Method and apparatus for transmitting a user datagram protocol message that is larger than a defined size
A first device initiates a handshake message exchange with a second device according to a security protocol. The first device determines that an application datagram is to be transmitted according to a first transport protocol that limits a size of a datagram based on a defined size. The first device also determines that an application datagram size is larger than the defined size. The first device fragments the application datagram if the application datagram size is larger than the defined size and secures the application datagram with the security protocol. The first device also encapsulates the application datagram fragments in handshake messages, wherein an encapsulated application datagram fragment is transmitted from the first device to the second device in a first security protocol record. The first device may also transmit, to the second device, another application datagram secured with the security protocol.
1. A method comprising:
engaging, by a device, in a Datagram Transport Layer Security (DTLS) handshake message exchange with a second device according to the DTLS protocol;
determining, at the first device, that an application datagram is to be transmitted according to a User Datagram Protocol (UDP) that limits a size of a datagram based on a Maximum Transmission Unit (MTU), wherein the first device determines that a size of the application datagram is larger than the MTU;
fragmenting, at the first device, the application datagram into application data fragments, if the application datagram size is determined to be larger than the MTU;
fragmenting, at the first device, the DTLS handshake message such that a size of a first DTLS protocol record is smaller than the MTU, and providing a fragment offset and length for each first DTLS protocol record created from the fragmented DTLS handshake message so that the second device can reassemble the DTLS handshake message;
securing, at the first device, the application datagram with the DTLS protocol;
encapsulating, by the first device, the application data fragments in DTLS handshake messages, wherein an encapsulated application data fragment is transmitted from the first device to the second device in the first DTLS protocol record; and
transmitting, by the first device to the second device, another application datagram secured with the DTLS protocol in a subsequent DTLS protocol record.
2. The method of claim 1 , wherein the engaging in a DTLS handshake message exchange comprises sending, by the first device, an introduction message that includes an element for indicating that the first device is capable of transmitting application data inside the DTLS handshake message of the first DTLS protocol record, and receiving a response to the introduction message that includes an element for indicating whether the second device can process the application data inside the DTLS handshake message of the first DTLS protocol record.
3. The method of claim 1 , further comprising performing authentication, cryptographic attributes negotiations, and key exchange during the DTLS handshake message exchange between the first device and the second device.
4. The method of claim 1 , wherein the encapsulating comprises adding a tunneling element to each first DTLS protocol record to indicate to the second device that the first DTLS protocol record includes the encapsulated application datagram.
5. The method of claim 1 , wherein the transmitting comprises adding a non-tunneling element to the subsequent DTLS protocol record to indicate to the second device that the subsequent DTLS protocol record does not includes the encapsulated application datagram.
6. The method of claim 1 , further comprising receiving, at the first device, an acknowledgment for each fragment of the DTLS handshake message received by the second device and resending un-acknowledgment fragments.
7. The method of claim 1 , wherein responsive to receiving a response associated the first DTLS protocol record, the second device decapsulates the first DTLS protocol record, deciphers the application datagram, and reassembles the application datagram.
8. A communication device comprising:
a processor configured to:
engage in a DTLS handshake message exchange with another communication device according to a DTLS protocol;
determine that an application datagram is to be transmitted according to a User Datagram Protocol (UDP) that limits a size of a datagram based on a Maximum Transmission Unit (MTU), wherein the application datagram size is determined to be larger than the MTU;
fragment the application datagram into application data fragments if the application datagram size is determined to be larger than the MTU;
fragment the DTLS handshake message such that the size of a first DTLS protocol record is smaller than the MTU, and provide a fragment offset and length for each first DTLS protocol record so that the second device can reassemble the DTLS handshake message;
secure the application datagram with the Datagram Transport Layer Security (DTLS) protocol;
encapsulate the application data fragments in DTLS handshake messages, wherein an encapsulated application data fragment is transmitted to the second device in the first DTLS protocol record; and
transmit, to the second device, another application datagram secured with the DTLS protocol in a subsequent DTLS protocol record.
9. The communication device of claim 8 , wherein the processor is configured to engage in a DTLS handshake message exchange by sending an introduction message that includes an element for indicating that the communication device is capable of transmitting application data inside the DTLS handshake message of the first DTLS protocol record, and, in response, receive a response to the introduction message that includes an element for indicating whether the another communication device can process the application data inside the DTLS handshake message of the first DTLS protocol record.
10. The communication device of claim 8 , wherein the processor further is configured to perform authentication, cryptographic attributes negotiations, and key exchange during the DTLS handshake message exchange between the first device and the second device.
11. The communication device of claim 8 , wherein the processor is configured to add a tunneling element to each first DTLS protocol record to indicate to the second device that the first DTLS protocol record includes the encapsulated application datagram.
12. The communication device of claim 8 , wherein the processor is configured to add a non-tunneling element to the subsequent DTLS protocol record to indicate to the second device that the subsequent DTLS protocol record does not includes the encapsulated application datagram.
13. The communication device of claim 8 , wherein the processor is configured to receive an acknowledgment for each fragment of the DTLS handshake message received by the second device and resend un-acknowledgment fragments.