Internet packet provenance to verify packet validity and control packet usage
This disclosure provides systems, devices, apparatus, and methods, including computer programs encoded on storage media, to verify packet validity and control packet usage based on centrally stored and locally cached device profiles and usage policies. A processing device may receive, at an encryption tunnel, an unencrypted packet or a previously encrypted packet. The packet is encrypted with a one or more layers of encryption (e.g., C2 and/or C1). The processing device generates a Passport to accompany the packet, where the Passport is a data file including information to validate the packet and control packet usage. The processing device encrypts the Passport and the packet with an additional layer of encryption (C3) that provides a multi-tiered encryption stack for the packet and outputs, from the encryption tunnel, the Passport and the packet encrypted with the additional layer of encryption.
1 . A method comprising:
receiving, at a tunnel, a packet including an indication of a source from which the packet originated, the packet being encrypted with a first layer of encryption;
encrypting provenance data and the packet with a second layer of encryption that provides a multi-tiered encryption stack for the packet, the provenance data to accompany the packet encrypted with the first layer of encryption and including embedded provenance information to validate the source from which the packet originated and embedded usage policy information to control usage of the packet, the provenance data not being a header of the packet or trailer of the packet; and
outputting, from the tunnel, the provenance data and the packet encrypted with the second layer of encryption.
2 . The method of claim 1 , further comprising:
decrypting the second layer of encryption of the multi-tiered encryption stack to reveal the packet encrypted with the first layer of encryption and the provenance data, the provenance data being appended to the packet encrypted with the first layer of encryption.
3 . The method of claim 2 , further comprising:
validating, based on the information included in the provenance data, the packet encrypted with the first layer of encryption.
4 . The method of claim 3 , wherein the packet is validated at a hop point or an endpoint with or without reference to an external database.
5 . The method of claim 3 , further comprising:
decrypting, at a destination of the packet, the first layer of encryption based on the packet being validated using the information included in the provenance data.
6 . The method of claim 1 , wherein the header of the packet and the trailer of the packet correspond to a protocol structure and a use indicated by Internet Engineering Task Force (IETF) request for comments (RFC).
7 . The method of claim 1 , wherein a format of the provenance data includes JavaScript Object Notation (JSON), extensible markup language (XML) or other formatted data.
8 . The method of claim 1 , further comprising:
rejecting the packet when the packet is not accompanied by the provenance data within the tunnel.
9 . The method of claim 1 , wherein the provenance data includes at least one of: an internet protocol (IP) address, a device profile, an encryption key, or a device fingerprint, or one or more other unique identifiers.
10 . The method of claim 1 , wherein the provenance data includes a device fingerprint for any computing device, an internet-of-things (IoT) device, or other network connected equipment.
11 . The method of claim 1 , wherein the packet includes an initial layer of encryption prior to the first layer of encryption, and
wherein the initial layer of encryption corresponds to a cryptography 1 (C1) inner encryption layer, the first layer of encryption corresponds to a cryptography 2 (C2) middle encryption layer, and the second layer of encryption corresponds to a cryptography 3 (C3) outer encryption layer.
12 . The method of claim 1 , wherein the packet is at least one of: encrypted within the tunnel or encrypted prior to receiving the packet at the tunnel.
13 . The method of claim 1 , wherein the indication of the source from which the packet originated corresponds to an internet protocol (IP) address.
14 . The method of claim 1 , wherein the embedded usage policy information controls the usage of the packet at a granularity of at least one of: an individual computing device, an internet of things (IoT) device, a machine sensor, a protocol, a file type, and internet protocol (IP) geofencing level, an operational date, or an operation time.
15 . An apparatus comprising:
a memory; and
at least one processor coupled to the memory and configured to:
receive, at a tunnel, a packet including an indication of a source from which the packet originated, the packet being encrypted with a first layer of encryption;
encrypt provenance data and the packet with a second layer of encryption that provides a multi-tiered encryption stack for the packet, the provenance data to accompany the packet encrypted with the first layer of encryption, the provenance data including embedded provenance information to validate the source from which the packet originated and an embedded usage policy information to control a usage of the packet, the provenance data not being a header of the packet or a trailer of the packet; and
output, from the tunnel, the provenance data and the packet encrypted with the second layer of encryption.
16 . The apparatus of claim 15 , wherein the at least one processor is further configured to:
decrypt the second layer of encryption of the multi-tiered encryption stack to reveal the packet encrypted with the first layer of encryption and the provenance data in the clear, the provenance data being appended to the packet encrypted with the first layer of encryption.
17 . The apparatus of claim 16 , wherein the at least one processor is further configured to:
validate, based on the information included in the provenance data, the packet encrypted with the first layer of encryption.
18 . The apparatus of claim 17 , wherein the packet is validated at a hop point or an endpoint without reference to an external database.
19 . The apparatus of claim 17 , wherein the at least one processor is further configured to:
decrypt, at a destination of the packet, the first layer of encryption based on the packet being validated using the information included in the provenance data.
20 . The apparatus of claim 15 , wherein the header of the packet and the trailer of the packet corresponding to a protocol structure and a use indicated by Internet Engineering Task Force (IETF) request for comments (RFC).
21 . A method comprising:
receiving, a destination, an encrypted packet that has been encrypted with a multi-tiered encryption stack having first and second layers of encryption;
decrypting the second layer of encryption packet to reveal provenance data and the packet encrypted with the first layer of encryption, the provenance data accompanying the packet encrypted with the first layer of encryption and including embedded provenance information to validate the source from which the packet originated and embedded usage policy information to control usage of the packet, the provenance data not being a header of the packet or trailer of the packet;
decrypting the packet that is encrypted with a first layer of encryption based on the packet being validated using the information included in the provenance data; and
outputting the decrypted packet upon being decrypted based on the packet being validated using the information included in the provenance data, the decrypted packet including an indication of the source form which the packet originated.
22 . The method of claim 21 , further comprising:
validating, based on the information included in the provenance data, the packet encrypted with the first layer of encryption.
23 . The method of claim 22 , wherein the packet is validated at a hop point or an endpoint without reference to an external database.
24 . The method of claim 21 , wherein the header of the packet and the trailer of the packet correspond to a protocol structure and a use indicated by Internet Engineering Task Force (IETF) request for comments (RFC).
25 . The method of claim 21 , wherein a format of the provenance data includes JavaScript Object Notation (JSON) or extensible markup language (XML).
26 . The method of claim 21 , further comprising:
rejecting the packet when the packet is not accompanied by the provenance data within an encryption tunnel.
27 . The method of claim 21 , wherein the provenance data includes at least one of: an internet protocol (IP) address, a device profile, an encryption key, or a device fingerprint.
28 . The method of claim 21 , wherein the provenance data includes a device fingerprint for an internet-of-things (IoT) device.
29 . The method of claim 21 , wherein the packet includes an initial layer of encryption prior to the first layer of encryption, and
wherein the initial layer of encryption corresponds to a cryptography 1 (C1) inner encryption layer, the first layer of encryption corresponds to a cryptography 2 (C2) middle encryption layer, and the second layer of encryption corresponds to a cryptography 3 (C3) outer encryption layer.
30 . The method of claim 21 , wherein an indication of the source from which the packet originated corresponds to an internet protocol (IP) address.
31 . The method of claim 21 , wherein the embedded usage policy information controls the usage of the packet at a granularity of at least one of: an individual computing device, an internet of things (IoT) device, a machine sensor, a protocol, a file type, and internet protocol (IP) geofencing level, an operational date, or an operation time.