VPN Packet Duplication via Single Encryption and Address Modification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current VPN technologies waste computing resources by performing separate encryption processes for each receiving network device when sending duplicate packets, leading to unnecessary encryption and decryption processes.
Innovation Solution
A method where a network device encrypts a packet once and duplicates it, modifying the destination address for each receiving network device, encapsulating the packets using a tunneling protocol, and sending them through designated tunnels, allowing each receiving device to decrypt the packet independently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate encryption processes are performed for each receiving network device, then security is maintained, but computing resources are wasted
Solution Approach 1:
The patent segments the encryption process from the duplication process. Instead of encrypting each duplicate packet separately, the system performs a single encryption operation on the original packet, then duplicates the encrypted result. This segmentation separates the security-critical encryption step from the resource-intensive duplication step, maintaining security while reducing computational overhead.
Solution Approach 2:
The patent applies preliminary action by performing the encryption operation once before duplication. The encryption key is applied to the original packet in advance, creating an encrypted version that can then be safely duplicated multiple times without requiring additional encryption operations. This preliminary encryption action eliminates redundant computing while preserving security.
2Reliability
If separate encryption processes are performed for each receiving network device, then individual security is ensured, but processing time increases
Solution Approach 1:
The patent segments the security operation from the distribution operation. By separating encryption (security function) from duplication (distribution function), the system performs the time-consuming encryption operation only once, then rapidly duplicates the result for multiple recipients. This segmentation dramatically reduces total processing time while maintaining individual security for each receiving device.
Solution Approach 2:
The patent performs the security-critical encryption operation as a preliminary step before duplication. The original packet is encrypted in advance using the appropriate key, creating a secure version that can then be quickly copied and distributed to multiple receiving devices. This preliminary action eliminates repeated encryption operations, significantly reducing processing time.
3Manufacturing precision
If duplicate packets are encrypted separately for each destination, then encryption correctness is maintained, but device complexity increases
Solution Approach 1:
The patent segments the system into distinct functional modules: an encryption module that performs the security operation, a duplication module that creates copies, and a distribution module that routes packets. This segmentation maintains encryption correctness by keeping the encryption logic separate and unchanged, while reducing overall system complexity through modular design where each component has a single, well-defined function.
Data Source
AI summary
A network device may create an encrypted packet and may duplicate the encrypted packet to create a plurality of encrypted packets that includes a first set of encrypted packets that is associated with a first receiving network device and a second set of encrypted packets that is to be associated with a second receiving network device. The network device may modify the second set of encrypted packets by replacing a first virtual destination address in the second set of the plurality of encrypted packets with a second virtual destination address that identifies a virtual tunnel endpoint of the second receiving network device. The network device may encapsulate and may send, based on the first virtual destination address and the second virtual destination address, individual encapsulated encrypted packets to the first receiving network device or the second receiving network device.