IPsec Packet Fragmentation for Jumbo Datagram Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IPsec implementations face challenges with large data packets, leading to fragmentation by routers in untrusted networks and potential decryption failures due to unsupported reassembly, and hardware limitations in encrypting jumbo frames, resulting in dropped packets.
Innovation Solution
A method and apparatus that fragment IP datagrams into multiple packets with fragmentation information when they exceed a threshold, ensuring each packet is within the maximum transmission unit and hardware limitations, allowing secure IPsec processing without post-encryption fragmentation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional encryption methods (DES, RSA) are used for securing communications, then data confidentiality is protected, but computational overhead increases and processing speed decreases
Solution Approach 1:
The cryptographic key is segmented into multiple shares distributed across different storage locations. Instead of encrypting/decrypting with a single complex key, the system divides the key into n-1 shares stored in remote locations and 1 share stored locally, enabling parallel processing and reducing computational burden on any single node while maintaining security through threshold cryptography.
Solution Approach 2:
A secret sharing scheme acts as an intermediary mechanism between the encryption/decryption processes and the key storage. The secret sharing protocol enables secure key reconstruction without requiring direct access to the complete key, reducing the computational overhead associated with traditional key management while maintaining cryptographic security.
2Reliability
If data is encrypted and stored in remote databases, then data security is improved, but access time and retrieval speed increase
Solution Approach 1:
The cryptographic key is segmented into multiple shares distributed across different storage locations. Instead of encrypting/decrypting with a single complex key, the system divides the key into n-1 shares stored in remote locations and 1 share stored locally, enabling parallel processing and reducing computational burden on any single node while maintaining security through threshold cryptography.
Solution Approach 2:
The secret key shares are pre-distributed and stored in secure locations before data encryption is needed. This preliminary distribution of key shares eliminates the need for time-consuming key generation and exchange processes during data access, reducing overall access time while maintaining security.
3Reliability
If secret sharing schemes are implemented across distributed systems, then key security is improved, but system complexity increases
Solution Approach 1:
The secret sharing mechanism is designed to work with existing cryptographic protocols and distributed storage systems without requiring specialized hardware or complex custom implementations. The universal applicability of the scheme reduces system complexity by leveraging established technologies while maintaining enhanced security through the secret sharing architecture.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
Embodiments of the present disclosure provide methods and apparatuses for security communication. A method performed by a first communication device comprises determining whether a length of an Internet protocol, IP, datagram is larger than a threshold. The method further comprises, when the length of the IP datagram is larger than the threshold, fragmenting the IP datagram into two or more IP packets. The length of each of two or more IP packets is not larger than the threshold and each of the two or more IP packets is filled with fragmentation information. The method further comprises processing the two or more IP packets to generate two or more corresponding IP security, IPsec, packets. The method further comprises sending the two or more corresponding IPsec packets to a second communication device.