Packet Segmentation for Secure Backhaul Latency Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Wireless service providers face challenges in reducing latency introduced by encryption protocols like IPSec when securing backhaul communications between wireless base stations and core networks, especially when the communication path is unsecure and not owned by the same service provider.
Innovation Solution
The method involves segmenting packets into a header portion and a payload portion, where the header portion is encrypted and sent through a secure tunnel, and the payload portion is sent unencrypted, allowing for efficient communication while minimizing latency, using a security function node to reconstruct the packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption protocol (IPSec) is used to secure backhaul communications, then security is improved, but communication latency increases
Solution Approach 1:
The patent segments IP packets into two portions: a first portion containing the IP header and a second portion containing the payload. This segmentation allows differential handling where only the header portion is encrypted and transmitted through the secure IPSec tunnel, while the payload portion is transmitted unencrypted. This resolves the contradiction by maintaining security for routing-critical header information while eliminating encryption overhead for large payload data, thereby reducing overall communication latency while preserving security.
2Reliability
If full packet encryption is used, then security is improved, but device complexity increases
Solution Approach 1:
The patent divides the packet processing into two distinct paths: one for the header portion that requires encryption/decryption operations, and another for the payload portion that can be processed more simply. This segmentation reduces device complexity by limiting the computational burden of encryption to only the smaller header portion, while the larger payload portion undergoes simpler forwarding operations.
Solution Approach 2:
The patent extracts the IP header from the complete IP packet and separates it from the payload. This extraction allows the header to be handled through the complex IPSec encryption path while the payload is handled through a simpler unencrypted path, thereby reducing overall device processing complexity while maintaining security for the critical header information.
3Reliability
If IPSec tunnel mode is implemented, then security is improved, but data transmission speed decreases
Solution Approach 1:
The patent segments the IP packet into header and payload portions, applying IPSec encryption only to the header portion which is then transmitted through the secure tunnel. The payload portion is transmitted separately without encryption. This segmentation significantly improves data transmission speed because the payload, which constitutes the majority of packet data, bypasses the time-consuming encryption and decryption processes while still maintaining security for the critical header information that enables proper routing and reassembly.
Data Source
AI summary
The present invention relates to methods and apparatus for reducing delay while providing secure communications between nodes. An exemplary method embodiment includes a first node performing the steps of: identifying packets corresponding to a first communications session, the first communications session corresponding to a first application type; segmenting at least a first packet corresponding to the first communications session into at least a first packet portion and a second packet portion, the first packet including a first packet header and a first packet payload, the first packet portion including at least a portion of the first packet header, the second packet portion including at least a portion of the first packet payload; communicating, in encrypted form, the first packet portion from the first node to a security function node; and communicating, in unencrypted form, the second packet portion from the first node to the security function node.