then key consistency across the network is maintained, but the unavailable device cannot decrypt traffic from other devices that have already been updated
Solution Approach 1:
The patent applies preliminary action by embedding the payload key in the metadata of packets before they are forwarded through the network. This ensures that the egress device already possesses the necessary key material in advance, eliminating the need for real-time key synchronization and ensuring continuous decryption capability even when devices are unavailable during key updates
Solution Approach 2:
The patent segments the key management function into two distinct parts: path keys for metadata encryption (managed centrally) and payload keys for data encryption (embedded in packets). This segmentation allows payload keys to be independently distributed with each packet, eliminating the single point of failure that exists in centralized key storage and ensuring that unavailable devices do not disrupt overall network decryption capability
3Loss of information
If a network device inserts the key into the payload of a packet and the packet traverses the network being decrypted and re-encrypted at each intervening router, then the key reaches the destination, but processing power is excessively consumed due to repeated encryption and decryption
Solution Approach 1:
The patent applies local quality by making the decryption requirement local to only the egress network device rather than universal across all intermediate devices. The metadata is encrypted with path keys that only the egress device needs to decrypt, and the payload key extraction is performed locally at the destination, eliminating the energy-consuming repeated encryption/decryption cycles at each router while ensuring reliable key delivery
Data Source
AI summary
Techniques are disclosed for inline security key exchanges between network devices. An example network device includes one or more processors and memory coupled to the one or more processors. The memory stores instructions that, upon execution, cause one or more processors to obtain a first payload key and obtain a path key. The instructions cause the one or more processors to encrypt a first payload of a first packet using the first payload key and insert the first payload key into first metadata of the first packet. The instructions cause the one or more processors to encrypt the first metadata using the path key and send the first packet to another network device.