Overlay Network Header Routing for Single-Pass End-to-End Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software-defined enterprise networking solutions incur overhead and latency due to the need for encrypting and decrypting data multiple times at each border between overlay networks in hierarchical SDWAN deployments.
Innovation Solution
A method of securely routing data through multiple overlay networks by using an encapsulation header that encodes both nexthop destination addresses and lookup indices, allowing packets to traverse multiple networks without decrypting and encrypting at each border, utilizing abbreviated transport addresses and lookup indices to efficiently route data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If packets are encrypted and decrypted at each border between overlay networks, then data security is maintained across multiple networks, but overhead and latency increase
Solution Approach 1:
The packet is encrypted once at the source edge router before entering the overlay network tunnel. This preliminary encryption action eliminates the need for repeated encryption/decryption at intermediate border routers, reducing latency while maintaining security. The encrypted packet traverses multiple overlay networks using the same encryption key established at the source.
Solution Approach 2:
A single encryption key established at the source edge router serves multiple overlay networks along the transmission path. The same key is used for encryption at the source and decryption at the destination, making the encryption mechanism universal across multiple networks rather than requiring separate encryption layers for each network boundary.
2Reliability
If packets are encrypted and decrypted at each border between overlay networks, then security is maintained across overlay networks, but processing overhead increases
Solution Approach 1:
Encryption is performed once in advance at the source edge router before the packet enters the overlay network. This preliminary action eliminates multiple subsequent encryption/decryption operations at intermediate borders, significantly reducing processing overhead while maintaining security through the single encryption layer.
Solution Approach 2:
The encryption and decryption operations are extracted from the intermediate border routers and concentrated only at the source and destination edge routers. This extraction eliminates unnecessary processing overhead at intermediate nodes while preserving security through the maintained encryption layer throughout the overlay network traversal.
3Reliability
If multiple encryption layers are used for each overlay network, then security is strengthened, but complexity of routing increases
Solution Approach 1:
A single encryption key serves multiple overlay networks along the transmission path. The same key pair is used for encryption at the source and decryption at the destination regardless of how many overlay networks the packet traverses, simplifying routing complexity while maintaining security through consistent encryption across all networks.
Solution Approach 2:
Multiple encryption operations that would normally occur at each overlay network boundary are merged into a single encryption operation at the source edge router. The encrypted packet traverses all intermediate overlay networks without additional encryption/decryption, combining security protection across multiple networks into one unified encryption layer.
Data Source
AI summary
A system and method are provided for securely routing data through a series of overlay networks without decrypting and encrypting at boundaries between the overlay networks. The packet is routed through first and second overlay networks, and a second overlay network using a header in which the destination-address field encodes both a nexthop destination address and one or more lookup indices that uniquely that are used to look up subsequent nexthop destination addresses. Using a current destination address in the header, the packet is forwarded through the first overlay network to a first router between the overlay networks. A lookup index in the header is used to look up the next destination address (i.e., a transport address across the second overlay network to a second router), which overwrites the current destination address, so that the modified header can be used to forward the packet to the second router.