Switch-Mediated Address Encryption for Source Privacy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing address encryption methods, particularly in servers, consume computing resources and still risk exposing the source device's address, compromising network security.
Innovation Solution
Implement address encryption and decryption operations at a switch using its computing power, mixing the source device's address with a random number, dividing it into blocks, and encrypting each block independently to generate a second address with a prefix and interface identifier fields, reducing computational overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If address encryption is performed at a server, then network security is improved, but computing resource consumption increases and address exposure risk remains
Solution Approach 1:
The patent introduces a switch as an intermediary device between the source device and server. The switch performs address encryption using its computing power rather than relying on the server, thereby protecting the source device's address while reducing the computational burden on servers. The switch acts as a mediator that handles the encryption/decryption operations locally within the network infrastructure.
Solution Approach 2:
The address encryption process is segmented into distinct components: the switch handles encryption/decryption operations, while the server focuses on providing core services. This segmentation allows the encryption function to be distributed to network infrastructure devices, reducing the computing resource consumption at the server level while maintaining security.
2Reliability
If address encryption is performed at a server, then address protection is improved, but address exposure risk to external networks remains
Solution Approach 1:
The switch serves as an intermediary that performs encryption before packets leave the local network and decryption after packets return. This ensures that the source device's address is protected not only from external networks but also from internal servers, eliminating the address exposure risk that remains when only server-side encryption is used.
Solution Approach 2:
The switch performs address encryption in advance before packets are transmitted to external networks or servers. By encrypting the address at the source end within the local network, the system prevents address exposure from the outset, rather than relying solely on server-side encryption which leaves gaps in protection.
3Reliability
If encryption operations are performed on the source device, then address security is improved, but device performance is degraded
Solution Approach 1:
The switch acts as an intermediary that takes over the encryption/decryption workload from the source device. By offloading these computationally intensive operations to the switch, the source device's performance is preserved while still achieving strong address security through the switch's encryption capabilities.
Solution Approach 2:
The switch provides self-service encryption capabilities using its own computing resources, eliminating the need for the source device to perform encryption operations. The switch independently handles the encryption/decryption process, allowing the source device to focus on its primary functions without performance degradation.
Data Source
AI summary
Embodiments of the present disclosure provide a method, an electronic device, and a computer program product that involve address encryption. The method includes: in response to receiving a packet from a source device, extracting a first address representing an address of the source device from the packet. The method further includes: mixing the first address with a random number to generate a mixed address, wherein the number of bits of the first address is the same as the number of bits of the random number. The method further includes: encrypting the mixed address. Moreover, the method further includes: generating a second address representing the address of the source device at least partially based on the encrypted mixed address, wherein the second address includes a prefix field and an interface identifier field. Illustrative embodiments can improve the security of the source device, and reduce computational overhead during address encryption and decryption.