WireGuard Tunnels for Secure MPTCP Sub-Flow Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multipath transmission control protocol (MPTCP) systems lack efficient and secure mechanisms for managing multiple paths, leading to inefficiencies in firewalls and SSL decryption due to cross-path data fragmentation and end-to-end encryption protocols.
Innovation Solution
Integrate WireGuard protocol with MPTCP to establish secure VPN tunnels for each sub-flow, using cryptographic parameters and encrypted data transmission to maintain data coherence across multiple paths.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TCP protocol is used for communication, then connection reliability is improved, but security against MITM attacks deteriorates
Solution Approach 1:
The patent introduces WireGuard as an intermediary security layer between TCP communication endpoints. WireGuard establishes encrypted tunnels that mediate all TCP traffic, providing cryptographic verification of peer identities through public key exchange. This intermediary layer prevents MITM attacks by ensuring that only authenticated peers can establish connections, while TCP continues to provide reliable data transmission without direct security exposure.
2Reliability
If multiple TCP connections are established for load balancing, then communication reliability is improved, but security management complexity increases
Solution Approach 1:
The patent merges multiple TCP connections under a single WireGuard interface. Instead of managing separate security credentials for each TCP connection, WireGuard consolidates authentication at the network layer, where a single peer-to-peer encrypted tunnel encompasses all traffic flows. This unified approach maintains communication reliability through multiple underlying paths while simplifying security management to a single authentication event per peer relationship.
Solution Approach 2:
WireGuard serves multiple functions simultaneously: it provides encryption, authentication, key management, and connection establishment for all TCP streams passing through it. This universal security layer handles diverse traffic types (data, control signals, acknowledgments) through a single cryptographic framework, eliminating the need for separate security configurations for each TCP connection type and reducing overall system complexity.
3Adaptability or versatility
If TCP connections are frequently established and terminated, then adaptability to changing conditions is improved, but connection stability deteriorates
Solution Approach 1:
WireGuard performs preliminary cryptographic authentication and key exchange before TCP connections are established. By pre-establishing trusted peer relationships and exchanging encryption keys in advance, the system enables rapid TCP connection creation without repeated authentication handshakes. This preliminary security setup allows TCP connections to be frequently created and torn down based on load conditions while maintaining overall connection stability through the persistent WireGuard tunnel framework.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
A method of a server to establish secure multipath communications between the server and a user device includes establishing a WireGuard connection with the user device, establishing a first sub flow of a multipath transmission control protocol (MPTCP) connection with the user device using a first WireGuard virtual private network (VPN) tunnel, the first sub flow having a first path, sending a message to initiate a second path between the server and the user device, the message including a WireGuard interface address, public key for the server, and WireGuard indicator, receiving a reply message with a public key for the user device, and establishing a second sub flow of the MPTCP connection with the user device using a second WireGuard VPN tunnel, the second sub flow having the second path.