Secure Routing Device for Encrypted Network Streams
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network architectures face challenges in routing encrypted data flows between remote enclaves while respecting broadcasting constraints and quality of service requirements, especially when direct connections are unavailable or insufficient, leading to complexity and confidentiality issues due to frequent decryption and encryption operations at intermediate enclaves.
Innovation Solution
A mechanism for routing encrypted streams that selects the most suitable path by establishing and maintaining a connectivity graph of logical links, inserting a marking value in packet headers, and encrypting all data except the header fields, allowing secure routing through intermediate enclaves without decryption, using interconnection and routing devices that communicate path associations and quality information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data flows are encrypted before crossing transport networks to ensure confidentiality, then security is improved, but routing and routing decisions become more complex because routing information must be preserved in encrypted packets
Solution Approach 1:
The packet structure is segmented into encrypted payload and unencrypted header portions. The header contains routing information (marking values) that remains readable while the data portion is encrypted, allowing routing decisions without decryption of the entire packet.
Solution Approach 2:
A gateway device acts as an intermediary between the red part (routing decisions) and black part (encrypted transmission). The gateway translates routing decisions into marking values that can be embedded in encrypted packets, enabling indirect communication between routing functions and encrypted data flows.
2Device complexity
If direct connections are used between enclaves to simplify routing, then routing complexity is reduced, but network reliability decreases when direct connections are unavailable
Solution Approach 1:
The routing system dynamically adapts between direct and indirect paths based on connectivity status. When direct connections are unavailable, the system automatically routes through intermediate enclaves using marking values that guide encrypted packets through multiple hops without requiring reconfiguration or decryption.
3Adaptability or versatility
If decryption and encryption operations are performed at intermediate enclaves to route encrypted streams, then routing flexibility is improved, but security and processing overhead worsen due to frequent cryptographic operations
Solution Approach 1:
Routing decisions and marking values are determined in advance before encryption occurs. The red part performs routing decisions on unencrypted data, and the resulting marking values are embedded in the encrypted packets, eliminating the need for decryption at intermediate points and reducing cryptographic overhead.
4Reliability
If multiple redundant transport networks are accessed to increase reliability, then communication reliability is improved, but network complexity and resource management become more difficult
Solution Approach 1:
The marking value system provides a universal routing mechanism that works across multiple transport networks and intermediate enclaves. The same marking value approach handles both direct and indirect routing, simplifying resource management across redundant networks compared to separate routing mechanisms for each path type.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Device (D) for interconnecting and routing between a remote local network (E_201 ) and at least one transport network (T_204, T_205, T_206) characterised in that it comprises: . first means (311) capable of selecting, for a communication stream coming from said source local network (E_201), at least one path to the remote network (E_203) for which it is intended and associating this path with a marking value (X), . means (317) of inserting the marking value (X) into a header field of the packets of said stream, . means (331) of encrypting the entirety of said stream except the header fields, . second means (321) capable of switching said encrypted stream towards the transport network (T_204) directly connected to said source local network (E_201) and located on the selected path, according to the marking value (X) read in the header field of said packets, . a gateway (341) for communicating, to said second means (342), the association between the marking value (X) and the switch to apply according to the path selected by said first means (311).