Secure Data Transfer via IP Packet Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The oil and gas industry's Terminal Management System (TMS) is vulnerable to hacking and malware spread due to standard TCP/IP connections between bulk plants and corporate networks, despite the use of sophisticated security systems.
Innovation Solution
The method involves intercepting the TCP/IP session to create a communication 'gap' by dividing IP packets into command and data portions, encoding the data into a text delimited non-IP format, and transmitting only the encoded data and command portions, ensuring secure data transfer without establishing a full TCP/IP session.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a full TCP/IP communication session is established between TMS and corporate billing system, then complete data exchange functionality is achieved, but system security is compromised due to vulnerability to hacking and malware spread
Solution Approach 1:
The patent segments the TCP/IP packet into distinct command portions and data portions, processing them separately through different encoding paths. This segmentation allows the system to maintain security by isolating command interpretation from data transmission, thereby reducing the attack surface while preserving full communication functionality.
Solution Approach 2:
The patent extracts and eliminates the unnecessary full TCP/IP session establishment, retaining only the essential command and data exchange functions. By removing the complex session management layer while preserving core data transfer capabilities, the system achieves enhanced security without sacrificing communication effectiveness.
2Reliability
If TCP/IP session is broken to create communication gap for security, then hacking and malware spread are prevented, but data transfer functionality may be impaired
Solution Approach 1:
The patent introduces an intermediary encoding/decoding layer that translates between the secure non-IP text format and the application-layer data requirements. This mediator maintains the communication gap for security while ensuring complete data transfer functionality by reconstructing the necessary information from encoded portions.
Solution Approach 2:
The patent changes the format parameter of data transmission from binary TCP/IP packets to text-based encoded portions. This parameter change enables security through format isolation while maintaining data transfer efficiency through structured encoding that preserves all necessary information for complete data exchange.
3Reliability
If IP packets are divided into command and data portions with separate encoding, then security is enhanced by isolating circuits, but processing complexity increases
Solution Approach 1:
The patent segments IP packets into command portions and data portions that are encoded separately using different encoding schemes. This segmentation enhances security by isolating the interpretation logic for commands from the transmission logic for data, reducing the risk of cross-contamination from security breaches while managing complexity through modular processing.
Data Source
AI summary
Systems and methods for securely transmitting data between terminals include receiving, by a first communication device, an internet protocol (IP) packet via a first application programming interface (API) running on a first computer, dividing, by a splitting unit in the first communication device, the IP packet into a command portion and a data portion, encoding, by a data encoding unit in the first communication device, the data portion into a text delimited non-IP format, transmitting, by a transmitting unit in the first communication device, the encoded data portion and the command portion, receiving, by a second communication device, the encoded data portion and the command portion, decoding, by a data decoding unit in the second communication device, the encoded data portion into IP format, combining, by a constructor unit in the second communication device, the decoded data portion and the command portion to regenerate the IP packet, and receiving, by a second API running on a second computer, the regenerated IP packet.