RSVP Dynamic Group Keying for Mixed Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Resource Reservation Protocol (RSVP) faces challenges in securing network communications, particularly when interacting with non-RSVP capable devices, due to the complexity and operational burden of conventional key distribution methods, which can lead to unauthorized actions and compromised security in mixed environments.
Innovation Solution
Implementing dynamic group keying, where a shared group key is distributed to a trusted set of RSVP devices, enabling cryptographic transforms and implicit authorization, thus securing RSVP messages even in environments with both RSVP-capable and non-RSVP-capable routers without requiring additional control packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional key distribution methods (manual or pair-wise) are used for RSVP authentication, then security can be provided, but the operational burden and complexity increase significantly
Solution Approach 1:
The patent merges multiple key distribution relationships into a single group key that is shared among multiple RSVP-capable devices. Instead of establishing separate pair-wise keys between each device pair, a single group key is distributed to all trusted RSVP devices, reducing the operational burden of key management while maintaining authentication security.
Solution Approach 2:
The group key serves multiple authentication purposes simultaneously - it can be used for securing RSVP messages between any pair of devices in the group, for authenticating Path messages, Resv messages, and other RSVP protocol messages. This universal key eliminates the need for multiple specialized keys.
2Reliability
If per-neighbor key approach is used for RSVP authentication, then security associations can be established, but it fails when IP hops exist between RSVP neighbors
Solution Approach 1:
The group key acts as an intermediary authentication mechanism that bridges RSVP-capable devices separated by non-RSVP-capable routers or IP hops. Since the group key is pre-distributed to all trusted RSVP devices, they can authenticate each other's messages even when intermediate devices cannot participate in RSVP security, eliminating the need for direct neighbor key pairs.
Solution Approach 2:
The patent segments the network into trusted RSVP-capable devices that share group keys and non-RSVP-capable intermediate devices. The security model is segmented so that authentication occurs at the RSVP-capable device boundaries using group keys, while intermediate devices are excluded from the security mechanism, allowing heterogeneous network compositions.
3Reliability
If frequent key changes are implemented to enhance security, then security is improved, but manual key distribution becomes increasingly burdensome
Solution Approach 1:
By merging all key distribution relationships into a single group key, the patent reduces key management operations from O(n²) pair-wise key updates to O(n) group key updates when n devices are involved. When keys need to be changed for security reasons, only one group key update is required rather than multiple pair-wise key updates.
Data Source
AI summary
In one embodiment, an apparatus associated with securing a Resource Reservation Protocol (RSVP) with dynamic group keying is provided. The apparatus may include a group key logic that interacts with a dynamic group key management logic. The dynamic group key management logic provides a group key to members of a set of RSVP-capable devices. The apparatus also includes an RSVP authentication logic to determine whether a received RSVP message was provided by a member of the set of RSVP-capable devices. The determination is made using implicit authorization that depends on the group key and that does not depend on a challenge/response protocol. In one embodiment the apparatus is a router.