Verification of in-situ network telemetry data in a packet-switched network

A method comprising:

• obtaining, by a network node, a data packet of data traffic of a packet-switched network, wherein the data packet includes an in-situ network telemetry block;
• obtaining present telemetry data of the network node and the data packet;
• obtaining a cryptographic key that confidentially identifies the network node;
• producing signed telemetry data by encrypting at least a portion of the present telemetry data based on the cryptographic key;
• updating a telemetry-data entry of the in-situ network telemetry block, the telemetry-data entry being associated with the network node, wherein the update includes inserting the present telemetry data and signed telemetry data into the telemetry-data entry;
• and
• forwarding the data packet with the updated telemetry-data entry to another network node of the packet-switched network.

A method comprising:

• obtaining, by a verification device of a packet-switched network, an in-situ network telemetry block of a data packet of data traffic of a packet-switched network;
• selecting a telemetry-data entry in the in-situ network telemetry block, the entry being associated with a particular network node;
• extracting telemetry data and signed telemetry-data from the selected telemetry-data entry;
• obtaining a cryptographic key that identifies the particular network node;
• decrypting data of the signed telemetry-data based on the cryptographic key;
• determining whether the decrypted data matches at least a portion of the telemetry data;
• and
• in response to a determination of a match, verifying that the telemetry data as a genuine entry by the network node.