VPN Auxiliary Link for Double Encryption Elimination
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current VPN strategies are inefficient as they apply double encryption to data that is already encrypted at the application layer, leading to unnecessary re-encryption and increased computational burden.
Innovation Solution
Implementing a TLS mechanism to establish an auxiliary link with NULL encryption security and an IPsec mechanism to create a NULL encryption Security Association during the VPN setup phase, thereby avoiding re-encryption of already encrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VPN applies encryption at the network layer to all traffic, then data security is maintained, but computational overhead increases due to re-encrypting already encrypted data
Solution Approach 1:
The patent applies different encryption treatments to different types of traffic: encrypted traffic (HTTPS) bypasses VPN re-encryption while unencrypted traffic receives full VPN encryption. This local differentiation eliminates redundant encryption operations on already-encrypted data while maintaining security on unencrypted traffic.
Solution Approach 2:
The patent changes the encryption parameter (encryption state) based on the traffic type. By detecting whether traffic is already encrypted at the application layer, the system dynamically adjusts the network layer encryption parameter to either apply or skip encryption, optimizing computational efficiency.
2Reliability
If VPN re-encrypts all data at the network layer, then security is maintained, but processing time increases
Solution Approach 1:
The system applies selective encryption processing based on traffic characteristics. Encrypted traffic is identified and routed through a fast path that skips re-encryption, while unencrypted traffic follows the standard encryption path, thereby reducing overall processing time.
Solution Approach 2:
The patent performs preliminary detection of encryption status at the application layer before network layer processing. This advance identification allows the system to prepare appropriate processing paths, avoiding unnecessary encryption operations and reducing processing time.
3Ease of manufacture
If VPN uses uniform encryption for all traffic types, then implementation is simple, but efficiency decreases due to double encryption of HTTPS traffic
Solution Approach 1:
The patent implements traffic-type-specific encryption policies where HTTPS traffic receives different treatment compared to unencrypted traffic. This local differentiation maintains implementation feasibility through clear classification rules while dramatically improving efficiency by eliminating double encryption.
Solution Approach 2:
The patent segments traffic into encrypted and unencrypted categories, applying different VPN processing rules to each segment. This segmentation enables efficient handling of HTTPS traffic separately from other traffic types, improving overall VPN efficiency without complicating the implementation.
Data Source
AI summary
Methods, apparatus, and software for efficient encryption in virtual private network (VPN) sessions. A VPN link and an auxiliary link (and associated sessions) are established between computing platforms to support end-to-end communication between respective application running on the platforms. The VPN link may employ a conventional VPN protocol such as TLS or IPsec, while the auxiliary link comprises a NULL encryption VPN tunnel. To transfer data, a determination is made to whether the data are encrypted or non-encrypted. Encrypted data are transferred over the auxiliary link to avoid re-encryption of the data. Non-encrypted are transferred over the VPN link. TLS and IPsec VPN agents may be used to assist in setting up the VPN and auxiliary sessions. The techniques avoid double encryption of VPN traffic, while ensuring that various types of traffic transferred between platforms is encrypted.