Network Tap Cryptographic Signature for Data Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for storing network information lack secure and tamper-proof mechanisms, particularly in digital telecommunication networks, making it difficult to ensure the integrity and authenticity of captured data for forensic analysis and legal contexts.
Innovation Solution
A method utilizing a network tap with a processing unit to divide network information into sequences, add sequence numbers, and sign blocks with cryptographic signatures, ensuring authenticity and integrity by using asymmetric cryptography and storing these signed blocks on an external storage device, which remains undetectable and unalterable.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network information is stored using conventional methods, then storage is simple and accessible, but the data lacks tamper-proof mechanisms and cannot ensure integrity and authenticity
Solution Approach 1:
The network information is divided into multiple sequences, with each sequence processed and signed individually. This segmentation allows for granular integrity verification while maintaining overall data security, resolving the contradiction by making the complex cryptographic process manageable through division into smaller, independent units.
Solution Approach 2:
Sequence numbers are added to each sequence before storage, establishing a predefined ordering structure in advance. This preliminary action enables later verification of data completeness and order without requiring complex real-time processing, thus improving reliability while controlling complexity.
Solution Approach 3:
Cryptographic signatures are introduced as an intermediary mechanism between the network information and storage. The signatures act as a trusted mediator that verifies authenticity and integrity without requiring direct complex verification of the entire data set, resolving the contradiction by adding a layer of security that manages complexity through abstraction.
2Reliability
If cryptographic signatures are added to each block of network information, then data authenticity and integrity are ensured, but processing time and computational resources increase
Solution Approach 1:
By dividing network information into smaller sequences and signing them individually, the cryptographic processing is broken into manageable chunks. This allows parallel processing of multiple sequences simultaneously, reducing overall processing time while maintaining authentication for each segment, thus resolving the time-reliability contradiction.
Solution Approach 2:
The system applies cryptographic signatures to sequences rather than treating the entire data set as one unit. This partial action approach processes only necessary portions at each step, reducing cumulative processing time while still providing comprehensive authenticity verification through the chain of signed sequences.
3Object-affected harmful factors
If the network tap is made invisible without a MAC address, then it cannot be detected by external attackers, but it cannot actively participate in network communication
Solution Approach 1:
The network tap extracts network information passively without requiring active network participation. By taking out only the necessary data for analysis while remaining invisible to the network, the system resolves the contradiction by separating the monitoring function from active network communication, achieving security through passive observation rather than active engagement.
Solution Approach 2:
The network tap acts as an invisible intermediary that captures network information without being detected. It mediates between the network traffic and the analysis system, allowing data collection for security purposes while maintaining network transparency and avoiding detection by attackers, thus resolving the contradiction between invisibility and functionality.
Data Source
Figure 1~2
Figure 3~4
AI summary
The application provides a method of storing network information (NI), comprising the steps of: - determining network information (NI) with a network tap (5) having a processing unit (7), - dividing the determined network information (NI) into a plurality of sequences (SQ), - adding to each sequence (SQ) a first information (I1) in the processing unit (7), said first information (I1) being representative of a sequence number, such that each sequence (SQ) and the respective first information (I1) form a block (B), - signing at least one block (B) with a signature (SIG) such that a signed block (B) is generated, and - storing the signed block (B) on a storage device. Furthermore, a device, a signalling control, a railway vehicle, a computer program and a computer-readable storage medium are provided.