Cisco Technology, Inc.

Venkata Krishna Sashank Dara

Frank Brockners

Shwetha Subray Bhandari

Eric G Vyncke

Andrew Yourtchenko

Nicholas Read Leavy

Andrei M Iourtchenko

Eric Vyncke

A system and methods are provided for verifying proof of transit of network traffic through a plurality of network nodes in a network. Information is obtained about a packet at a network node in a network. The information may include in-band metadata of the packet. Verification information is read from in-band metadata of the packet. Updated verification information is generated from the verification information read from the packet and based on configuration information associated with the network node. The updated verification information is written back to the in-band metadata in the packet. The packet is forwarded from the network node in the network.

Network path proof of transit using in-band metadata

A system and methods are provided herein for verifying proof of transit of traffic through a plurality of network nodes in a network. In one embodiment, a method is provided in which information is obtained about a packet at a network node in a network. The information includes in-band metadata. Verification information is read from the in-band metadata. The verification information for use in verifying a path of the packet in the network. Updated verification information is generated from the verification information read from the packet. The updated verification information is written to the in-band metadata of the packet, and the packet is forwarded from the network node in the network.

Transport mechanism for carrying in-band metadata for network path proof of transit

A system and methods are provided for verifying proof of transit of network traffic through a plurality of network nodes in a network. In one embodiment, each network node reads a first value and a second value from in-band metadata of packet, and generates, using a cryptographic key that is unique to each respective network node, an encryption result based on the first value. An updated second value is generated based on the second value read from the packet and the encryption result. Each network node writes the updated second value to the in-band metadata of the packet, and forwards the packet in the network. In another embodiment, a secret sharing scheme is employed by each network node computes a portion of verification information using a unique share of a secret and based on the packet specific information.

Cumulative schemes for network path proof of transit

Embodiments generally provide techniques for managing data security. One embodiment includes providing, at a client system, an encrypted private key that can be decrypted using a locker key. Encrypted data is received from a remote system, and embodiment determine that the received encrypted data can be decrypted using a private key recovered by decrypting the encrypted private key. A request is transmitted to the remote system for the locker key corresponding to the encrypted private key, and the requested locker key is received from the remote system. Embodiments decrypt the encrypted private key using the received locker key to recover the private key, and decrypt the encrypted data, using the private key.

Growing community of inventors

Karnataka, India

Venkata Krishna Sashank Dara