QUIC Multipath Token Validation for Seamless Path Switchover
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multipath QUIC systems in 5G networks face challenges in seamless connection switchover without compromising security, particularly for mobile devices moving between network coverage areas, as they struggle to efficiently manage IP address changes and validate new paths.
Innovation Solution
The implementation of make-before-break and break-before-make switchover techniques in QUIC multipath systems, where a QUIC client acquires a new IP address and sends a path modification request with an address validation token to a CDN server, allowing seamless transition to a new network path without revalidating the IP address, thus reducing setup time and maintaining security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional IP address validation is performed during path switchover in QUIC multipath systems, then security is maintained, but setup time for new paths increases
Solution Approach 1:
The system performs preliminary actions by establishing a new path and obtaining a new IP address before breaking the old connection (make-before-break approach). The address validation token is prepared in advance and can be quickly presented when the new path is established, avoiding time-consuming validation procedures during actual switchover.
Solution Approach 2:
The address validation token acts as an intermediary mechanism that carries validation information without requiring full re-validation of the new IP address. This token enables the server to quickly accept the new path by trusting the pre-validated token, thus reducing setup time while maintaining security through the token-based verification system.
2Loss of time
If connection switchover is performed quickly without proper validation, then setup time is reduced, but security is compromised
Solution Approach 1:
The system performs IP address validation and generates an address validation token in advance, before the actual path switchover occurs. This preliminary validation ensures security requirements are met beforehand, allowing the actual switchover to proceed quickly without compromising security.
Solution Approach 2:
The address validation token provides feedback to the server about the validity of the new IP address. This token-based feedback mechanism allows the server to quickly verify the new path's legitimacy without performing time-consuming re-validation, thus maintaining security while reducing setup time.
3Ease of operation
If make-before-break switchover is used to maintain seamless connection, then connection continuity is improved, but system complexity increases
Solution Approach 1:
The system establishes the new path and obtains the new IP address before breaking the old connection, ensuring connection continuity. The address validation token is prepared in advance, simplifying the switchover process by having all necessary validation information ready before the actual transition occurs.
Solution Approach 2:
The address validation token serves as an intermediary that simplifies the make-before-break process by providing pre-validated authentication information. This token allows the server to quickly accept the new path without complex verification procedures, reducing the operational complexity despite maintaining connection continuity.
4Device complexity
If break-before-make switchover is used to reduce complexity, then system complexity is reduced, but connection continuity is affected
Solution Approach 1:
The system performs preliminary validation and token generation before the actual path break occurs. By having the address validation token ready in advance, the break-before-make process can proceed quickly with minimal disruption, as the server already has the validation information needed to accept the new path immediately after switchover.
Solution Approach 2:
The address validation token provides immediate feedback to the server about the new IP address validity. This feedback mechanism allows the server to quickly recognize and accept the new path after the connection break, minimizing the impact on connection continuity while keeping the system relatively simple.
Data Source
AI summary
A disclosed method is performed at a server (e.g., a content delivery network (CDN) server). The server receives from a QUIC client a first token, where the first token includes a first connection identifier that identifies a first path connecting the QUIC client to the server. The server validates the first token, including validating path properties associated with the first path extracted from the first token. The server further generates a second token associated with a second connection identifier that identifies a second path connecting the QUIC client to the server in accordance with a successful validation of the first token. Additionally, the server transmits the second token to the QUIC client.