Data network path integrity verification
AssigneePaypal, Inc.
InventorShlomi Boutnaru
Life of this patent
Estimating the term…
Abstract
Data packets transmitted and/or handled by various systems can be injected with cryptographically signed data, which may be stored in a TCP and/or IP options field of a data packet. Systems handling the packet may have a particular private cryptographic key used to sign a hash of the packet, which can ensure the integrity of a packet's data path flow. A downstream system can analyze the encrypted path information to verify that the packet was handled correctly. Transaction integrity can be verified using these techniques, which also provide enhanced monitoring capability and the ability to detect if a packet and/or transaction is being handled in an unexpected or incorrect manner. The techniques described herein may apply to cloud computing environments, as well as other environments.
Claims20
A method for providing data path security protection, comprising:
- receiving a particular data packet at a destination computer system;
- determining, at the destination computer system, a transit path sequence applicable to the particular data packet, the transit path sequence including an ordered series of one or more nodes;
- extracting a cryptographic check sequence from options field data of the particular data packet;
- and
- analyzing the cryptographic check sequence using a verification group of one or more encryption keys.
A packet-handling system, comprising:
- a processor;
- a network interface device;
- and
- a memory having stored thereon instructions that are executable by the processor to cause the system to perform operations comprising:
- accessing a private individual system key issued only for the packet-handling system;
- performing a hash operation on payload data of a particular data packet to determine a packet hash value;
- encrypting the packet hash value using the private individual system key to produce a first signature comprising a first encrypted packet hash value;
- storing the first signature in a transmission control protocol (TCP) or internet protocol (IP) options field of the particular data packet;
- and
- subsequent to the storing, transmitting the particular data packet with the first signature to a downstream system.
A non-transitory computer-readable medium having stored thereon instructions executable by a computer system to cause the computer system to perform operations comprising:
- receiving a particular data packet;
- determining a transit path sequence applicable to the particular data packet, the transit path sequence including an ordered series of one or more nodes;
- extracting a cryptographic check sequence from options field data of the particular data packet;
- and
- analyzing the cryptographic check sequence using a verification group of one or more encryption keys.
Dependencies are inferred from the claim text.