TLS Decryption Padding Removal for Memory Efficiency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In TLS 1.3 protocols, the increased maximum padding length and absence of a padding length field in packets make it difficult to efficiently eliminate unnecessary padding data during decryption, leading to increased memory requirements and reduced data transfer efficiency.
Innovation Solution
An information processing apparatus that acquires and decodes TLS packets on a unit data basis, includes a padding processing unit to detect and restrict output of padding patterns, thereby preventing unnecessary data from being transferred to external devices, such as DRAM, optimizing data transfer efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the maximum padding length is increased to 2^14-1 bytes in TLS 1.3 to conceal packet type and content length, then communication security is improved, but buffer memory requirements increase and data transfer efficiency decreases
Solution Approach 1:
The patent extracts and removes the padding portion from the decrypted packet before transferring data to DRAM. The padding processing unit identifies and separates padding bytes from actual content based on the padding length field, eliminating unnecessary data transfer and reducing buffer memory requirements while maintaining security through proper padding handling
Solution Approach 2:
The patent segments the decrypted packet into two distinct parts: actual content and padding portion. By dividing the data stream and processing them separately, the system can transfer only necessary content to external devices, reducing the buffer memory needed for handling the entire packet including maximum 2^14-1 bytes of padding
2Reliability
If the maximum padding length is increased to 2^14-1 bytes in TLS 1.3, then communication security is improved, but data transfer efficiency decreases
Solution Approach 1:
The padding processing unit extracts and removes the padding portion from the decrypted packet before transferring data to DRAM. This extraction eliminates unnecessary data transfer operations, improving data transfer efficiency by ensuring only actual content is transferred to external devices while maintaining the security benefits of extended padding
Solution Approach 2:
The patent performs padding removal as a preliminary action immediately after decryption and before data transfer to external devices. By preprocessing the data to eliminate padding bytes in advance, the system optimizes subsequent data transfer operations and avoids wasting bandwidth on unnecessary padding transmission
3Reliability
If a field indicating padding length is eliminated from the packet in TLS 1.3, then communication security is improved, but the ability to efficiently eliminate padding data decreases
Solution Approach 1:
The patent implements a feedback mechanism where the padding processing unit receives the padding length value from the packet structure and uses it to control the padding removal process. The system monitors the decryption output, applies the padding length information to identify padding bytes, and adjusts the data transfer accordingly, creating a closed-loop control system for efficient padding handling
Data Source
AI summary
In order to improve the efficiency of transfer to outside devices while necessary buffer memory is suppressed, the present invention is an information processing apparatus for decoding a packet that is encrypted in accordance with Transport Layer Security (TLS) protocols and in which a padding portion has a variable length, the information processing apparatus including acquisition means for acquiring an encrypted packet on a unit data basis, decoding means for decoding the encrypted packet on the unit data basis, output means for outputting decoded data obtained through the decoding performed by the decoding means to an external device in accordance with an order in which the decoding is performed by the decoding means, and control means for restricting output to be performed by the output means in a case where a padding pattern is detected from the decoded data obtained through the decoding performed by the decoding means.