Granted Patent B2

US 12,647,266 · App. 18/905,930 · Granted Jun 2, 2026

Inventors: Arul Murugan Manickam (Mountain House, CA); Basavaraju Halappa (San Jose, CA)

Assignee: Cisco Technology, Inc.

H04L9/14

Abstract

Claims (39)

1 . A method, comprising:

receiving, at a device in a computer network, a packet having an unencrypted header and an encrypted segment list, wherein the device is an authorized segment hop device and wherein a destination address within the unencrypted header matches an address of the device, wherein the encrypted segment list is encrypted using a private key;

decrypting, by the device and in response to the destination address within the unencrypted header matching the address of the device, the encrypted segment list to expose at least a next segment hop address in the encrypted segment list, wherein decrypting comprises decrypting the encrypted segment list using a public key received from a controller;

replacing, by the device, the destination address within the unencrypted header with the next segment hop address; and

forwarding, from the device, the packet toward the next segment hop address along with the encrypted segment list.

2 . The method of claim 1 , wherein the encrypted segment list, when decrypted, is view-only to the device.

3 . The method of claim 1 , wherein the packet is formatted as a Segment Routing for Internet Protocol version 6 packet.

4 . The method of claim 1 , wherein the packet comprises an encrypted Software-Defined Wide Area Network Internet Protocol Security tunneled packet that remains un-decrypted while forwarding.

5 . The method of claim 4 , wherein a last segment hop for the packet decrypts the packet before forwarding toward a final destination device.

6 . The method of claim 1 , wherein the computer network comprises a hierarchical multi-region fabric.

7 . The method of claim 1 , further comprising:

rekeying keys used for decrypting the encrypted segment list with a controller.

8 . The method of claim 1 , further comprising:

reducing a segment left field by one segment prior to forwarding the packet.

9 . A method, comprising:

determining, by a device, a segment list corresponding to a segment route from a source device to a destination device via one or more authorized segment hop devices across a computer network;

encrypting, by the device, the segment list into an encrypted segment list using a private key, wherein a public key corresponding to the private key is distributed only to authorized devices of the computer network; and

causing, by the device, the encrypted segment list to be carried within packets forwarded from the source device to the destination device, wherein the packets are forwarded through the computer network with the encrypted segment list and an unencrypted header indicating a subsequent segment hop, and wherein only the one or more authorized segment hop devices are configured to decrypt the encrypted segment list using the public key to expose at least a next segment hop address and then forward the packets with the encrypted segment list and with the next segment hop address replacing the subsequent segment hop in the unencrypted header.

10 . The method of claim 9 , wherein the device is a controller within the computer network.

11 . The method of claim 10 , wherein causing comprises:

sending the encrypted segment list to an edge device to add the encrypted segment list to the packets when received from the source device.

12 . The method of claim 11 , wherein the edge device does not have the private key.

13 . The method of claim 9 , wherein the device is one of either the source device or an edge device associated with the source device.

14 . The method of claim 13 , wherein causing comprises:

encapsulating the packets within an encapsulation containing the encrypted segment list.

15 . The method of claim 13 , wherein determining comprises:

obtaining the segment list from a controller.

16 . The method of claim 9 , wherein the packets are formatted as a Segment Routing for Internet Protocol version 6 packets.

17 . The method of claim 9 , wherein the packets comprise encrypted Software-Defined Wide Area Network Internet Protocol Security tunneled packets that remain un-decrypted while forwarded across the computer network.

18 . The method of claim 9 , further comprising:

rekeying the private key and the public key.

19 . An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the one or more network interfaces and configured to execute one or more processes; and

a non-transitory memory configured to store a process that is executable by the processor, the process comprising:

receiving, as a device, a packet having an unencrypted header and an encrypted segment list, wherein the device is an authorized segment hop device, wherein a destination address within the unencrypted header matches an address of the device, wherein the encrypted segment list is encrypted using a private key;

decrypting, in response to the destination address within the unencrypted header matching the address of the device, the encrypted segment list to expose at least a next segment hop address in the encrypted segment list, wherein decrypting comprises decrypting the encrypted segment list using a public key received from a controller;

replacing the destination address within the unencrypted header with the next segment hop address; and

forwarding the packet toward the next segment hop address along with the encrypted segment list.

Assignments (1)

Continuity (1)

References Cited (31)