Route Advertisement Encryption Key Distribution for Scalable Secure Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The high network deployment complexity of IPSec-based traffic encryption processes, requiring dedicated encryption tunnels between network devices, hinders widespread use in large-scale networks.
Innovation Solution
A method for distributing encryption information through route advertisement packets, including encryption extended information, allowing network devices to generate keys and routing entries without establishing dedicated encryption tunnels, using TLV fields in BGP and OSPF messages to facilitate encrypted data transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dedicated encryption tunnels are established between network devices for IPSec-based traffic encryption, then security services are provided, but network deployment complexity increases
Solution Approach 1:
The patent merges the route advertisement function with the encryption key distribution function by carrying encryption extended information (including key generation parameters) within route advertisement packets. This integration eliminates the need for separate dedicated encryption tunnel establishment, thereby reducing network deployment complexity while maintaining security services.
Solution Approach 2:
The route advertisement packet is extended to serve multiple functions: it not only advertises routing information but also distributes encryption keys and parameters. This multi-functionality allows the same communication mechanism to handle both routing and security setup, simplifying the overall network deployment process.
2Reliability
If dedicated encryption tunnels are established between network devices, then encrypted traffic transmission is secured, but the process becomes difficult to implement in large-scale networks
Solution Approach 1:
Network devices automatically generate encryption keys locally using parameters received in route advertisement packets, without requiring manual configuration or separate key exchange protocols. This self-service mechanism enables automatic security setup across large-scale networks, improving scalability and ease of deployment.
Solution Approach 2:
Encryption key generation parameters are distributed in advance through route advertisement packets before actual encrypted traffic transmission begins. This preliminary distribution of cryptographic material enables devices to be pre-configured for secure communication, facilitating rapid deployment in large-scale networks.
Data Source
Figure 1~2
Figure 3~4
Figure 5~7
AI summary
A method for distributing encryption information is provided, which can implement encrypted transmission of data between two encryption parties, and effectively reduce network deployment complexity. The method includes: Encryption extended information is carried in a route advertisement packet to indicate a routing prefix and the encryption extended information related to the routing prefix. When receiving the route advertisement packet, a network device generates a key based on the encryption extended information in the route advertisement packet, and generates a routing entry with an encryption attribute. The routing entry can indicate the network device to encrypt data by using the key and then send encrypted data to a network indicated by the routing prefix. In this method, transfer of encryption information between a plurality of network devices is implemented based on the route advertisement packet, and the network device is guided to generate the routing entry with the encryption attribute, so as to ensure that the network device can implement encrypted transmission of a data packet based on the routing entry, without establishing a dedicated encryption tunnel between the network devices. This effectively reduces network deployment complexity.