Ordered Proof of Transit Verification in Network Nodes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for proof of transit in networks do not effectively verify the ordered traversal of packets across nodes, are computationally costly, and require a central key server, making them vulnerable to attacks and potential security risks.
Innovation Solution
The implementation of ordered proof-of-transit (OPoT) using symmetric encryption algorithms and key exchange technologies to secure Shamir's Secret Sharing scheme, ensuring that packets traverse a specified path in the correct order by encrypting and decrypting metadata with private keys at each node, eliminating the need for a central key server and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Shamir's Secret Sharing scheme with two polynomials is used to validate packet transit, then the ability to verify packet traversal is improved, but security vulnerability increases due to passive attackers being able to tap traffic and calculate Lagrange polynomial coefficients
Solution Approach 1:
The patent extracts the verification value calculation from the packet metadata itself and moves it to the egress node. By removing the second polynomial from the metadata and only keeping the first polynomial's evaluation, the packet carries minimal information that attackers can exploit. The egress node independently calculates the verification value using its own share of the secret, preventing attackers from gathering enough information to bypass intermediate nodes.
Solution Approach 2:
The patent introduces the egress node as an intermediary that holds a share of the secret and independently verifies packet traversal. This intermediary prevents passive attackers from successfully tapping traffic, because the verification value cannot be calculated without the egress node's secret share. The egress node acts as a mediator that ensures the integrity of the verification process.
2Ease of operation
If cumulative encryption with XOR operation is used for proof of transit, then ease of operation is improved, but the ability to verify ordered traversal is worsened because the commutative property allows verification in any order
Solution Approach 1:
The patent applies asymmetry by making the verification process non-commutative through the use of ordered polynomial evaluations. Each intermediate node evaluates the first polynomial at a specific point determined by its position in the path, creating an asymmetric verification sequence. This ensures that packets must traverse nodes in the correct order, as reversing or shuffling the sequence would produce incorrect verification values at the egress node.
3Ease of operation
If a central key server is used to distribute secret keys to nodes, then ease of key management is improved, but device complexity and security risks increase due to the single point of failure
Solution Approach 1:
The patent extracts the key distribution function from a central key server and distributes key generation responsibilities to individual network nodes. Each node independently generates its own secret share using local randomness, eliminating the need for a centralized key server. This extraction removes the single point of failure while maintaining secure key management through the properties of Shamir's Secret Sharing.
Solution Approach 2:
The patent enables self-service by allowing each network node to independently generate and manage its own secret share without requiring a central authority. Nodes autonomously participate in the secret sharing scheme, generating their shares locally and using them for verification. This self-service approach eliminates the central key server infrastructure while maintaining security and simplifying the system architecture.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method for validating proof of transit of network traffic through network nodes (N), the node (N) comprising a set of input interfaces (20) receiving incoming packets, a first module (A) to identify a matching route within a routing table (23) and storing means (22) to provide next modules (B, C, D) with two private keys if the packet is matched and/or the packet metadata includes OPoT information. The second module (B) decrypts the OPoT metadata using the first private key associated to the link of the node from which the incoming packets are received. The node (N) has SSS metadata to be processed by a third module (C) for the correct generation of cumulative validation parameters. When the SSS process is finished by the third module (C), the fourth module (D) re-encrypts the OPoT metadata using the second private key before packet forwarding to the subsequent node in the path through output interfaces (21).