IP Packet Filter Translation for Encrypted Tunnel Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network communication technologies face challenges in classifying and routing IP data packets effectively when they are modified due to encryption or tunneling, leading to conflicts between QOS and security filters, which can render standard filters ineffective in recognizing modified packets.
Innovation Solution
The development of methods to translate IP data packet filters, allowing for proper classification and routing of modified packets by accommodating header modifications, and potentially establishing additional tunnels or control procedures to ensure required processing can be performed by all nodes in the communication link.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IP data packets are encrypted or tunneled to enhance security, then security is improved, but flow classification capability deteriorates because headers are modified or encrypted
Solution Approach 1:
The system performs preliminary actions by establishing security associations and translating filters before packet transmission. The home agent translates QOS filters into translated QOS filters that account for upcoming encryption or tunneling, ensuring classification capability is preserved before the packets are modified
Solution Approach 2:
The home agent acts as an intermediary between the QOS filter deployment system and the encrypted/tunneled packet stream. It receives original QOS filters, translates them into translated QOS filters that work with modified packets, and deploys these translated filters to appropriate network nodes
2Reliability
If QOS filters are deployed to maintain quality of service, then QOS is improved, but conflicts with security filters occur when packets are modified
Solution Approach 1:
The system performs preliminary translation of QOS filters before packets undergo encryption or tunneling. By translating filters in advance at the home agent, the system prevents filter conflicts from arising, rather than attempting to resolve them after they occur
Solution Approach 2:
The home agent changes filter parameters by translating original QOS filters into translated QOS filters with modified parameter values and formats. This translation adjusts the filter parameters to account for header modifications, encryption, or tunneling that will occur, allowing both QOS and security requirements to be satisfied
3Adaptability or versatility
If IP tunneling is implemented to enable specialized routing, then routing flexibility is improved, but standard filter recognition deteriorates due to header dislocation
Solution Approach 1:
The home agent performs preliminary translation of QOS filters to account for tunneling before packets are encapsulated. This advance translation ensures that filters are configured to recognize tunneled packets with their dislocated headers, maintaining classification accuracy despite the routing flexibility provided by tunneling
Data Source
AI summary
Methods and systems for solving the problem of special processing required by various communication network subsystems (e.g., QOS, security, tunneling, etc). In some cases the processing by one communication subsystem may result in modified IP data packets which may affect the application of additional processing of such packets. The methods and systems solve problem by translating filters and setting up additional tunnels or other procedures based on the use case so that all the end and intermediate nodes can do the required processing on modified packets. The methods and systems may take into consideration an overlap or intersection of two or more different types of packet filters. A first set of packet filters is translated to provide the desired packet classification for modified packets. The second set of packet filters may be translated based upon the translation applied to the first set of packet filters.