# US 2019/0246160 A1 · Securing an overlay network against attack

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0246160 A1
- Document ID: US20190246160A1
- Status: Published application
- Kind: A1
- Application number: 16/267,578
- Filed: 2019-02-05
- Published: 2019-08-08
- Earliest claimed: 2018-02-06
- Assignees: Akamai Technologies, Inc.
- Applicants: Akamai Technologies, Inc.
- Inventors: Brandon O. Williams; Liza Alenchery; Yixin Jin
- Web page: https://patentgrep.com/patent/US20190246160A1

## CPC

- H04N 21/26613: {for generating or managing keys in general (key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04)}
- H04L 9/006: {involving public key infrastructure [PKI] trust models (network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 9/0838: {Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061)}
- H04L 9/0872: {using geo-location information, e.g. location data, time, relative position or proximity to other entities}
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling}
- H04L 45/50: using label swapping, e.g. multi-protocol label switch [MPLS]
- H04L 45/64: using an overlay routing layer
- H04L 63/0272: {Virtual private networks}
- H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)}
- H04L 63/0815: {providing single-sign-on or federations}
- H04L 63/123: {received data contents, e.g. message integrity}
- H04N 21/63345: {by transmitting keys (key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06)}
- H04L 2209/60: Digital content management, e.g. content distribution
- H04L 2463/061: applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
- H04N: PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The techniques herein provide for enhanced overlay network-based transport of traffic, such as IPsec traffic, e.g., to and from customer branch office locations, facilitated through the use of the Internet-based overlay routing infrastructure. This disclosure describes a method of providing integrity protection for traffic on the overlay network.

## Claims

### Claim 1

A method operative in an overlay network configured to provide UDP-based packet transport across the publicly-routed Internet between and among regions, the regions comprising at least one ingress edge region, and at least one egress gateway region, comprising:
associating a private key pair to each region;
deriving a shared secret across a pair of regions, the region pair operating according to a trust scheme;
using the shared secret to generate a key;
using the key and additional data to compute an integrity check value (ICV), wherein the integrity check value is unique to the region pair; and
incorporating the ICV into an overlay network packet header associated with each data packet communicated between the region pair during a flow.

### Claim 2 (depends on 1)

The method as described in claim 1 further including:
receiving the data packet at a machine in the region pair;
determining whether ICV is valid; and
forwarding the data packet at least in part upon a determination that the ICV is valid.

### Claim 3 (depends on 1)

The method as described in claim 1 wherein the region pair comprises the ingress edge region and the egress gateway region, and wherein the data packet is associated with the flow between these regions.

### Claim 4 (depends on 3)

The method as described in claim 3 wherein the flow is a unidirectional UDP connection between a machine in the ingress edge region, and a machine in the egress gateway region.

### Claim 5 (depends on 1)

The method as described in claim 1 wherein the flow also passes through one or more additional regions.

### Claim 6 (depends on 1)

The method as described in claim 1 wherein the other data comprises source and destination Internet Protocol (IP) addresses, and data derived from one or more data fields of the overlay network packet header.

### Claim 7 (depends on 1)

The method as described in claim 1 wherein the shared secret is derived by the ingress edge region using a private key of the ingress edge region, and a public key of the egress gateway region, and wherein the shared secret is derived by the egress edge region using a private key of the egress edge region and the public key of the ingress edge region.

### Claim 8 (depends on 1)

The method as described in claim 1 wherein the trust scheme comprises a set of trust levels, wherein at least a first trust level in the set has a different degree of trust as compared to a second trust level.

### Claim 9 (depends on 1)

The method as described in claim 1 wherein the region pair comprises a collection of regions in the overlay network that are managed according to a same trust level in the trust scheme.

### Claim 10 (depends on 9)

The method as described in claim 9 wherein associating the private key pair ensures that a region cannot impersonate another region outside of its trust level.

### Claim 11

A method operative in an overlay network configured to provide UDP-based packet transport across the publicly-routed Internet between and among regions, the regions comprising at least one ingress edge region, and at least one egress gateway region, comprising:
organizing multiple regions into a collective, the collective associated with a trust level of a multi-level trust scheme;
having each of the machines in the multiple regions of the collective subscribe to a collection of keying materials, the collection being associated with the trust level of the collective, as well as one or more other trust levels lower in the multi-level trust scheme;
having a pair of regions use the keying materials to generate a key;
using the key to generate a message authentication code; and
applying the message authentication code to data packets within a flow across the region pair to prevent attack.

### Claim 12 (depends on 11)

The method as described in claim 11 wherein the message authentication code is an integrity check value (ICV) that is unique to the region pair.

### Claim 13 (depends on 11)

The method as described in claim 11 wherein the ICV is applied to data packets by writing the ICV into a dedicated ICV field of an overlay network packet header.

### Claim 14 (depends on 11)

The method as described in claim 11 wherein the region pair comprises the ingress edge region and the egress gateway region, and wherein the data packet is associated with the flow between these regions.

### Claim 15 (depends on 14)

The method as described in claim 14 wherein the flow is a unidirectional UDP connection between a machine in the ingress edge region, and a machine in the egress gateway region.

### Claim 16 (depends on 11)

The method as described in claim 11 wherein a first region within the trust level impersonates a second region with the trust level with respect to data packets sent on the overlay network by the first region having access to the second region's private keying material used to generate the key.

### Claim 17 (depends on 11)

The method as described in claim 11 wherein the overlay network comprises a content delivery network (CDN).

### Claim 18

A method for overlay network integrity protection, comprising:
configuring a set of regions of the overlay network according to a multi-level trust scheme, whereby a first region associated with a first trust level is unable to represent itself to a second region associated with a second trust level as more trusted than it is; and
associating region pairs within a trust level with a per-region pair integrity check value (ICV), the ICV being associated with each data packet of a flow across a particular region pair.

### Claim 19 (depends on 18)

The method as described in claim 18 further including using the ICV to verify integrity of a data packet in the flow.

### Claim 20 (depends on 18)

The method as described in claim 18 wherein the ICV is associated with each data packet by being incorporated in an overlay network packet header, wherein inclusion of the ICV in the overlay network packet header secures the flow against a replay attack.