Method and system for validating ordered proof of transit of traffic packets in a network

A system for validating ordered proof of transit of network traffic comprising a plurality of network infrastructure nodes assignable to a path, the path starting from an ingress node and finishing at an egress node, in a network, each network infrastructure node comprising a set of input interfaces (20) for receiving at least a packet with a header containing metadata from a previous network infrastructure node within the path, wherein each network infrastructure node is configured to:

• identify a matching route for the received packet with a routing table (23) and to identify proof of transit metadata in the header of the received packet;
• if the matching route for the received packet is identified, and the packet contains proof of transit metadata, provide a first private key associated with the network infrastructure node and the previous network infrastructure node of the matching route in the path;
• if the matching route for the received packet is identified and the identified matching route is associated with proof of transit metadata and proof of transit metadata is identified in the header of the received packet, decrypt the proof of transit metadata by using the first private key provided by the storing means (22) of the network infrastructure node;
• and
• if the network infrastructure node is the ingress node, generate proof of transit metadata, which is included in the header of the received packet;
• and,
• if the network infrastructure node is the egress node, validate if the packet has traversed the path by verifying the proof of transit metadata and, if so, remove all the proof of transit metadata from the header before forwarding the packet via a set of output interfaces (21) provided by the network infrastructure node, otherwise drop the packet;
• and
• for any node, update the proof of transit metadata using unique information hosted per each node;
• wherein the proof of transit metadata generated by the ingress node comprises a random polynomial secret and a cumulative verification value, and wherein egress node verifies the proof of transit metadata by comparing the cumulative verification value and the random polynomial secret, using Shamir's Secret Sharing scheme;
• and
• network infrastructure node different from the egress node updates the proof of transit metadata by updating the cumulative verification value using unique information, following Shamir's Secret Sharing scheme;
• and each network infrastructure node different from the egress node is configured to re-encrypt the proof of transit metadata by using a second private key, before passing the packet with the header, the header including the re-encrypted proof of transit metadata, to a set of output interfaces (21), wherein the set of output interfaces (21) is provided by the network infrastructure node to forward the packet to a subsequent network infrastructure node of the matching route in the path and the storing means (22) of the network infrastructure node are further configured to provide the second private key associated with said network infrastructure node and the subsequent network infrastructure node of the matching route in the path;
• wherein, if the order traversing the path is not respected, a first private key is used to decrypt the proof of transit metadata, which is different from the second key used by the previous node in the path to re-encrypt the proof of transit metadata, and a wrong cumulative verification value is generated.