Network device and method for processing a session using a packet signature

• US 10,033,843 B2
• Filed: 08/07/2017
• Issued: 07/24/2018
• Est. Priority Date: 05/18/2015
• Status: Active Grant

• Current Assignee: 128 Technology, Inc. (Juniper Networks Incorporated)
• Original Assignee: 128 Technology, Inc. (Juniper Networks Incorporated)
• Inventors: Kumar, Prashant, Timmons, Patrick, MeLampy, Patrick J.
• Primary Examiner(s): Lagor, Alexander
• Application Number:
  US15/670,270
• Publication Number:
  US 20170359450A1
• Time in Patent Office: 351 Days
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 69/325 in the network layer [OSI layer 3], e.g. X.25 H04L69/16 takes precedence

Abstract

A method processes a session having a first session packet received by a current node in an IP network having a plurality of nodes. The plurality of nodes includes a next node, and the current node that communicates with the next node using a Layer 3 protocol. The method receives the first session packet, which has a digital signature, payload data, and meta-data, at the current node. The method uses the payload data and meta-data to produce validation information, and uses the digital signature to produce a comparator digital signature. Next, the method compares the validation information with the comparator digital signature. If the validation information does not match the comparator digital signature, then the method discards the first session packet. If there is a match, then the method digitally signs the first session packet, and routes the first session packet to the next node via the IP network.

Claims

1. A network routing device for processing a session of an IP network having a plurality of nodes, the plurality of nodes including a next node having a next authentication key, the network routing device having a current authentication key distinct from the next authentication key and comprising:

an input interface at least partially implemented by an electronic circuit and configured to receive a first session packet, the first session packet having a digital signature, payload data, and meta-data;

a signature module at least partially implemented by an electronic circuit and operatively coupled with the input interface, the signature module being configured to process the digital signature using the current authentication key to produce a processed digital signature,

the signature module also being configured to process the payload data and the meta-data to produce validation information,

the signature module further being configured to compare the processed digital signature and the validation information to determine if they match, the signature module further being configured to

     1) discard the first session packet when there is not a match, and

     2) digitally sign the first session packet using the next authentication key when there is a match; and

an output interface at least partially implemented by an electronic circuit and operatively coupled with the signature module, the output interface being configured to route the first session packet, after digitally signing, to the next node via the IP network using a Layer 3 protocol.

2. The network routing device as defined by claim 1 wherein the signature module is configured to apply a hash function to the payload data and meta-data to produce the validation information.

3. The network routing device as defined by claim 1 wherein the session comprises the first session packet, a plurality of intermediate session packets, and a last session packet, the signature module being configured to digitally sign the first session packet only, the intermediate session packets being forwarded after receipt without a digital signature.

4. The network routing device as defined by claim 1 wherein the meta-data includes data relating to 1) the session, 2) the payload data, or 3) both the session and payload data.

5. The network routing device as defined by claim 1 further comprising:

a key manager operatively coupled with the signature module, the key manager being configured to retrieve the next authentication key from a key network device across the network, the key network device having a copy of authentication keys for a set of the plurality of nodes.

6. A method of processing a session having a first session packet received by a current node in an IP network having a plurality of nodes, the plurality of nodes including a next node, the current node configured to communicate with the next node using a Layer 3 protocol, the method comprising:

receiving the first session packet at the current node, the first session packet having a digital signature, payload data, and meta-data;

processing the payload data and the meta-data to produce validation information;

processing the digital signature using a given authentication key to produce a processed digital signature;

comparing the validation information with the processed digital signature;

discarding the first session packet if the validation information does not match the processed digital signature;

digitally signing the first session packet with a next authentication key of the next node if the validation information matches the processed digital signature, the next authentication key being distinct from the given authentication key; and

routing the first session packet, after digitally signing, to the next node via the IP network.

7. The method as defined by claim 6 wherein the current node has the given authentication key.

8. The method as defined by claim 7 wherein the next node has a next authentication key, digitally signing the first session packet comprising digitally signing the first session packet using the next authentication key, the payload and the meta-data.

9. The method as defined by claim 6 wherein the current node comprises a router device.

10. The method as defined by claim 6 wherein the session comprises the first session packet, a plurality of intermediate session packets, and a last session packet, the method digitally signing and forwarding the first session packet only.

11. The method as defined by claim 6 wherein the validation information matches the processed digital signature when the validation information is substantially exactly the same as the processed digital signature.

