Granted Patent B2

US 12,567,953 · App. 18/745,443 · Granted Mar 3, 2026

Inventors: Abilash Menon (Boxborough, MA); Avinash Prakash Bhat (Bedford, MA); Anna Yungelson (Lexington, MA)

Assignee: Juniper Networks, Inc.

H04L9/0825H04L9/0827H04L9/0891H04L63/0428

Abstract

Claims (84)

1 . Non-transitory computer readable storage media storing instructions, which, when executed cause one or more processors of a network device to:

obtain a first payload key, the first payload key being associated with a first session;

obtain a path key, wherein the path key is associated with a path between the network device and a neighboring network device;

encrypt a first packet payload of a first packet using the first payload key;

insert the first payload key into first metadata for the first packet;

encrypt the first metadata using the path key, the first metadata including the first payload key, to generate encrypted first metadata;

send the first packet including the encrypted first metadata and the first packet payload to the neighboring network device;

determine that a second packet payload of a second packet is associated with the first session;

based on the second packet payload being associated with the first session, encrypt the second packet payload using the first payload key; and

send the second packet including second metadata to the neighboring network device, the second metadata not including the first payload key.

2 . The non-transitory computer readable storage media of claim 1 , wherein the instructions cause the one or more processors to obtain the first payload key by generating the first payload key or by receiving the first payload key.

3 . The non-transitory computer readable storage media of claim 1 , wherein the instructions further cause the one or more processors to:

determine to update the first payload key;

obtain a second payload key;

encrypt a third packet payload of a third packet using the second payload key;

insert the second payload key into third metadata of the third packet;

encrypt the third metadata using the path key; and

send the third packet to the neighboring network device.

4 . The non-transitory computer readable storage media of claim 1 , wherein the instructions further cause the one or more processors to:

obtain a second payload key associated with a second session;

encrypt a third packet payload of a third packet associated with the second session using the second payload key;

insert the second payload key into third metadata of the third packet;

encrypt the third metadata using the path key; and

send the third packet to the neighboring network device.

5 . The non-transitory computer readable storage media of claim 1 , wherein the first payload key is further associated with a first type of service and wherein the instructions further cause the one or more processors to:

obtain a second payload key associated with a second type of service;

encrypt a third packet payload of a third packet associated with the second type of service using the second payload key;

insert the second payload key into third metadata of the third packet;

encrypt the third metadata using the path key; and

send the third packet to the neighboring network device.

6 . The non-transitory computer readable storage media of claim 1 , wherein the network device comprises a session-based router.

7 . The non-transitory computer readable storage media of claim 1 , wherein the neighboring network device comprises a session-based router.

8 . Non-transitory computer readable storage media storing instructions, which, when executed cause one or more processors of a network device to:

obtain a path key;

receive a first packet from a neighboring network device;

decrypt first metadata of the first packet using the path key;

obtain a first payload key from the first metadata of the first packet, the first payload key being associated with a first session;

decrypt a first packet payload of the first packet using the first payload key;

receive a second packet including a second packet payload and second metadata from the neighboring network device, the second metadata not including the first payload key;

determine that the second packet payload is associated with the first session based on the second metadata; and

decrypt the second packet payload of the second packet using the first payload key.

9 . The non-transitory computer readable storage media of claim 8 , wherein the instructions further cause the one or more processors to:

receive a third packet from the neighboring network device;

decrypt third metadata of the third packet using the path key;

obtain a second payload key from the third metadata of the third packet; and

decrypt a third packet payload of the third packet using the second payload key.

10 . The non-transitory computer readable storage media of claim 8 , wherein the instructions further cause the one or more processors to:

receive a third packet from the neighboring network device, the third packet being associated with a second session;

decrypt third metadata of the third packet using the path key;

obtain a second payload key from the third metadata of the third packet, the second payload key being associated with the second session; and

decrypt a third packet payload of the third packet using the second payload key.

11 . The non-transitory computer readable storage media of claim 8 , wherein the first payload key is further associated with a first type of service and wherein the instructions further cause the one or more processors to:

receive a third packet from the neighboring network device, the third packet being associated with a second type of service;

decrypt third metadata of the third packet using the path key;

obtain a second payload key from the third metadata of the third packet, the second payload key being associated with the second type of service; and

decrypt a third packet payload of the third packet using the second payload key.

12 . The non-transitory computer readable storage media of claim 8 , wherein the network device comprises a session-based router.

13 . The non-transitory computer readable storage media of claim 8 , wherein the neighboring network device comprises a session-based router.

14 . A method comprising:

obtaining, by one or more processors of an egress network device, a path key;

receiving, by the one or more processors of the egress network device, a first packet from a neighboring network device;

decrypting, by the one or more processors of the egress network device, first metadata of the first packet using the path key;

obtaining, by the one or more processors of the egress network device, a first payload key from the first metadata of the first packet, the first payload key being associated with a first session;

decrypting, by the one or more processors of the egress network device, a first packet payload of the first packet using the first payload key;

receiving, by the one or more processors of the egress network device, a second packet including a second packet payload and second metadata from the neighboring network device, the second metadata not including the first payload key;

determining, by the one or more processors of the egress network device, that the second packet payload is associated with the first session based on the second metadata; and

decrypting, by the one or more processors of the egress network device, the second packet payload of the second packet using the first payload key.

15 . The method of claim 14 , further comprising:

receiving, by the one or more processors of the egress network device, a third packet from the neighboring network device;

decrypting, by the one or more processors of the egress network device, third metadata of the third packet using the path key;

obtaining, by the one or more processors of the egress network device, a second payload key from the third metadata of the third packet; and

decrypting, by the one or more processors of the egress network device, a third packet payload of the third packet using the second payload key.

16 . The method of claim 14 , further comprising:

receiving, by the one or more processors of the egress network device, a third packet from the neighboring network device, the third packet being associated with a second session;

decrypting, by the one or more processors of the egress network device, third metadata of the third packet using the path key;

obtaining, by the one or more processors of the egress network device, a second payload key from the third metadata of the third packet, the second payload key being associated with the second session; and

decrypting, by the one or more processors of the egress network device, a third packet payload of the third packet using the second payload key.

17 . The method of claim 14 , wherein the first payload key is further associated with a first type of service and wherein the method further comprises:

receiving, by the one or more processors of the egress network device, a third packet from the neighboring network device, the third packet being associated with a second type of service;

decrypting, by the one or more processors of the egress network device, third metadata of the third packet using the path key;

obtaining, by the one or more processors of the egress network device, a second payload key from the third metadata of the third packet, the second payload key being associated with the second type of service; and

decrypting, by the one or more processors of the egress network device, a third packet payload of the third packet using the second payload key.

18 . The method of claim 14 , wherein the egress network device comprises a session-based router.

19 . The method of claim 14 , wherein the neighboring network device comprises a session-based router.

Assignments (1)

Continuity (3)

References Cited (22)