# US 11,444,955 B2 · Verification of in-situ network telemetry data in a packet-switched network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,444,955 B2
- Document ID: US11444955B2
- Status: Granted
- Kind: B2
- Application number: 16/916,368
- Filed: 2020-06-30
- Published: 2021-12-30
- Granted: 2022-09-13
- Earliest claimed: 2020-06-30
- Assignees: Cisco Technology, Inc.
- Applicants: Cisco Technology, Inc.
- Inventors: Shwetha Subray Bhandari; Santhosh N; Rakesh Reddy Kandula; Saiprasad Reddy Muchala; Frank Brockners
- Web page: https://patentgrep.com/patent/US11444955B2

## CPC

- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 63/123: {received data contents, e.g. message integrity}
- H04L 9/0869: {involving random numbers or seeds}
- H04L 9/321: {involving a third party or a trusted authority}
- H04L 45/72: {Routing based on the source address}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)}
- H04L 63/126: {the source of the received data}
- H04L 2463/061: applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Techniques to facilitate verification of in-situ network telemetry data of data packet of data traffic of packet-switched networks are described herein. A technique described herein includes a network node obtaining a data packet of data traffic of a packet-switched network. The data packet includes an in-situ network telemetry block. The network node obtains telemetry data and cryptographic key. The cryptographic key confidentially identifies the network node. The node encrypts at least a portion of the telemetry data based on the cryptographic key to produce signed telemetry data and updates telemetry-data entry of the in-situ network telemetry block. The telemetry data and signed telemetry data is inserted into the telemetry-data entry. The node forwards the data packet with the updated telemetry-data entry to another network node of the packet-switched network.

## Claims

### Claim 1

A system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to:
obtain, by a network node, a data packet of data traffic of a packet-switched network, wherein the data packet includes an in-situ network telemetry block;
obtain present telemetry data of the network node and the data packet;
obtain a cryptographic key that confidentially identifies the network node;
produce signed telemetry data by encrypting at least a portion of the present telemetry data based on the cryptographic key;
update a telemetry-data entry of the in-situ network telemetry block, the telemetry-data entry being associated with the network node, wherein the update includes insert the present telemetry data and signed telemetry data into the telemetry-data entry; and
forward the data packet with the updated telemetry-data entry to another network node of the packet-switched network.

### Claim 2 (depends on 1)

The system of claim 1, wherein the present telemetry data is selected from a group consisting of an identification of the network node, measured factors regarding traversal of the data packet through the network node, an identification of an interface on which the data packet was received, an identification of an interface on which the data packet was forwarded, a utilization of resources of the network node, timestamps, sequence numbers, a queue size, and a geo-location of the node that handled the packet.

### Claim 3 (depends on 1)

The system of claim 1, wherein production of the signed telemetry data includes encryption of data from another telemetry-data entry of the in-situ network telemetry block, the other telemetry-data entry being supplied by a previous network node of the data traffic of the packet-switched network.

### Claim 4 (depends on 1)

The system of claim 1, wherein the cryptographic key is part of an asymmetric pair of keys.

### Claim 5 (depends on 1)

The system of claim 1, wherein the cryptographic key is a confidential symmetric key that is shared between the network node and a verification device.

### Claim 6 (depends on 5)

The system of claim 5, wherein the update the data packet includes:
obtain a symmetric-key validation identification from the verification device, the symmetric-key validation identification being associated with the verification device and the network node; and
include the symmetric-key validation identification into the in-situ network telemetry block,
wherein the symmetric-key validation identification being an additional basis for the encryption of the signed telemetry data of the network node.

### Claim 7 (depends on 5)

The system of claim 5, wherein the update the data packet includes:
obtain a confidential seed key from the verification device, the confidential seed key being associated with the verification device and confidential between the verification device and the network node;
for each data packet of a plurality of data packets, generate a dynamic-key identification based on the confidential seed key, the dynamic-key identification being associated with one data packet of the plurality of data packets;
include the dynamic-key identification into the in-situ network telemetry block,
wherein the dynamic-key identification being an additional basis for the encryption of the signed telemetry data of the network node.