12. The method as defined by claim 6 wherein the given authentication key comprises a public-private key pair, or a symmetric key.

13. The method as defined by claim 6 wherein the network includes a public network having a source node and a destination node, the first session packet being received from the source node via a set of nodes, the first session packet having the destination node address as the ultimate destination of the first session packet.

14. The method as defined by claim 6 wherein processing the payload and meta-data comprises processing the payload and meta-data using a one-way hash function.

15. The method as defined by claim 6 further comprising:

receiving a second session packet at the current node, the second session packet having a second digital signature, second payload data, and second meta-data;

processing the second payload data and the second meta-data to produce second validation information;

processing the second digital signature using the given authentication key to produce a second processed digital signature;

comparing the second validation information with the second processed digital signature;

discarding the second session packet if the second validation information does not match the second processed digital signature;

digitally signing the second session packet if the second validation information matches the second processed digital signature; and

routing the second session packet, after digitally signing, to the next node via the IP network.

16. The method as defined by claim 6 wherein the meta-data includes data relating to 1) the session, 2) the payload data, or 3) both the session and payload data.

17. The method as defined by claim 6 wherein the first session packet comprises a SYN packet of the TCP protocol.

18. The method as defined by claim 6 further comprising:

starting up the current node; and

retrieving a next authentication key, for the next node, from a key network device across the network, the key network device having a copy of the authentication keys for a set of the plurality of nodes.

19. The method as defined by claim 6 wherein:

the given authentication key is the authentication key for the current node; and

the next node has a next authentication key, the method digitally signing the first packet using the next authentication key if the authentication data matches both the payload data and meta-data.

20. A computer program product for use on a computer system for processing a session having a first session packet received by a current node in an IP network having a plurality of nodes, the plurality of nodes including a next node, the current node configured to communicate with the next node using a Layer 3 protocol, the computer program product comprising a tangible, non-transitory computer usable medium having computer readable program code stored thereon, the computer readable program code, when executed by a processor, performing the steps of:

receiving the first session packet at the current node, the first session packet having a digital signature, payload data, and meta-data;

processing the payload data and the meta-data to produce validation information;

processing the digital signature using a given authentication key to produce a processed digital signature;

comparing the validation information with the processed digital signature;

discarding the first session packet if the validation information does not match the processed digital signature;

digitally signing the first session packet with a next authentication key of the next node if the validation information matches the processed digital signature, the next authentication key being distinct from the given authentication key; and

routing the first session packet, after digitally signing, to the next node via the IP network.

21. The computer program product as defined by claim 20 wherein the session comprises the first session packet, a plurality of intermediate session packets, and a last session packet, the program code being configured to digitally sign and forward the first session packet only.

22. The computer program product as defined by claim 20 wherein the current node has the given authentication key.

23. The computer program product as defined by claim 22 wherein the next node has a next authentication key, the program code for digitally signing the first session packet comprising program code for digitally signing the first session packet using the next authentication key, the payload and the meta-data.

24. The computer program product as defined by claim 20 wherein the validation information matches the processed digital signature when the validation information is substantially exactly the same as the processed digital signature.

25. The computer program product as defined by claim 20 wherein the current authentication key comprises a public-private key pair, or a symmetric key.

26. The computer program product as defined by claim 20 wherein the meta-data includes data relating to 1) the session, 2) the payload data, or 3) both the session and payload data.

27. A method of processing a session having a first session packet received by a current node in an IP network having a plurality of nodes, the plurality of nodes including a next node, the current node configured to communicate with the next node using a Layer 3 protocol, the method comprising:

receiving the first session packet at the current node, the first session packet having a digital signature, payload data, and meta-data;

using the payload data and the meta-data to produce validation information;

using the digital signature to produce a comparator digital signature;

comparing the validation information with the comparator digital signature;

discarding the first session packet if the validation information does not match the comparator digital signature;

digitally signing the first session packet with a next authentication key of the next node if the validation information matches the comparator digital signature, the next authentication key being distinct from the given authentication key; and

routing the first session packet, after digitally signing, to the next node via the IP network.

28. The method as defined by claim 27 wherein using the payload data and the meta-data comprises using a hash function to produce the validation information.

29. The method as defined by claim 27 wherein the current node has a given key, the method using the given key to produce the comparator digital signature.

30. The method as defined by claim 27 wherein the validation information comprises the raw payload data and meta-data.

31. The method as defined by claim 27 wherein the next node has an associated next authentication key, digitally signing comprising using the next authentication key to digitally sign the first session packet.