VPN Authentication Packet Encryption for Private Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing VPN authentication methods are vulnerable to monitoring and tracking of private user information during communication between the VPN server and authentication server, leading to potential data compromise and inefficient resource utilization.
Innovation Solution
Implementing an authentication procedure that encrypts initial authentication packets using a nonce and encryption key, and decrypts them using a decryption key, thereby securing private information and optimizing resource usage by avoiding constant TCP connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional VPN authentication methods are used, then authentication can be performed, but private user information becomes vulnerable to monitoring and tracking during communication between VPN server and authentication server
Solution Approach 1:
The patent introduces an intermediary encryption layer using AES-CBC mode with random nonces as a mediator between the VPN server and authentication server. The authentication packets are encrypted before transmission, so the authentication server receives and processes encrypted data without being able to read the private information. This intermediary encryption mechanism protects user privacy while enabling authentication functionality.
Solution Approach 2:
The patent changes the state of authentication packets from plaintext to encrypted form by applying AES-CBC encryption with random nonces. This parameter change (from readable to encrypted) ensures that even if packets are intercepted during transmission, the private information remains unreadable. The encryption/decryption process transforms the data state while maintaining authentication functionality.
2Reliability
If constant TCP connections are maintained for authentication, then authentication can be performed, but resource utilization becomes inefficient
Solution Approach 1:
The patent implements preliminary action by establishing TCP connections only when authentication is actually needed, rather than maintaining constant connections. The system prepares authentication packets with encryption and transmits them on-demand, allowing connections to be closed after authentication completes. This eliminates the waste of maintaining persistent connections during idle periods while ensuring authentication capability when required.
Data Source
AI summary
The disclosure discloses an infrastructure device that configures a first server to determine an encrypted authentication packet including (i) a crypted code field that indicates a type of the encryption authentication packet, (ii) a crypted payload field that includes an encrypted initial authentication packet, determined by utilizing a nonce, an encryption key, and an encryption algorithm, and (iii) a data length field that indicates a length of the encrypted authentication packet, the length including a sum of a length of the crypted code field, a length of the crypted payload field, and a length of the data length field. The infrastructure device may also configure the first server to transmit, to a second server, the encrypted authentication packet to enable the first server and the second server to conduct an authentication process. Various other aspects are contemplated.