Multipath Encryption with Shared Keys and Distinct IVs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Encrypting multiple links across a network fabric between devices is challenging due to the increased number of paths and the need for secure, efficient encryption methods that ensure data confidentiality and integrity.
Innovation Solution
Implementing multiple cryptographic ordered flows with independent security associations, shared keys, and initialization vectors to secure multipath routing, using a high-performance load/store transport layer like NVLink over InfiniBand physical and data link layers, with encryption and decryption supported by an in-line compute engine for end-to-end encryption and decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple cryptographic ordered flows with independent security associations are implemented to secure multipath routing, then data confidentiality and integrity are improved, but key management complexity increases
Solution Approach 1:
The patent merges multiple cryptographic ordered flows to share a single security association and key between source and destination devices. Instead of establishing separate keys for each path, the system combines multiple flows under one unified key management structure, reducing key management complexity while maintaining security across all paths
Solution Approach 2:
The shared key and security association serve multiple cryptographic ordered flows simultaneously, making the key management system universal across all paths. This multi-functional approach allows a single key to protect multiple communication paths, eliminating the need for separate key management for each flow
2Reliability
If separate keys are used for each cryptographic ordered flow to ensure independent security, then security is improved, but the number of keys and management overhead increases
Solution Approach 1:
Multiple cryptographic ordered flows are merged to share a single key between source and destination devices. This consolidation reduces the total number of keys from potentially hundreds to just one or a few shared keys, while maintaining security through the use of initialization vectors to differentiate between flows
Solution Approach 2:
The shared key serves multiple cryptographic ordered flows universally, allowing one key to perform the security function for all paths. The system achieves this by deriving unique initialization vectors from path identifiers, enabling the single key to securely handle multiple flows without requiring separate keys for each
3Reliability
If encryption is implemented across all paths to ensure security, then data protection is improved, but processing overhead and performance increase
Solution Approach 1:
The system performs preliminary actions by establishing a single shared key and security association before data transmission begins. This upfront key establishment eliminates the need for repeated key setup and encryption/decryption operations for each path, reducing processing overhead while maintaining security across all flows
Data Source
AI summary
Technologies for encrypting communication links between devices are described. A method includes generating a first initialization vector (IV), from a first subspace of IVs, for a first cryptographic ordered flow, and a second IV, from a second subspace of IVs that are mutually exclusive from the first subspace. The first and second cryptographic ordered flows share a key to secure multipath routing in a fabric between devices. The method sends, to the second device, a first packet for the first cryptographic ordered flow and a second packet for the second cryptographic ordered flow. The first packet includes a first security tag with the first IV and a first payload encrypted using the first IV and a first key. The second packet includes a second security tag with the second IV and a second payload encrypted using the second IV and a second key.