Inline security key exchange

Patent metadata

Field	Value
Publication number	US-2024340163-A1
Application number	US-202418745443-A
Country	US
Kind code	A1
Filing date	Jun 17, 2024
Priority date	Oct 26, 2021
Publication date	Oct 10, 2024
Grant date	—

Abstract

Techniques are disclosed for inline security key exchanges between network devices. An example network device includes one or more processors and memory coupled to the one or more processors. The memory stores instructions that, upon execution, cause one or more processors to obtain a first payload key and obtain a path key. The instructions cause the one or more processors to encrypt a first payload of a first packet using the first payload key and insert the first payload key into first metadata of the first packet. The instructions cause the one or more processors to encrypt the first metadata using the path key and send the first packet to another network device.

First claim

What is claimed is:

1 . Non-transitory computer readable storage media storing instructions, which, when executed cause one or more processors of a network device to:
obtain a first payload key, the first payload key being associated with a first session; obtain a path key, wherein the path key is associated with a path between the network device and a neighboring network device; encrypt a first packet payload of a first packet using the first payload key; insert the first payload key into first metadata for the first packet; encrypt the first metadata using the path key, the first metadata including the first payload key, to generate encrypted first metadata; send the first packet including the encrypted first metadata and the first packet payload to the neighboring network device; determine that a second packet payload of a second packet is associated with the first session; based on the second packet payload being associated with the first session, encrypt the second packet payload using the first payload key; and send the second packet including second metadata to the neighboring network device, the second metadata not including the first payload key.

2 . The non-transitory computer readable storage media of claim 1 , wherein the instructions cause the one or more processors to obtain the first payload key by generating the first payload key or by receiving the first payload key.

3 . The non-transitory computer readable storage media of claim 1 , wherein the instructions further cause the one or more processors to:
determine to update the first payload key; obtain a second payload key; encrypt a third packet payload of a third packet using the second payload key; insert the second payload key into third metadata of the third packet; encrypt the third metadata using the path key; and send the third packet to the neighboring network device.

4 . The non-transitory computer readable storage media of claim 1 , wherein the instructions further cause the one or more processors to:
obtain a second payload key associated with a second session; encrypt a third packet payload of a third packet associated with the second session using the second payload key; insert the second payload key into third metadata of the third packet; encrypt the third metadata using the path key; and send the third packet to the neighboring network device.

5 . The non-transitory computer readable storage media of claim 1 , wherein the first payload key is further associated with a first type of service and wherein the instructions further cause the one or more processors to:
obtain a second payload key associated with a second type of service; encrypt a third packet payload of a third packet associated with the second type of service using the second payload key; insert the second payload key into third metadata of the third packet; encrypt the third metadata using the path key; and send the third packet to the neighboring network device.

6 . The non-transitory computer readable storage media of claim 1 , wherein the network device comprises a session-based router.

7 . The non-transitory computer readable storage media of claim 1 , wherein the neighboring network device comprises a session-based router.

8 . Non-transitory computer readable storage media storing instructions, which, when executed cause one or more processors of a network device to:
obtain a path key; receive a first packet from a neighboring network device; decrypt first metadata of the first packet using the path key; obtain a first payload key from the first metadata of the first packet, the first payload key being associated with a first session; decrypt a first packet payload of the first packet using the first payload key; receive a second packet including a second packet payload and second metadata from the neighboring network device, the second metadata not including the first payload key; determine that the second packet payload is associated with the first session based on the second metadata; and decrypt the second packet payload of the second packet using the first payload key.

9 . The non-transitory computer readable storage media of claim 8 , wherein the instructions further cause the one or more processors to:
receive a third packet from the neighboring network device; decrypt third metadata of the third packet using the path key; obtain a second payload key from the third metadata of the third packet; and decrypt a third packet payload of the third packet using the second payload key.

10 . The non-transitory computer readable storage media of claim 8 , wherein the instructions further cause the one or more processors to:
receive a third packet from the neighboring network device, the third packet being associated with a second session; decrypt third metadata of the third packet using the path key; obtain a second payload key from the third metadata of the third packet, the second payload key being associated with the second session; and decrypt a third packet payload of the third packet using the second payload key.

11 . The non-transitory computer readable storage media of claim 8 , wherein the first payload key is further associated with a first type of service and wherein the instructions further cause the one or more processors to:
receive a third packet from the neighboring network device, the third packet being associated with a second type of service; decrypt third metadata of the third packet using the path key; obtain a second payload key from the third metadata of the third packet, the second payload key being associated with the second type of service; and decrypt a third packet payload of the third packet using the second payload key.

12 . The non-transitory computer readable storage media of claim 8 , wherein the network device comprises a session-based router.

13 . The non-transitory computer readable storage media of claim 8 , wherein the neighboring network device comprises a session-based router.

14 . A method comprising:
obtaining, by one or more processors of an egress network device, a path key; receiving, by the one or more processors of the egress network device, a first packet from a neighboring network device; decrypting, by the one or more processors of the egress network device, first metadata of the first packet using the path key; obtaining, by the one or more processors of the egress network device, a first payload key from the first metadata of the first packet, the first payload key being associated with a first session; decrypting, by the one or more processors of the egress network device, a first packet payload of the first packet using the first payload key; receiving, by the one or more processors of the egress network device, a second packet including a second packet payload and second metadata from the neighboring network device, the second metadata not including the first payload key; determining, by the one or more processors of the egress network device, that the second packet payload is associated with the first session based on the second metadata; and decrypting, by the one or more processors of the egress network device, the second packet payload of the second packet using the first payload key.

15 . The method of claim 14 , further comprising:
receiving, by the one or more processors of the egress network device, a third packet from the neighboring network device; decrypting, by the one or more processors of the egress network device, third metadata of the third packet using the path key; obtaining, by the

Assignees

• Juniper Networks Inc

Inventors

• Menon Abilash
• Bhat Avinash Prakash
• Yungelson Anna

Classifications

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title

• H04L9/0827

  involving distinctive intermediate devices or communication paths (network architectures or network communication protocols using different networks H04L63/18) · CPC title

• H04L9/088

  Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068) · CPC title

• H04W12/033

  of the user plane, e.g. user's traffic · CPC title