Kernel Transport Layer Security Mechanism for Transparent Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security mechanisms at the transport layer require separate libraries and corrections for each application program, leading to issues with transparency, expansibility, and performance degradation due to the need for separate socket interfaces for each application.
Innovation Solution
A method and apparatus that search for key information in a database, determine if a new key negotiation is needed, and perform encrypting/decrypting based on key information stored in the kernel, allowing for transparent and efficient security services at the transport layer without modifying existing application programs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate socket interfaces are used for each application program to provide transport layer security, then security service can be provided, but transparency is degraded and performance deteriorates
Solution Approach 1:
The patent merges the security service functionality into the kernel's transport layer (TCP/UDP protocols) rather than maintaining separate socket interfaces for each application. The encrypting/decrypting module operates within the kernel itself, combining multiple security functions into a unified system that handles all application programs through a common interface, thereby restoring transparency while maintaining security.
Solution Approach 2:
The patent creates a universal security mechanism that serves all application programs through the kernel's transport layer. The encrypting/decrypting module provides multi-functional security services (encryption, decryption, key exchange) that can be applied to any application program without requiring separate interfaces, making the security system universally applicable while maintaining ease of operation.
2Reliability
If separate socket interfaces are used for each application program, then security service can be provided, but device complexity increases
Solution Approach 1:
The patent combines multiple security functions (encrypting module, decrypting module, key exchange module) into a single integrated security mechanism within the kernel. Instead of having separate socket interfaces for each application, all security operations are consolidated in one location, significantly reducing device complexity while maintaining comprehensive security service.
3Reliability
If separate socket interfaces are used for each application program, then security service can be provided, but productivity decreases
Solution Approach 1:
The patent merges security operations into the kernel's transport layer processing path, eliminating the need for separate socket interface calls for each application. This integration allows security operations to be performed inline with normal data transmission, significantly improving productivity and performance while maintaining reliable security service.
Data Source
AI summary
Provided are a method and apparatus for providing a security mechanism guaranteeing transparency at a transport layer. The method includes: receiving a data packet from an application program, and searching key information corresponding to the data packet in key information database; determining whether to request a key exchange module of an application layer for a new key negotiation according to a result obtained by searching key information; and performing encrypting/decrypting based on key information when the key exchange module stores key negotiation information obtained by the new key negotiation in a kernel. The apparatus encrypts/decrypts the data packet at the transport layer of the kernel, thereby providing the application program with security transparency, effectively controlling and making it easily expansible.