Network Device Session Packet Digital Signature Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network routing technologies face challenges in ensuring the security of packets during transmission across public or private networks, particularly due to the risk of tampering by 'man-in-the-middle' attacks, where packets can be modified or accessed by unauthorized entities, leading to difficulties in maintaining session integrity and security.
Innovation Solution
Implementing a method where network routing nodes digitally sign session packets using authentication keys, incorporating both payload and metadata, and utilizing a one-way hash function to validate the digital signature, ensuring that packets remain unaltered throughout their transfer between source and destination nodes, thereby mitigating tampering risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If digital signature validation is implemented for each packet, then security against man-in-the-middle attacks is improved, but processing complexity and computational overhead increase
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing hash values of packet payloads in a hash table before transmission. When a packet arrives, the receiver can quickly validate integrity by comparing the computed hash against the pre-stored hash value, rather than performing complex digital signature verification on every packet. This reduces real-time processing complexity while maintaining security.
Solution Approach 2:
The patent creates a copy of the payload hash and stores it separately in a hash table structure. This copy mechanism allows the system to validate packet integrity by comparing hashes without needing to re-process the entire payload or perform full digital signature verification, thereby reducing computational overhead while maintaining reliability.
2Reliability
If digital signatures are computed for all packets, then tampering detection is improved, but processing time and computational resources increase
Solution Approach 1:
The patent extracts the essential security function from full digital signature verification and implements only hash-based integrity checking. By taking out the computationally intensive digital signature computation and replacing it with faster hash function evaluation, the system maintains tampering detection capability while significantly reducing processing time per packet.
Solution Approach 2:
The patent changes the cryptographic parameter from full digital signature (which requires asymmetric cryptography and is computationally expensive) to hash function output (which is computationally lighter). This parameter change maintains the core security function of detecting tampering while reducing the computational resources and time required for validation.
3Reliability
If authentication keys are stored at each node, then security verification is improved, but key management complexity increases
Solution Approach 1:
The patent implements a universal hash function that can be applied to any packet payload regardless of content type or source. This single universal hashing mechanism serves multiple security functions including integrity verification, tampering detection, and authentication support, eliminating the need for separate key management systems for different packet types and simplifying overall key management complexity.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
A method processes a session having a first session packet received by a current node in an IP network having a plurality of nodes. The plurality of nodes includes a next node, and the current node that communicates with the next node using a Layer 3 protocol. The method receives the first session packet, which has a digital signature, payload data, and meta-data, at the current node. The method uses the payload data and meta-data to produce validation information, and uses the digital signature to produce a comparator digital signature. Next, the method compares the validation information with the comparator digital signature. If the validation information does not match the comparator digital signature, then the method discards the first session packet. If there is a match, then the method digitally signs the first session packet, and routes the first session packet to the next node via the IP network.