Methods and apparatuses for handling end-to-end encryption
Methods, apparatuses, and systems for handling end-to-end encryption are described. A user device may send encrypted data to a server via a proxy using an encryption key shared with multiple network nodes across multiple layers. The proxy device may create an encrypted tunnel with an application server and send the encrypted data over the encrypted tunnel to the application server. The application server may receive the encrypted data over the encrypted tunnel from the proxy device. The application server may decrypt the encrypted data.
1. A method comprising:
generating a frame that comprises a data packet encrypted based on an encryption key shared with a plurality of network nodes across a plurality of layers;
determining, based on Quality of Server (QOS) information associated with the data packet, a multipath connection with a proxy server;
sending, to the proxy server, a request to create an encrypted tunnel with an application server; and
sending, to the proxy server, the frame using a path of the multipath connection, wherein the frame is to be forwarded to the application server over the encrypted tunnel based on the encryption key shared with the plurality of network nodes across the plurality of layers.
2. The method of claim 1 , wherein the plurality of network nodes comprises the proxy server and the application server.
3. The method of claim 1 , wherein the plurality of layers comprises a Quick User Datagram Protocol (UDP) Internet Connections (QUIC) protocol layer, an Internet Protocol (IP) layer, and a UDP layer.
4. The method of claim 1 , wherein the frame comprises an Internet Protocol (IP) header, a User Datagram Protocol (UDP) header, a Quick UDP Internet Connections (QUIC) header, and the data packet encapsulated within a QUIC datagram.
5. The method of claim 1 , wherein the request further comprises a method field being set to CONNECT and a protocol field being set to CONNECT-UDP or CONNECT-IP.
6. The method of claim 1 , further comprising:
receiving, from the proxy server, configuration information to establish the multipath connection with the proxy server, wherein the configuration information comprises an Internet Protocol (IP) address of the proxy server, a port number for the proxy server, and a proxy type.
7. The method of claim 1 , wherein the proxy server is a network node performing one or more User Plane Functions (UPFs).
8. A method comprising:
determining, based on Quality of Server (QOS) information associated with a data packet, a multipath connection with a user device;
receiving, from the user device, a request to create an encrypted tunnel with an application server;
receiving, from the user device, using a path of the multipath connection, a frame comprising the data packet, wherein the data packet is encrypted based on an encryption key shared with a plurality of network nodes across a plurality of layers; and
sending, to the application server, the frame over the encrypted tunnel based on the encryption key shared with the plurality of network nodes across the plurality of layers.
9. The method of claim 8 , wherein the plurality of network nodes comprises the user device and the application server.
10. The method of claim 8 , wherein the plurality of layers comprises a Quick User Datagram Protocol (UDP) Internet Connections (QUIC) protocol layer, an Internet Protocol (IP) layer, and a UDP layer.
11. The method of claim 8 , wherein the frame comprises an Internet Protocol (IP) header, a User Datagram Protocol (UDP) header, a Quick UDP Internet Connections (QUIC) header, and the data packet encapsulated within a QUIC datagram.
12. The method of claim 8 , wherein the request further comprises a method field being set to CONNECT and a protocol field being set to CONNECT-UDP or CONNECT-IP.
13. The method of claim 8 , further comprising:
sending, to the user device, configuration information for the multipath connection with the user device, wherein the configuration information comprises an Internet Protocol (IP) address of a proxy server, a port number for the proxy server, and a proxy type.
14. The method of claim 13 , wherein the proxy server is a network node performing one or more User Plane Functions (UPFs).
15. A method comprising:
receiving, from a proxy server, a request to create an encrypted tunnel with a user device via the proxy server, wherein the encrypted tunnel is based on an encryption key shared with a plurality of network nodes across a plurality of layers;
receiving, from the proxy server, a frame over the encrypted tunnel, wherein the frame comprises a data packet encrypted based on the encryption key shared with the plurality of network nodes across the plurality of layers; and
decoding, based on the encryption key, the data packet.
16. The method of claim 15 , wherein the plurality of network nodes comprises the user device and the proxy server.
17. The method of claim 15 , wherein the plurality of layers comprises a Quick User Datagram Protocol (UDP) Internet Connections (QUIC) protocol layer, an Internet Protocol (IP) layer, and a UDP layer.
18. The method of claim 15 , wherein the frame comprises an Internet Protocol (IP) header, a User Datagram Protocol (UDP) header, a Quick UDP Internet Connections (QUIC) header, and the data packet encapsulated within a QUIC datagram.
19. The method of claim 15 , wherein the request further comprises a method field being set to CONNECT and a protocol field being set to CONNECT-UDP or CONNECT-IP.
20. The method of claim 15 , wherein the proxy server is a network node performing one or more User Plane Functions (UPFs).