Network Enclave Security Association Setup
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
High-performance networks face challenges in securing data confidentiality and integrity due to expensive cryptographic operations, which degrade user experience and hinder IT monitoring, and existing security protocols like IPsec and TLS are not fully pervasive due to these issues.
Innovation Solution
A network enclave system that uses a central network authority to establish and manage client-server security associations through lightweight protocols, eliminating the need for mutual authentication and reducing reliance on central authorities for session key distribution, allowing for efficient and seamless encryption and decryption of data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic operations are performed for all secured connections on high performance links, then data confidentiality and integrity are protected, but network performance degrades and user experience deteriorates
Solution Approach 1:
The patent segments the network into a secure enclave and untrusted network portions. Cryptographic operations are confined only to the enclave boundary rather than being applied to all network traffic. This segmentation allows high-performance computing resources within the enclave to communicate efficiently while maintaining security at the perimeter.
Solution Approach 2:
The patent introduces a trusted enclave as an intermediary between untrusted network sources and high-performance computing resources. The enclave performs authentication and cryptographic verification of incoming connections, then establishes secure channels. This intermediary approach prevents expensive cryptographic operations from blocking high-performance network paths while maintaining security.
2Reliability
If asymmetric cryptographic operations are used for secure connection setup, then authentication and security are strengthened, but connection establishment time increases and Denial-of-Service opportunities arise
Solution Approach 1:
The patent performs asymmetric cryptographic authentication in advance during enclave entry, establishing security credentials before high-performance computing begins. Once authenticated, the enclave maintains secure connections using faster symmetric cryptography for data plane communications. This preliminary authentication approach separates the expensive security setup from ongoing high-speed data transfer.
Solution Approach 2:
The patent changes the cryptographic parameter regime by using asymmetric cryptography only for initial authentication and key exchange, then transitioning to symmetric cryptography for bulk data protection. This parameter change reduces connection establishment time and eliminates DoS vulnerabilities associated with continuous asymmetric operations while maintaining strong security.
3Reliability
If end-to-end encryption is implemented across the network, then data privacy is protected, but IT monitoring devices and IDS/IPS systems cannot perform their functions
Solution Approach 1:
The patent applies different encryption qualities to different network locations. End-to-end encryption is applied only to traffic entering and leaving the secure enclave, not to internal enclave traffic or trusted network segments. This local quality approach allows IT monitoring devices positioned within the enclave to inspect traffic for security purposes while maintaining strong privacy protection at the enclave boundaries.
Data Source
AI summary
Methods and apparatus are disclosed to provide for security within a network enclave. In one embodiment authentication logic initiates authentication with a central network authority. Packet processing logic receives a key and an identifier from the central network authority. Security protocol logic then establishes a client-server security association through a communication that includes a client identifier and an encrypted portion and/or an authorization signature, wherein a client authorization key allocated by the central network authority can be reproduced by a server, other than said central network authority, from the client identifier and a derivation key provided to the server by the central network authority to decrypt the encrypted portion and/or to validate the communication using the authorization signature. The server may also provide the client with new session keys and/or new client session identifiers using server-generated derivation keys if desired, protecting these with the client authorization key.