WireGuard Tunnel Integration for Secure MPTCP Multi-Path Sessions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multipath transmission control protocol (MPTCP) lacks an efficient and secure mechanism for managing multiple paths, leading to inefficiencies in firewalls and SSL decryption due to cross-path data fragmentation and end-to-end encryption protocols.
Innovation Solution
Integrate WireGuard VPN tunnels with MPTCP to establish secure sub-flows by using WireGuard virtual private network (VPN) tunnels for each path, ensuring secure tunneling and encryption of MPTCP signaling and data transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If MPTCP is used to establish multiple independent pathways for communication, then resource usage is maximized and redundancy is increased, but cross-path data fragmentation occurs that reduces firewall and malware scanner efficiency
Solution Approach 1:
The patent introduces an intermediary mechanism that intercepts and inspects MPTCP packets at the network level. This intermediary reconstructs the fragmented data across multiple paths before forwarding it to the destination, enabling firewalls and scanners to effectively inspect the complete data flow while maintaining the benefits of multipath communication.
2Productivity
If MPTCP is used to expand TCP operation to support multiple paths, then throughput is increased to the sum of all link-level channels, but secure socket layer decryption becomes inefficient due to end-to-end encryption protocols
Solution Approach 1:
The patent segments the encryption and decryption process by introducing network-level inspection points that can access and decrypt individual path transmissions. This allows SSL decryption to occur at the network level for each path separately, maintaining security while enabling efficient inspection of encrypted traffic across multiple paths.
3Reliability
If WireGuard VPN tunnels are established for each MPTCP path, then security and efficiency are enhanced, but device complexity increases
Solution Approach 1:
The patent merges the WireGuard VPN tunnel establishment process with the existing MPTCP path management infrastructure. By integrating the security protocol into the existing multipath framework rather than implementing separate tunnel management for each path, the system achieves enhanced security while minimizing the increase in device complexity.
Data Source
AI summary
A method of a server to establish secure multipath communications between the server and a user device includes establishing a WireGuard connection with the user device, establishing a first sub flow of a multipath transmission control protocol (MPTCP) connection with the user device using a first WireGuard virtual private network (VPN) tunnel, the first sub flow having a first path, sending a message to initiate a second path between the server and the user device, the message including a WireGuard interface address, public key for the server, and WireGuard indicator, receiving a reply message with a public key for the user device, and establishing a second sub flow of the MPTCP connection with the user device using a second WireGuard VPN tunnel, the second sub flow having the second path.