Granted Patent B2

US 12,309,268 · App. 17/324,876 · Granted May 20, 2025

Inventors: Ian James Wells (San Jose, CA); Kyle Andrew Donald Mestery (Woodbury, MN)

Assignee: Cisco Technology, Inc.

H04L9/088H04L9/30

Abstract

Claims (100)

1. A method for identifying, from a packet, consent that indicates a destination device has consented to receiving network communications, the method comprising:

receiving, at a consent-contract system, from the destination device in a network, an indication that the destination device has consented to receiving network communications from a sending device;

based at least in part on the indication, distributing, by the consent-contract system, a private key to the sending device, wherein the private key is usable to create signatures on consent data indicating that the destination device has consented to communicate with the sending device;

based at least in part on the indication, distributing, by the consent-contract system, a public key to a network device located in the network, wherein the public key is usable to verify signatures of consent data that have been signed using private keys provided to sending devices with which the destination device has consented to communicate;

receiving, at the network device, the packet that is to be sent over the network, the packet being sent from the sending device and to the destination device;

identifying, from the packet, consent data indicating that the destination device has consented to receiving the packet from the sending device;

using the public key, determining whether the consent data was signed by the sending device using the private key; and

in response to determining that the consent data was signed using the private key, sending the packet to a next-hop network device in the network such that the packet is being transmitted to the destination device; or

in response to determining that the consent data was not signed using the private key, dropping the packet.

2. The method of claim 1 , further comprising:

identifying, from the packet, a destination address associated with the destination device;

sending, to the consent-contract system, a request for a particular public key associated with the destination address of the destination device; and

receiving the public key from the consent-contract system.

3. The method of claim 1 , further comprising determining that the consent data indicates that the destination device has consented to receiving network communications from the sending device.

4. The method of claim 1 , further comprising:

receiving, from the consent-contract system, an indication of a range of destination addresses associated with the public key;

storing an association between the public key and the range of destination addresses;

determining that a destination address is included in the range of destination addresses; and

selecting the public key to verify that the consent data was signed using the private key based at least in part on the association.

5. The method of claim 4 , further comprising:

receiving a second packet that has a second destination address associated with a second destination device;

identifying, from the second packet, second consent data that was signed using the private key;

determining that the second destination address is included in the range of destination addresses; and

selecting the public key to verify that the second consent data was signed using the private key based at least in part on the association.

6. The method of claim 1 , wherein the network device comprises at least one of:

a network router;

a network switch;

a network modem;

a network hub;

a network gateway; or

a network access point.

7. The method of claim 1 , further comprising:

receiving, at the consent-contract system, first data that indicates the consent by the destination device to receive the network communications from the sending device;

receiving, at the consent-contract system, second data that includes a request by the sending device to communicate with the destination device;

using the private key, signing the consent data that indicates the consent by the destination device; and

sending the consent data to the sending device.

8. A method comprising:

receiving, at a consent-contract system, from a destination device in a network, an indication that the destination device has consented to receiving network communications from a sending device;

based at least in part on the indication, distributing, by the consent-contract system, a private key to the sending device, wherein the private key is usable to create signatures on consent data indicating that the destination device has consented to communicate with the sending device;

based at least in part on the indication, distributing, by the consent-contract system, a public key to a network device located in the network, wherein the public key is usable to verify signatures of consent data that have been signed using private keys provided to sending devices with which the destination device has consented to communicate;

receiving, at the network device, a packet that is to be sent over the network, the packet being sent from the sending device and to the destination device;

identifying, from the packet, consent data indicating that the destination device has consented to receiving the packet from the sending device;

determining whether the consent data was issued by the consent-contract system based at least in part on a signature by the sending device on the consent data, wherein the consent-contract system manages consent contracts indicating consent for network communications between devices; and

in response to determining that the consent data was issued by the consent-contract system, sending the packet to a next-hop network device in the network such that the packet is being transmitted to the destination device; or

in response to determining that the consent data was not issued by the consent-contract system, dropping the packet.

9. The method of claim 8 , further comprising determining that the consent data indicates that the destination device has consented to receiving network communications from the sending device.

10. The method of claim 8 , wherein determining whether the consent data was issued by the consent-contract system includes:

using the public key, determining that the consent data was signed using the private key, wherein the public key was provided to the network device from the consent-contract system.

11. The method of claim 10 , further comprising:

identifying, from the packet, a destination address associated with the destination device;

sending, to the consent-contract system, a request for a particular public key associated with the destination address of the destination device; and

receiving the public key from the consent-contract system.

12. The method of claim 10 , further comprising:

receiving, from the consent-contract system, an indication of a range of destination addresses associated with the public key;

storing an association between the public key and the range of destination addresses;

determining that a destination address is included in the range of destination addresses; and

selecting the public key to verify that the consent data was signed using the private key based at least in part on the association.

13. The method of claim 12 , further comprising:

receiving a second packet that has a second destination address associated with a second destination device;

identifying, from the second packet, second consent data that was signed using the private key;

determining that the second destination address is included in the range of destination addresses; and

selecting the public key to verify that the second consent data was signed using the private key based at least in part on the association.

14. The method of claim 10 , further comprising:

receiving, at the consent-contract system, first data that indicates the consent by the destination device to receive the network communications from the sending device;

receiving, at the consent-contract system, second data that includes a request by the sending device to communicate with the destination device;

using the private key, signing the consent data that indicates the consent by the destination device; and

sending the consent data to the sending device.

15. A consent-contract system comprising:

one or more processors; and

one or more computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving, from a destination device located in a network, an indication that the destination device has consented to receiving network communications from a sending device;

based at least in part on the indication, distributing a private key to the sending device, wherein the private key is usable to create signatures on consent data indicating that the destination device has consented to communicate with the sending device;

based at least in part on the indication, distributing a public key to a network device located in the network, wherein the public key is usable to verify signatures of consent data that have been signed using private keys provided to sending devices with which the destination device has consented to communicate;

receiving, at the network device, a packet that is to be sent over the network, the packet being sent from the sending device and to the destination device;

identifying, from the packet, consent data indicating that the destination device has consented to receiving the packet from the sending device;

verifying, using the public key, that the consent data was signed by the sending device using a private key;

determining that the destination device has consented to receiving the packet from the sending device based at least in part on the consent data being signed using the private key; and

sending the packet to a next-hop network device in the network such that the packet is being transmitted to the destination device.

16. The consent-contract system of claim 15 , the operations further comprising:

identifying, from the packet, a destination address associated with the destination device;

receiving, from the network device, a request for a particular public key associated with the destination address of the destination device; and

sending, to the network device, the particular public key from the consent-contract system.

17. The consent-contract system of claim 15 , further comprising determining that the consent data indicates that the destination device has consented to receiving network communications from the sending device.

18. The consent-contract system of claim 15 , the operations further comprising:

receiving an indication of a range of destination addresses associated with the public key;

storing an association between the public key and the range of destination addresses;

determining that a destination address is included in the range of destination addresses; and

selecting the public key to verify that the consent data was signed using the private key based at least in part on the association.

19. The consent-contract system of claim 18 , the operations further comprising:

receiving, at the network device, a second packet that has a second destination address associated with a second destination device;

identifying, from the second packet, second consent data that was signed using the private key;

determining that the second destination address is included in the range of destination addresses; and

selecting the public key to verify that the second consent data was signed using the private key based at least in part on the association.

20. The consent-contract system of claim 15 , wherein the network device comprises at least one of:

a network router;

a network switch;

a network modem;

a network hub;

a network gateway; or

a network access point.

Assignments (1)

Continuity (2)

References Cited (88)