VPN Packet Duplication Using Single Encryption Across Tunnels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network devices waste computing resources by performing multiple encryption and decryption processes when sending duplicate packets to multiple receiving network devices via separate tunnels, leading to inefficiency and resource wastage.
Innovation Solution
A transmitting network device encrypts a packet once and duplicates it, modifying destination addresses for each receiving network device, encapsulating it using tunneling protocols, and sends it through designated tunnels, allowing receiving devices to decrypt and discard duplicates, thus conserving computing resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a network device performs separate encryption and decryption processes for each receiving network device, then security requirements are met, but computing resources are wasted
Solution Approach 1:
The patent creates multiple copies of the single encrypted packet, each with modified outer IP headers containing different destination addresses for different receiving network devices. The encrypted payload remains identical across all copies, eliminating redundant encryption operations while maintaining secure delivery to multiple recipients through selective packet discarding based on destination address matching
Solution Approach 2:
The patent segments the packet handling process into distinct layers: a single encryption operation on the inner packet, followed by creation of multiple outer IP header-wrapped copies with different destination addresses. This segmentation allows the encryption operation to occur only once while still achieving secure multi-recipient delivery through subsequent copying and selective discarding
2Reliability
If multiple encryption processes are performed for duplicate packets, then each receiving device gets secure encrypted data, but processing time increases
Solution Approach 1:
The patent performs the encryption operation once in advance on the inner packet before creating multiple copies. This preliminary encryption action eliminates the need for repeated encryption operations for each receiving device, significantly reducing processing time while maintaining security through the use of the pre-encrypted packet across all recipients
3Reliability
If separate encryption operations are performed for each tunnel, then tunnel security is maintained, but device complexity increases
Solution Approach 1:
The patent makes the single encrypted packet universal across multiple tunnels by creating copies with different outer IP headers for different destination tunnels. The same encrypted payload serves multiple security zones and tunnels simultaneously, eliminating the need for separate encryption operations for each tunnel while maintaining tunnel-specific security through address-based packet selection and discarding
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
A network device may create an encrypted packet and may duplicate the encrypted packet to create a plurality of encrypted packets that includes a first set of encrypted packets that is associated with a first receiving network device and a second set of encrypted packets that is to be associated with a second receiving network device. The network device may modify the second set of encrypted packets by replacing a first virtual destination address in the second set of the plurality of encrypted packets with a second virtual destination address that identifies a virtual tunnel endpoint of the second receiving network device. The network device may encapsulate and may send, based on the first virtual destination address and the second virtual destination address, individual encapsulated encrypted packets to the first receiving network device or the second receiving network device.