Parallel DTLS Rekeying Over SCTP for Long-Lived Secure Sessions

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing DTLS/SCTP solutions do not support long-lived SCTP associations, as DTLS 1.3 lacks mutual re-authentication and rekeying, and DTLS 1.2 renegotiation impacts applications with data draining during key changes, posing challenges for secure data transmission in mobile networks.

Innovation Solution

Establish parallel DTLS connections over the same SCTP association, enabling rekeying and mutual reauthentication with minimal application impact by using DTLS handshake and SCTP-AUTH, ensuring secure data transmission without pausing or delaying data transfer.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If DTLS 1.3 is used for secure data transmission, then security and confidentiality are improved, but mutual re-authentication and rekeying capabilities are lost

Engineering Contradiction:

ImprovesecurityVSAvoidmutual re-authentication and rekeying

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent divides the DTLS connection into multiple parallel connections (primary and secondary). Each connection can independently perform rekeying and mutual re-authentication operations, allowing the system to maintain security while enabling key rotation without interrupting the overall data transmission session.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent establishes a secondary DTLS connection in advance before the primary connection needs rekeying. When rekeying is required, the system switches to the pre-established secondary connection, avoiding the need to wait for rekeying completion and thus maintaining continuous secure communication.

Inventive Principle:

Principle #10Preliminary action

2Adaptability or versatility

If DTLS 1.2 renegotiation is used for key changes, then rekeying capability is improved, but application data transmission is paused during draining phase

Engineering Contradiction:

Improverekeying capabilityVSAvoiddata transmission continuity

Core Design Contradiction:

Adaptability or versatilityVSProductivity

Solution Approach 1:

The patent segments the DTLS connection into parallel primary and secondary connections. The rekeying operation is performed on the secondary connection while the primary connection continues to handle data transmission, eliminating the need to pause data flow during rekeying operations.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The secondary DTLS connection is established in advance with pre-configured security parameters. When rekeying is needed, the system can immediately switch to the secondary connection without interrupting data transmission, as the rekeying infrastructure is already in place.

Inventive Principle:

Principle #10Preliminary action

3Duration of action of stationary object

If SCTP association lifetime is extended to weeks or months, then connection stability is improved, but support for large SCTP messages and long-lived connections becomes more difficult

Engineering Contradiction:

ImproveSCTP association lifetimeVSAvoidsupport for long-lived connections

Core Design Contradiction:

Duration of action of stationary objectVSDevice complexity

Solution Approach 1:

The patent implements multiple parallel DTLS connections over the same SCTP association. This allows the SCTP association to maintain long lifetime while the DTLS layer provides periodic rekeying through parallel connections, managing the complexity of long-lived secure connections.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system pre-establishes multiple DTLS connections (primary and secondary) before the SCTP association reaches its intended long lifetime. This preliminary setup enables periodic rekeying operations to be performed without interrupting the long-lived SCTP association, simplifying the management of long-term secure connections.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS12500933B2Key replacement during datagram transport layer security (DTLS) connections over stream control transmission protocol (SCTP)

Publication Date: 2025.12.16 TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)

AI summary

Embodiments include methods, electronic device, storage medium, and computer program to implement parallel Data-gram Transport Layer Security (DTLS) connections over a stream control transmission protocol (SCTP) association. In one embodiment, a method at a first network node for encoding user messages for secure transmission to a second network node comprises: initiating a Datagram Transport Layer Security (DTLS) connection over a stream control transmission protocol (SCTP) association through a DTLS handshake using an existing Authenticated Chunks for SCTP (SCTP-AUTH) key from an existing DTLS connection over the SCTP association that transmits user messages: deriving a new SCTP-AUTH key from the initiated DTLS connection: transmitting further user messages through the initiated DTLS connection with the new SCTP-AUTH key: and closing the existing DTLS connection over the SCTP association upon confirmation that SCTP packets encrypted with the existing DTLS connection and SCTP packets authenticated by the existing SCTP-AUTH key have been delivered.