### Claim 8

A method comprising:
obtaining, by a network node, a data packet of data traffic of a packet-switched network, wherein the data packet includes an in-situ network telemetry block;
obtaining present telemetry data of the network node and the data packet;
obtaining a cryptographic key that confidentially identifies the network node;
producing signed telemetry data by encrypting at least a portion of the present telemetry data based on the cryptographic key;
updating a telemetry-data entry of the in-situ network telemetry block, the telemetry-data entry being associated with the network node, wherein the update includes inserting the present telemetry data and signed telemetry data into the telemetry-data entry; and
forwarding the data packet with the updated telemetry-data entry to another network node of the packet-switched network.

### Claim 9 (depends on 8)

The method of claim 8, wherein the present telemetry data is selected from a group consisting of an identification of the network node, measured factors regarding traversal of the data packet through the network node, an identification of an interface on which the data packet was received, an identification of an interface on which the data packet was forwarded, a utilization of resources of the network node, timestamps, sequence numbers, a queue size, and a geo-location of the node that handled the packet.

### Claim 10 (depends on 8)

The method of claim 8, wherein the production of the signed telemetry data includes encryption of data from another telemetry-data entry of the in-situ network telemetry block, the other telemetry-data entry being supplied by a previous network node of the data traffic of the packet-switched network.

### Claim 11 (depends on 10)

The method of claim 10, wherein the cryptographic key is part of an asymmetric pair of keys.

### Claim 12 (depends on 10)

The method of claim 10, wherein the cryptographic key is a confidential symmetric key that is shared between the network node and a verification device.

### Claim 13 (depends on 12)

The method of claim 12, wherein the update the data packet includes:
obtain a symmetric-key validation identification from the verification device, the symmetric-key validation identification being associated with the verification device and the network node; and
include the symmetric-key validation identification into the in-situ network telemetry block,
wherein the symmetric-key validation identification being an additional basis for the encryption of the signed telemetry data of the network node.

### Claim 14 (depends on 12)

The method of claim 12, wherein the update the data packet includes:
obtain a confidential seed key from the verification device, the confidential seed key being associated with the verification device and confidential between the verification device and the network node;
for each data packet of a plurality of data packets, generate a dynamic-key identification based on the confidential seed key, the dynamic-key identification being associated with one data packet of the plurality of data packets;
include the dynamic-key identification into the in-situ network telemetry block,
wherein the dynamic-key identification being an additional basis for the encryption of the signed telemetry data of the network node.

### Claim 15

A method comprising:
obtaining, by a verification device of a packet-switched network, an in-situ network telemetry block of a data packet of data traffic of a packet-switched network;
selecting a telemetry-data entry in the in-situ network telemetry block, the entry being associated with a particular network node;
extracting telemetry data and signed telemetry-data from the selected telemetry-data entry;
obtaining a cryptographic key that identifies the particular network node;
decrypting data of the signed telemetry-data based on the cryptographic key;
determining whether the decrypted data matches at least a portion of the telemetry data; and
in response to a determination of a match, verifying that the telemetry data as a genuine entry by the network node.

### Claim 16 (depends on 15)

The method of claim 15, wherein the telemetry data is selected from a group consisting of an identification of the network node, measured factors regarding traversal of the data packet through the network node, an identification of an interface on which the data packet was received, an identification of an interface on which the data packet was forwarded, a utilization of resources of the network node, timestamps, sequence numbers, a queue size, and a geo-location of the node that handled the packet.

### Claim 17 (depends on 15)

The method of claim 15, wherein the decrypting includes:
selecting another entry in the in-situ network telemetry block, the other entry being associated with a previous network node of the data traffic that traversed the data-traffic path across the packet-switched network; and
decrypting data of the signed telemetry-data based on the cryptographic key and data from the other selected entry in the in-situ network telemetry block.

### Claim 18 (depends on 15)

The method of claim 15, wherein the cryptographic key is part of an asymmetric pair of keys.

### Claim 19 (depends on 15)

The method of claim 15, wherein the cryptographic key is a confidential symmetric key that is shared between the network node and the verification device.

### Claim 20 (depends on 19)

The method of claim 19 further comprising distribution, by the verification device, of the cryptographic key with the network node.