Intermediary Module for Encrypted Data Stream Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The widespread use of encryption protocols like HTTPS, TLS, and DTLS in Internet traffic hampers the ability of access providers to perform caching, content enrichment, and network management functions, leading to performance deterioration and loss of revenue streams, especially with the adoption of new HTTP2 protocols that multiplex connections and prevent differentiation of services.
Innovation Solution
A method that processes encrypted data streams by inserting intermediation requests within the data frames, allowing an intermediary module to perform operations like caching, enriching, and modifying data without decrypting the content, using existing protocols like HTTP2 to manage encrypted connections and provide additional information to service providers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption protocols (HTTPS, TLS, DTLS) are used to protect data confidentiality, then data security is improved, but the ability of access providers to perform caching and content enrichment functions deteriorates
Solution Approach 1:
The data stream is segmented into two distinct parts: encrypted data portions that maintain confidentiality, and metadata portions that remain unencrypted and accessible to intermediaries. This segmentation allows caching operations to be performed on metadata ( URLs, headers, authentication information) while the actual content remains protected through encryption.
Solution Approach 2:
An intermediary module is introduced that operates on unencrypted metadata within the encrypted data stream. This intermediary can perform caching, content enrichment, and network management functions by processing only the metadata portions, while the encrypted content portions pass through unchanged, thus resolving the conflict between security and intermediary functionality.
2Reliability
If encryption protocols are implemented to ensure data confidentiality, then trust between users and service providers is improved, but network management and authentication functions deteriorate
Solution Approach 1:
Network management information is segmented from the encrypted content and placed in unencrypted metadata sections. This allows network operators to perform authentication, billing, and quality of service management on the metadata while the user content remains encrypted, maintaining both user trust and network manageability.
Solution Approach 2:
An intermediary module acts as a mediator that processes unencrypted metadata for network management purposes (authentication, billing, QoS) while leaving encrypted content untouched. This enables network operators to maintain control over network resources and user management without compromising end-to-end encryption of user data.
3Productivity
If HTTP2 protocol with TLS encryption is used to multiplex connections, then connection efficiency is improved, but the ability to differentiate services and insert signaling information deteriorates
Solution Approach 1:
HTTP2 frames are segmented into those carrying encrypted application data and those carrying unencrypted metadata. The unencrypted metadata frames can be inspected and modified by intermediaries for service differentiation, while encrypted data frames maintain security. This allows signaling information to be embedded in metadata sections without compromising connection efficiency.
Solution Approach 2:
Service differentiation and signaling capabilities are moved to a different dimension (metadata layer) rather than attempting to modify the encrypted data layer. This allows HTTP2 multiplexing to maintain its efficiency benefits while adding a parallel metadata dimension that intermediaries can use for service differentiation, authentication, and signaling without interfering with the encrypted content.
4Reliability
If full encryption is applied to all data streams, then data confidentiality is improved, but the ability to perform content analysis and audience measurement deteriorates
Solution Approach 1:
Data streams are segmented into encrypted content portions and unencrypted metadata portions. The unencrypted metadata contains information suitable for analysis (URLs, headers, authentication data, signaling information) that can be used for audience measurement and content analysis, while the encrypted content portions maintain confidentiality. This segmentation resolves the contradiction by making only the necessary information accessible for analysis.
Data Source
AI summary
A method, a device and a program are provided for processing data. The method is implemented within an intermediary module. The data is transmitted between a customer module and a server module connected through a communications network. The method includes: receiving, from one among the customer and server modules, an intermediation request identifying an operation of intermediation to be performed relative to a stream of encrypted data exchanged between the customer module and the server module; and processing relative to said encrypted data as a function of said operation of intermediation.