Applying attestation to segment routing
In one embodiment, a method by an apparatus of a segment routing (SR) network includes receiving a data packet and accessing an attestation token for the apparatus. The method further includes determining a location within a header of the received data packet for the attestation token and creating an updated header by encoding the attestation token in the determined location of the header. The method further includes sending the updated header with the encoded attestation token to another apparatus of the SR network.
1. An apparatus of a segment routing (SR) network, the apparatus comprising:
one or more processors; and
one or more non-transitory computer-readable storage media coupled to the one or more processors and comprising instructions operable when executed by the one or more processors to cause the one or more processors to perform operations comprising:
receiving a data packet;
accessing an attestation token for the apparatus;
determining a location within a header of the received data packet for the attestation token;
creating an updated header by encoding the attestation token in the determined location of the header, wherein encoding the attestation token in the determined location of the header comprises writing the attestation token in a Type-Length-Value (TLV); and
sending the updated header with the encoded attestation token to another apparatus of the SR network.
2. The apparatus of claim 1 , wherein the apparatus of the SR network comprises a router or an SR endpoint.
3. The apparatus of claim 1 , wherein the attestation token is generated by a crypto-processor of the apparatus.
4. The apparatus of claim 1 , wherein the SR network is a Segment Routing—Multiprotocol Label Switching (SR-MPLS) network.
5. The apparatus of claim 1 , wherein the SR network is a Segment Routing over IPv6 (SRv6) network.
6. The apparatus of claim 1 , wherein:
determining the location within a header of the received data packet for the attestation token comprises computing a new offset value using an existing offset value stored in the header; and
creating the updated header comprises writing the new offset value in the header.
7. A method by an apparatus of a segment routing (SR) network, the method comprising:
receiving a data packet;
accessing an attestation token for the apparatus;
determining a location within a header of the received data packet for the attestation token;
creating an updated header by encoding the attestation token in the determined location of the header, wherein encoding the attestation token in the determined location of the header comprises writing the attestation token in a Type-Length-Value (TLV); and
sending the updated header with the encoded attestation token to another apparatus of the SR network.
8. The method of claim 7 , wherein the apparatus of the SR network comprises a router or an SR endpoint.
9. The method of claim 7 , wherein the attestation token is generated by a crypto-processor of the apparatus.
10. The method of claim 7 , wherein the SR network is a Segment Routing—Multiprotocol Label Switching (SR-MPLS) network.
11. The method of claim 7 , wherein the SR network is a Segment Routing over IPv6 (SRv6) network.
12. The method of claim 7 , wherein:
determining the location within a header of the received data packet for the attestation token comprises computing a new offset value using an existing offset value stored in the header; and
creating the updated header comprises writing the new offset value in the header.
13. One or more non-transitory computer-readable storage media embodying software that is operable when executed to:
receive a data packet at an apparatus of a segment routing (SR) network;
access an attestation token for the apparatus;
determine a location within a header of the received data packet for the attestation token, wherein determining the location within the header of the received data packet for the attestation token comprises computing a new offset value using an existing offset value stored in the header;
create an updated header by encoding the attestation token in the determined location of the header, wherein creating the updated header comprises writing the new offset value in the header; and
send the updated header with the encoded attestation token to another apparatus of the SR network.
14. The one or more non-transitory computer-readable storage media of claim 13 , wherein the apparatus of the SR network comprises a router or an SR endpoint.
15. The one or more non-transitory computer-readable storage media of claim 13 , wherein the attestation token is generated by a crypto-processor of the apparatus.
16. The one or more non-transitory computer-readable storage media of claim 15 , wherein encoding the attestation token in the determined location of the header comprises writing the attestation token in a Type-Length-Value (TLV).
17. The one or more non-transitory computer-readable storage media of claim 15 , wherein the SR network is a Segment Routing—Multiprotocol Label Switching (SR-MPLS) network or a Segment Routing over IPv6 (SRv6) network.