Cryptographic peer discovery, authentication, and authorization for on-path signaling

An apparatus for secure network device policy configuration, comprising:

• means for intercepting, at an intermediary network device, one or more data packets that (a) are addressed to a destination device other than the intermediary network device, (b) collectively contain a request, and (c) collectively contain a group identifier;
• means for selecting, from among one or more cryptographic keys that are stored at the intermediary network device, a particular cryptographic key that is mapped to the group identifier;
• means for sending, toward an upstream device that sent the one or more data packets toward the intermediary network device, a first message that contains a first challenge;
• means for receiving a second message that contains a first response;
• means for generating a verification value based on (a) the particular cryptographic key and (b) the first challenge;
• means for determining whether the first response matches the verification value;
• and
• means for selecting, in response to determining that the first response matches the verification value, and from among one or more authorization sets, a particular authorization set that is mapped to the group identifier;
• means for determining, in response to determining that the first response matches the verification value, whether the request is allowed by the particular authorization set;
• and
• means for configuring, in response to determining that the first response matches the verification value, in response to determining that the request is allowed by the particular authorization set, and based on the request, a policy of the intermediary network device.

An apparatus for secure network device policy configuration, comprising:

• a network interface that is coupled to a data network for receiving one or more packet flows therefrom;
• a processor;
• one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of:
• intercepting, at an intermediary network device, one or more data packets that (a) are addressed to a destination device other than the intermediary network device, (b) collectively contain a request, and (c) collectively contain a group identifier;
• selecting, from among one or more cryptographic keys that are stored at the intermediary network device, a particular cryptographic key that is mapped to the group identifier;
• sending, toward an upstream device that sent the one or more data packets toward the intermediary network device, a first message that contains a first challenge;
• receiving a second message that contains a first response;
• generating a verification value based on (a) the particular cryptographic key and (b) the first challenge;
• determining whether the first response matches the verification value;
• and
• in response to determining that the first response matches the verification value, performing particular steps comprising:
• selecting, from among one or more authorization sets, a particular authorization set that is mapped to the group identifier;
• determining whether the request is allowed by the particular authorization set;
• and
• in response to determining that the request is allowed by the particular authorization set, configuring, based on the request, a policy of the intermediary network device.

A method comprising:

• intercepting one or more data packets that collectively contain a request;
• selecting, from among one or more cryptographic keys, a particular cryptographic key;
• sending, toward an upstream device, a first challenge;
• receiving a first response;
• generating a verification value based on the particular cryptographic key and the first challenge;
• determining whether the first response matches the verification value;
• and
• in response to determining that the first response matches the verification value:
• selecting, from among one or more authorization sets, a particular authorization set;
• determining whether the request is allowed by the particular authorization set;
• and
• in response to determining that the request is allowed by the particular authorization set, configuring, based on the request, an intermediary network device.