Loose Source Routing for Reduced Packet Encryption at Intermediate Routers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques for transporting packets through intermediate routers in VPNs require decryption, re-encryption, and re-encapsulation, leading to wastage of computing resources and network congestion, reducing throughput.
Innovation Solution
Intermediate network nodes process packets without decryption, re-encryption, and re-encapsulation by updating the outer IP header with their own tunnel endpoint addresses, allowing them to route the packets directly, thus eliminating unnecessary encryption and encapsulation steps.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If decryption, re-encryption, and re-encapsulation are performed at intermediate routers, then security is maintained, but computing resources are wasted and network congestion increases
Solution Approach 1:
The packet transmission process is segmented into two distinct phases: secure encrypted transmission through intermediate routers using outer IP headers, and secure decapsulation at endpoint routers using inner IP headers. This segmentation allows intermediate routers to handle only routing without decryption, while endpoint routers perform security operations, thus resolving the contradiction between security and throughput.
Solution Approach 2:
Dual IP header structure acts as an intermediary mechanism that enables intermediate routers to route packets based on outer IP headers without accessing or processing the encrypted inner IP header content. This intermediary layer allows routing functionality to be separated from security processing, improving throughput while maintaining security at endpoints.
2Reliability
If decryption, re-encryption, and re-encapsulation are performed at intermediate routers, then security is maintained, but computing resources are wasted
Solution Approach 1:
Security processing operations are segmented and concentrated exclusively at endpoint routers (ingress and egress) rather than being distributed across all intermediate routers. Ingress routers perform initial encryption and encapsulation, while egress routers perform final decapsulation and decryption. This segmentation eliminates redundant computing operations at intermediate routers, conserving energy and computing resources while maintaining security.
Solution Approach 2:
The heavy security processing functions (encryption and decryption) are extracted from intermediate routers and relocated to endpoint routers. Intermediate routers are left with only lightweight routing functions based on outer IP headers. This extraction eliminates wasteful computing resource consumption at intermediate routers while preserving security operations at appropriate locations in the network.
3Reliability
If decryption, re-encryption, and re-encapsulation are performed at intermediate routers, then security is maintained, but network congestion increases
Solution Approach 1:
The network processing workflow is segmented such that intermediate routers handle only fast routing decisions based on outer IP headers, while time-consuming security operations are performed only at endpoint routers. This segmentation creates a bottleneck-free path through intermediate routers, reducing network congestion and transmission delays while maintaining security at endpoints.
Solution Approach 2:
The outer IP header serves as an intermediary that enables intermediate routers to perform routing functions without accessing or processing the encrypted inner IP header. This intermediary mechanism allows intermediate routers to operate at full speed without the computational overhead of decryption, thereby reducing network congestion and latency while security is maintained at endpoint routers through inner IP header processing.
Data Source
AI summary
A network node may receive a packet having an inner internet protocol (IP) header and an outer IP header. The inner IP header may be encrypted. A loose source routing (LSR) field of the outer IP header may identify a recipient address. The network node may determine, based on the recipient address identified in the LSR field, a tunnel endpoint associated with a receiving network node. The network node may update the outer IP header of the packet to obtain an updated packet with an updated outer IP header. A source address of the updated outer IP header may be updated to a tunnel endpoint associated with the network node, and the destination address of the updated outer IP header may be updated to a tunnel endpoint associated with the receiving network node. The network node may route the updated packet according to the updated outer IP header.