Secure QoS Packet Flow Identification Using Pseudorandom Headers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Communications networks face challenges in securely prioritizing and allocating resources to different packet flows, as existing QoS mechanisms can be abused, impairing network performance and interfering with other users.
Innovation Solution
The solution involves securely labeling packet flows by varying values in packet headers using a common key value for both transmitting and QoS enforcement devices, generating pseudorandom values for packet flow identification fields, ensuring that only authorized packets receive requested Quality of Service (QoS) attributes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If QoS mechanisms are implemented to prioritize packet flows, then network resource allocation is improved, but security against abuse deteriorates
Solution Approach 1:
The system performs preliminary authentication and key distribution before QoS enforcement. The transmitting device and QoS enforcement device establish shared secret keys in advance, which are used to generate pseudorandom packet flow identification values. This preliminary action ensures that only authorized devices can request and receive prioritized service, preventing abuse before it occurs.
Solution Approach 2:
The system uses pseudorandom packet flow identification values that are generated by both the transmitting device and QoS enforcement device using the same key. These generated values serve as secure copies or representations of the actual packet flow identity, allowing the system to enforce QoS based on these cryptographic copies rather than directly exposing the real flow identifiers.
2Reliability
If packet flow identification is made secure using pseudorandom values, then security against abuse is improved, but device complexity deteriorates
Solution Approach 1:
The system uses a universal key distribution mechanism where the same secret key serves multiple purposes: it is used by both the transmitting device and QoS enforcement device to generate pseudorandom packet flow identification values. This multi-functionality eliminates the need for separate authentication and QoS enforcement mechanisms, reducing overall system complexity while maintaining security.
3Reliability
If pseudorandom values are generated for each packet, then security is improved, but processing time deteriorates
Solution Approach 1:
The pseudorandom packet flow identification values are generated using pre-shared keys that are established before packet transmission. This preliminary key distribution allows both the transmitting device and QoS enforcement device to independently generate matching pseudorandom values without real-time communication, significantly reducing packet processing time while maintaining security.
Data Source
AI summary
Methods and apparatus are provided for communicating a flow of packets with a requested quality of service. An exemplary method involves receiving a first packet of a flow, determining a first reference value for the packet flow identification field of the first packet using a key value, and facilitating the requested quality of service for the first packet when the received value of the packet flow identification field of the first packet matches the first reference value. The method continues by receiving a second packet of the flow, determining a second reference value for the packet flow identification field using the key value, and facilitating the requested quality of service for the second packet when the received value of the packet flow identification field of the second packet matches the second reference value.