Service Chain Verification via Segmented Attestations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for service chain verification in network communications lack the ability to perform partial chain verification, leading to inefficient resource utilization and inability to detect tampering or misrouting of packets, especially in dynamic environments with multiple independent entities.
Innovation Solution
A method and system that generate attestations for process certification and link certification, allowing for partial service chain verification by intermediate nodes that can act as both signers and verifiers, enabling early detection and handling of invalid packets, and allowing any entity to verify the process without relying on a shared secret strategy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If entire service chain verification is performed requiring all nodes to collaborate, then verification completeness is improved, but system complexity and resource consumption increase
Solution Approach 1:
The patent divides the service chain verification into two independent segments: process certification (PC) that verifies service function execution, and link certification (LC) that verifies packet transmission integrity between nodes. Each node independently generates PC for its own service function execution and verifies LC from previous nodes, eliminating the need for all nodes to collaborate simultaneously while maintaining comprehensive verification coverage.
2Loss of energy
If verification is performed only at the end of the service chain, then resource consumption is reduced, but detection of tampering or misrouting is delayed
Solution Approach 1:
The patent implements preliminary verification actions at each intermediate node along the service chain. Each node performs link certification verification on incoming packets and generates process certification for outgoing packets, enabling early detection of tampering or misrouting incidents before packets reach the final destination, thus reducing both resource waste from processing invalid packets and detection delay.
3Reliability
If symmetric cryptography is used for service chain verification, then security is improved, but adaptability to dynamic node addition/removal deteriorates
Solution Approach 1:
The patent extracts the key management complexity from the verification process by using asymmetric cryptography where each node has its own private key for generating process certifications and public key for verification. This eliminates the need for all nodes to share and manage common symmetric keys, allowing nodes to be dynamically added or removed from the service chain without requiring key redistribution or reconfiguration across the entire network.
4Reliability
If a high level of trust is required between collaborating entities, then security is improved, but collaboration potential is reduced
Solution Approach 1:
The patent introduces process certification and link certification as intermediary verification mechanisms that enable semi-trusted parties to collaborate securely. Instead of requiring high-level mutual trust between all entities, each node can independently verify the authenticity and integrity of packets from previous nodes through cryptographic certifications, allowing entities with varying trust levels to participate in the service chain while maintaining security through verifiable proofs of proper service function execution.
Data Source
AI summary
A system, node and wireless device are provided. An intermediate node is provided that includes processing circuitry configured to: receive a packet where the packet includes metadata associated with first input data of a first node, first output data of the first node, a first PC signature and a public cryptographic key associated with the first node, verify that the first PC signature corresponds to a process that led from the first input data to the first output data using the public cryptographic key, verify a link between first node and the intermediate node by comparing the received packet and the first output data, and determine whether to perform at least one service function on the packet based at least in part on the verification of the first PC signature and the verification of the link between the first node and the intermediate node.