SD-WAN Controller Half-Key Distribution for Branch Node Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software-defined wide-area networks (SD-WANs) face challenges in efficiently establishing secure connections between branch nodes, leading to network strain and potential security vulnerabilities due to the need for extensive key exchanges and direct communications between nodes.
Innovation Solution
A method involving a SD-WAN controller and branch nodes that advertise and distribute half-keys via secure connections, using these half-keys to generate shared secret keys for encrypting payloads, thereby reducing network strain and enhancing security by avoiding direct key exchanges between nodes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If direct key exchanges are performed between branch nodes to establish secure connections, then security is improved, but network strain increases and scalability deteriorates
Solution Approach 1:
The SD-WAN controller serves as an intermediary that collects half-keys from branch nodes and distributes appropriate half-keys to establish shared secret keys. This mediator approach eliminates direct key exchange between branch nodes, reducing network strain while maintaining security through the controller's coordinated key distribution
Solution Approach 2:
The key exchange process is segmented into two parts: each branch node generates and advertises only its own half-key to the controller, rather than exchanging complete keys with all other nodes. This segmentation reduces the complexity and network strain of key distribution while enabling secure connection establishment
2Reliability
If extensive key exchanges are performed between branch nodes, then secure connections are established, but network performance deteriorates due to network strain
Solution Approach 1:
The SD-WAN controller acts as a central intermediary that handles all key distribution operations, preventing extensive peer-to-peer key exchanges that would strain network performance. The controller consolidates key management traffic, improving overall network performance while establishing secure connections
3Reliability
If direct communications between branch nodes are used for key exchanges, then security is enhanced, but scalability is reduced due to increased complexity
Solution Approach 1:
The SD-WAN controller serves as a scalable intermediary that can accommodate any number of branch nodes without requiring proportional increases in direct communications. Each node only communicates with the controller for key exchange, enabling the network to scale efficiently while maintaining security
Solution Approach 2:
The key management function is segmented and centralized at the controller, allowing individual branch nodes to be added or removed without affecting existing node communications. This segmentation enables easy scalability as nodes can independently join or leave the network through controller-mediated key distribution
Data Source
AI summary
A method for protecting data flows between pairs of branch nodes in a software-defined wide-area network (SD-WAN) is disclosed. In an embodiment, the method involves establishing secure connections between a SD-WAN controller and branch nodes in a plurality of branch nodes, wherein each branch node advertises a half-key to the SD-WAN controller via its secure connection, distributing advertised half-keys to branch nodes in the plurality of branch nodes via the established secure connections, wherein the advertised half-keys distributed to each branch node are the half-keys advertised by peer branch nodes of the branch node, and encrypting payloads for transmission from a first branch node in the plurality of branch nodes to a peer branch node in the plurality of branch nodes using a shared secret key, the shared secret key generated using the half-key of the first branch node and the distributed half-key of the peer branch node.