Scalable VPN Node Decoupling Crypto Units
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication protocols, such as IPSec, face bottlenecks in encryption and decryption processes, particularly for software-based solutions on general-purpose computers, which can hinder data transfer rates as traffic increases.
Innovation Solution
Decoupling cryptographic operations from packet forwarding functions allows for the parallel operation of multiple cryptographic units, enabling concurrent encryption and decryption of packets, thereby increasing data transfer rates through the cryptographic part of the communication protocol.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software-based encryption and decryption are executed on general-purpose computers, then security protection is achieved, but data transfer rate deteriorates due to processing time consumption
Solution Approach 1:
The patent divides the cryptographic processing function into multiple independent cryptographic units (first cryptographic unit, second cryptographic unit, etc.), each capable of independently encrypting or decrypting packets. This segmentation allows parallel processing of multiple packets simultaneously, thereby increasing data transfer rate while maintaining security protection through distributed cryptographic operations.
Solution Approach 2:
The patent combines multiple cryptographic units into a single VPN endpoint node, allowing them to work together as a unified system. The packet aggregator coordinates these units to process incoming and outgoing packets, merging their individual capabilities to achieve higher overall throughput while maintaining the security functions of each unit.
2Productivity
If multiple cryptographic units operate in parallel, then data transfer rate is improved, but device complexity increases
Solution Approach 1:
Each cryptographic unit is designed as a universal component capable of performing both encryption and decryption operations. This multi-functionality reduces the need for separate specialized units for each operation, thereby managing system complexity while enabling parallel processing to improve data transfer rate.
Solution Approach 2:
The packet aggregator serves as an intermediary component that manages the complexity of coordinating multiple cryptographic units. It handles packet distribution to appropriate units, aggregates their outputs, and maintains the overall system structure, thereby shielding the complexity of parallel operations from the external interface.
Data Source
AI summary
A virtual private network (VPN) endpoint node is implemented on multiple virtual machines in a provider network. One or more virtual machines execute a packet aggregator. One or more other virtual machines implement cryptographic units. The packet aggregator is configured to distribute incoming encrypted packets from a secure tunnel across the plurality of cryptographic units. Each cryptographic unit is configured to decrypt incoming encrypted packets from the packet aggregator and to encrypt outgoing plaintext packets for transmission across the secure tunnel. The packet aggregator also may assign a sequence number to an outgoing plaintext packet, create a tunneled packet including the sequence number in a header of the tunneled packet and including the plaintext packet in tunneled packet, select one of the cryptographic units, and forward the tunneled packet to the selected cryptographic unit.