Method and apparatus for verification of at least a portion of a datagram's header information
View Patent ↗At least part of the information in a packet's header may be verified so that a network element may rely on the information, e.g. to provide enhanced QoS and/or to identify the source. The information may be verified by a verifying agent (VA) or a transmitting network element. Where a VA is used, the VA may sign the header information issuing its private key of a private/public key pair. The signature may take the form of a digest, certificate, or other form. Once the header information has been signed, the client may transmit packets using headers that include the signed information and may include the VA's signature as an option in the header or in another area of the packet. The VA may also transmit packets directly. The signature may be decrypted by other NEs to extract the signed information, which can then be compared with the normal header information.
1. A method of verifying the accuracy of a value contained in at least a portion of a header of a layer 2 or layer 'packet formed using a layer 2 or layer 3 protocol, the method comprising the steps of:
receiving the layer 2 or layer 3 packet by a router or switch required to make a routing or switching decision for the layer 2 or layer 3 packet using information in a header of the layer 2 or layer 3 packet, the header containing a source address field, a destination address field, a plurality of other header fields, and encrypted signature information, the encrypted signature information relating to at least to a portion of the header including at least the source address field or the destination address field and the encrypted signature information being part of the header of the layer 2 or layer 3 packet when the layer 2 or layer 3 packet is received by the router;
comparing, by the router or switch, information associated with the signature information with the portion of the header to determine if the signature information and the portion of the header are consistent to verify the accuracy of a value contained in the portion of the header; and
if the information associated with the signature information and the value of the portion of the header are consistent, implementing a quality of service specified by the header in connection with implementing the routing or switching decision for the layer 2 or layer 3 packet;
wherein the encrypted signature information is created from fields of the header that are common to a plurality of packets transmitted by a given sender to enable the same encrypted signature information to be used by the sender in connection with transmission of each of the plurality of packets;
wherein the encrypted signature information is an encrypted digest of the header information; and
wherein the digest is created from a quality of service field, the source address and the destination address.
2. The method of claim 1 , wherein the encrypted signature information was encrypted using a private key of a public key/private key encryption system.
3. The method of claim 1 , wherein the step of comparing comprises decrypting the encrypted signature information and comparing the decrypted signature information with the portion of the header.
4. The method of claim 3 , wherein the signature information is generated by a validating agent having a private key and a public key, and wherein the step of decrypting the encrypted signature information comprises using the public key to decrypt the encrypted signature information.
5. The method of claim 1 , wherein the layer 2 protocol is a link layer protocol, and wherein the layer 3 protocol is a routing layer protocol.
6. The method of claim 5 , wherein the packet is an Internet Protocol (IP) packet.
7. The method of claim 6 , wherein the encrypted signature information is contained as an option in the IP packet.
8. A non-transitory computer-readable medium containing instructions for controlling at least one processor to perform a method of evaluating the accuracy of a value contained in a header of an Internet Protocol (IP) packet in connection with making a routing or switching decision for the IP packet on a communication network, the method comprising the steps of:
receiving an IP packet having an IP header and a data portion, the IP header having a source IP address field, a destination IP address field, and a plurality of other header fields, at least one of the plurality of other header fields containing an encrypted digest of a portion of the IP header including the source IP address field, the encrypted signature information being part of the IP header when the IP packet is received;
decrypting the encrypted digest; and
verifying the accuracy of a value contained in the portion of the IP header, including the source IP address field, by comparing the decrypted digest with the portion of the IP header to determine if the information in the decrypted digest matches the information in the portion of the IP header in connection with making the routing or switching decision for the IP packet on the communication network;
wherein the digest is created from fields of the IP header that are common to a plurality of packets transmitted by a given sender to enable the same digest to be used in connection with the plurality of packets; and
wherein the IP header further includes a type of service field containing type of service information, wherein the source IP address field containing a source IP address, wherein the destination IP address field containing a destination IP address, and wherein the encrypted digest contains digest information including the type of service information, the source IP address, and the destination IP address.
9. The computer-readable medium of claim 8 , wherein the step of decrypting the encrypted digest comprises accessing a public key, and using the public key to decrypt the encrypted digest.
10. The computer-readable medium of claim 9 , wherein the public key is associated with a verifying agent.
11. The computer-readable medium of claim 10 , wherein the encrypted digest was created by the verifying agent.