Selective Network Encryption for Redundant Traffic Protection

Solution Overview

Problem

Existing network encryption methods, such as IPsec, adopt an all-or-nothing approach that is inefficient for modern networks with significant application layer encryption, leading to performance bottlenecks and suboptimal security-efficiency balance.

Innovation Solution

Implementing intelligent network encryption by inspecting traffic attributes to determine if endpoint encryption is already in use, and selectively applying network layer encryption based on session data, with modes prioritizing either security or performance.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If network layer encryption is applied to all traffic, then security is improved, but network performance deteriorates due to redundant encryption

Engineering Contradiction:

ImprovesecurityVSAvoidnetwork performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent applies different encryption strategies to different traffic flows based on their specific characteristics. Instead of uniform encryption, the system inspects traffic attributes (protocol, port, destination) and applies network layer encryption only when necessary, allowing encrypted traffic to pass through without re-encryption. This localized approach optimizes security for unencrypted traffic while maintaining performance for already-encrypted traffic.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The system dynamically adjusts encryption behavior based on real-time traffic inspection. The network element monitors traffic attributes and session data to determine whether encryption is needed, changing its encryption policy from static to dynamic based on the specific characteristics of each traffic flow, thereby avoiding redundant encryption operations.

Inventive Principle:

Principle #15Dynamics

2Reliability

If network layer encryption is applied to all traffic, then security coverage is improved, but device complexity increases due to inspection and decision logic

Engineering Contradiction:

Improvesecurity coverageVSAvoidinspection and decision logic

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system applies encryption only to the extent necessary - specifically to traffic flows that require it based on their attributes. Rather than attempting to encrypt everything uniformly, the system performs partial encryption actions on unencrypted traffic while allowing already-encrypted traffic to pass through, reducing the complexity burden on network elements.

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The network element autonomously inspects traffic attributes and makes its own decisions about encryption based on session data and traffic characteristics. This self-service approach eliminates the need for complex centralized control systems, as each network element independently determines whether encryption is needed based on the traffic it encounters.

Inventive Principle:

Principle #25Self-service

3Reliability

If all traffic is encrypted at network layer, then security uniformity is improved, but processing time increases due to encryption overhead

Engineering Contradiction:

Improvesecurity uniformityVSAvoidprocessing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent applies different encryption strategies to different traffic flows based on their specific characteristics. Instead of uniform encryption, the system inspects traffic attributes (protocol, port, destination) and applies network layer encryption only when necessary, allowing encrypted traffic to pass through without re-encryption. This localized approach optimizes security for unencrypted traffic while maintaining performance for already-encrypted traffic.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The system applies encryption only to the extent necessary - specifically to traffic flows that require it based on their attributes. Rather than attempting to encrypt everything uniformly, the system performs partial encryption actions on unencrypted traffic while allowing already-encrypted traffic to pass through, reducing the complexity burden on network elements.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS12500871B2Network encryption based on traffic between source and destination

Publication Date: 2025.12.16 ORACLE INT CORP

AI summary

The present disclosure relates to intelligent network encryption of traffic between a source and a destination. In an example, a network element receives, during a session between the source and the destination, first traffic exchanged between the source and the destination. The network element determines whether a traffic exchange between the source and the destination is expected to be secured by at least one of the source or the destination at any of a network layer, a transport layer, or an application layer. The network element generates a decision whether to secure the first session at the network layer based on whether the traffic exchange is expected to be secured or unsecured. The network element implements the decision on at least one of the first traffic or second traffic exchanged between the source and the destination during the first session.