Media Data Security via Intermediate Node with Unified Protocol
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Secure Real-time Transport Protocol (SRTP) methods are inefficient when introducing an intermediate node, as they require decrypting and re-encrypting packets, wasting resources and not allowing the intermediate node to check packet integrity without accessing plaintext data.
Innovation Solution
Implementing a method where a single security protocol instance uses both hop-by-hop and end-to-end keys for transforming media data, allowing the intermediate node to perform security processing without accessing plaintext and reducing header requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SRTP intermediate node decrypts and re-encrypts packets, then packet security is maintained, but processing time and resource consumption increase
Solution Approach 1:
The patent extracts the decryption operation from the intermediate node's processing path. Instead of decrypting packets at the intermediate node, the system uses end-to-end encryption where only the endpoint devices perform decryption. This removes the time-consuming decryption step from the intermediate node's operations while maintaining security through cryptographic protection of the transmitted data.
Solution Approach 2:
The patent applies preliminary encryption at the source device before data leaves the origin point. By encrypting packets with end-to-end keys at the source, the system prepares the data for secure transmission without requiring intermediate decryption. This preliminary security measure allows intermediate nodes to forward encrypted packets directly, eliminating re-encryption delays.
2Reliability
If SRTP intermediate node decrypts packets to check integrity, then integrity verification is possible, but plaintext data access increases security risks
Solution Approach 1:
The patent introduces cryptographic hash functions as intermediary verification mechanisms. Instead of accessing plaintext data for integrity checks, the intermediate node computes hashes of encrypted packets and compares them against transmitted hash values. This intermediary hashing process enables integrity verification while maintaining the security barrier that prevents plaintext exposure.
Solution Approach 2:
The patent replaces the mechanical approach of decrypting and examining plaintext data with a cryptographic substitution method. Integrity verification is achieved through mathematical hash functions operating on encrypted data, eliminating the need for decryption-based verification and thereby removing the security vulnerability of plaintext exposure.
3Reliability
If multiple security protocol instances are used for hop-by-hop and end-to-end encryption, then security layers are enhanced, but header size and processing complexity increase
Solution Approach 1:
The patent merges multiple security protocol instances into a unified encryption framework. Instead of implementing separate hop-by-hop and end-to-end security protocols that would require distinct processing instances, the system combines these security functions into a single integrated protocol that handles both security requirements through unified key management and processing logic.
Solution Approach 2:
The patent creates a universal security protocol instance that performs multiple security functions simultaneously. The single protocol instance handles both hop-by-hop integrity verification and end-to-end confidentiality through multi-functional cryptographic operations, eliminating the need for separate specialized protocol instances and reducing overall system complexity.
Data Source
AI summary
A method and apparatus for sending protected media data from a data source node to a client node via an intermediate node. The data source node establishes a first hop-by-hop key to be shared with the intermediate node and an end-to-end key to be shared with the client node. A single security protocol instance is configured and used to trans-protocol form data from a media stream into transformed data using the keys. The transformed data is then sent to the intermediate node. The intermediate node uses the first hop-by-hop key to apply a security processing to the transformed data, and establishes a second hop-by-hop key with the client node. A second transformation is performed on the transformed data using the second hop-by-hop key to produce further transformed media data, which is then sent to the client node. At the client node a single security protocol instance is configured with the second hop-by-hop key and the end-to-end key, which are used to apply further security processing to the transformed media data.