Facilitating user privacy in communications involving semantic-bearing IPv6 addresses

Patent metadata

Field	Value
Publication number	US-11218454-B2
Application number	US-201916268087-A
Country	US
Kind code	B2
Filing date	Feb 5, 2019
Priority date	Feb 5, 2019
Publication date	Jan 4, 2022
Grant date	Jan 4, 2022

Abstract

A message is received which indicates a request for a client-specific service address for service or content provided by a service provider. In response to the request, a client-specific service address may be generated and sent to the client. The address may be used as a destination address in one or more subsequent client requests for service or content. A first portion of the address comprises an IPv6 service prefix assigned to a service network of the service provider. A second portion of the address comprises semantic information having a first portion of encrypted private information and a second portion of unencrypted service information. The encrypted private information may be generated by encrypting private information based on a cryptographic key, where the cryptographic key is derived based on a secret key associated with the service provider and an IP client prefix assigned to the client.

First claim

What is claimed is:

1. A method comprising:
at a network node configured to be provisioned with a shared secret key of a service provider associated with a service network,
receiving a message comprising a data packet originating from a client, the data packet including:
a source address which includes an Internet Protocol (IP) client prefix assigned to the client;
a destination address having at least a first portion and a second portion, the first portion including an IP version 6 (IPv6) service prefix assigned to the service network of the service provider, the second portion comprising semantic information having a first portion of encrypted private information and a second portion of unencrypted service information for application of policy for the data packet;

decrypting the encrypted private information of the destination address based on a cryptographic key to provide decrypted private information, the cryptographic key being derived based on the shared secret key of the service provider and the IP client prefix assigned to the client; and
processing or forwarding the data packet to a destination server or cache based at least in part on the decrypted private information.

2. The method of claim 1 , which is performed by a network node comprising a router or switch configured to forward the data packet to the destination server or cache based at least in part on the decrypted private information.

3. The method of claim 1 , further comprising:
at the network node,
deriving the cryptographic key based on the shared secret key of the service provider and the IP client prefix assigned to the client.

4. The method of claim 1 , wherein the cryptographic key comprises a concatenation of the shared secret key of the service provider and the IP client prefix assigned to the client.

5. The method of claim 1 , wherein the decrypted private information comprises personally identifiable information (PII) or sensitive personal information (SPI).

6. The method of claim 1 , wherein the decrypted private information comprises a user identifier or a tenant identifier.

7. The method of claim 1 , wherein the decrypted private information comprises a content identifier.

8. The method of claim 1 , wherein the decrypted private information comprises a content identifier which identifies content to be accessed by the client, and wherein the processing or forwarding comprises forwarding the data packet to a destination cache which includes the content.

9. The method of claim 1 , wherein the unencrypted service information for the application of policy for the data packet comprises bandwidth or Quality of Service (QoS) criteria, the method further comprising:
at the network node,
processing or forwarding the data packet in satisfaction of the bandwidth or QoS criteria.

10. A network node comprising:
one or more processors;
a plurality of interfaces or ports;
the one or more processors being configured to operate the network node to receive a provisioning of a shared secret key of a service provider associated with a service network, and further to:
receive, via an interface or port, a message comprising a data packet originating from a client, the data packet including:
a source address which includes an Internet Protocol (IP) client prefix assigned to the client;
a destination address having at least a first portion and a second portion, the first portion comprising an IP version 6 (IPv6) service prefix assigned to the service network of the service provider, the second portion comprising semantic information having a first portion of encrypted private information and a second portion of unencrypted service information for application of policy for the data packet;

decrypt the encrypted private information of the destination address based on a cryptographic key to provide decrypted private information, the cryptographic key being derived based on the shared secret key of the service provider and the IP client prefix assigned to the client; and
process or forward the data packet to a destination server or cache based at least in part on the decrypted private information.

11. The network node of claim 10 , wherein the decrypted private information comprises one of a content identifier, a user identifier, and a tenant identifier, and wherein the one or more processors are configured to operate the network node further to:
derive the cryptographic key based on the shared secret key of the service provider and the IP client prefix assigned to the client.

12. The network node of claim 10 , wherein the source address which includes IP client prefix assigned to the client further comprises an IPv6 Dynamic Host Configuration Protocol Prefix Delegation (DHCP-PD) prefix (IPv6 DHCP-PD prefix).

13. A method comprising:
maintaining access to a database which stores a shared secret key of a service provider;
receiving a message which indicates a request for a client-specific service address for a client for obtaining a service or content associated with the service provider;
generating a client-specific service address in response to the request, the client-specific service address having:
a first portion comprising an Internet Protocol version 6 (IPv6) service prefix assigned to a service network of the service provider;
a second portion comprising semantic information having a first portion of encrypted private information and a second portion of unencrypted service information for application of policy on an application or flow for obtaining the service or content;

wherein generating the client-specific service address comprises generating the encrypted private information by encrypting private information based on a cryptographic key, the cryptographic key being derived based on the shared secret key of the service provider and an IP client prefix assigned to the client; and
sending to the client one or more messages which include the client-specific service address.

14. The method of claim 13 , wherein the client-specific service address is for use as a destination address in one or more subsequent client requests for the service or content.

15. The method of claim 13 , wherein the one or more messages which include the client-specific service address includes a manifest file having a list of uniform resource indicators (URIs) for accessing content, wherein each one of one or more URIs of the manifest file includes or corresponds to the client-specific service address.

16. The method of claim 13 , wherein the cryptographic key comprises a concatenation of the shared secret key of the service provider and the IP client prefix assigned to the client.

17. The method of claim 13 , wherein the private information comprises personally identifiable information (PII) or sensitive personal information (SPI).

18. The method of claim 13 , wherein the private information comprises one of a service identifier, a content identifier, a user identifier, or a tenant identifier.

19. The method of claim 13 , wherein the unencrypted service information for the application of policy comprises bandwidth or Quality of Service (QoS) criteria.

20. The method of claim 13 , which is performed by a catalog service node having the database for storing a plurality of shared secret keys in association with a plurality of different service provider IDs or names, wherein the shared secret key is retrieved from the database according to a service provider ID or name of the service provider.

Assignees

• Cisco Tech Inc

Inventors

• Vyncke Eric
• Ruty Guillaume
• Pfister Pierre
• Surcouf Andre Jean-Marie

Classifications

• H04L2101/668

  Internet protocol [IP] address subnets · CPC title

• H04L2101/659

  Internet protocol version 6 [IPv6] addresses · CPC title

• H04L67/5682

  Policies or rules for updating, deleting or replacing the stored data · CPC title

• H04L61/5007

  Internet protocol [IP] addresses · CPC title

• H04L2101/604

  Address structures or formats · CPC title