Protecting signaling messages in hop-by-hop network communication link

A method of protecting signaling messages in a hop-by-hop network communication link between a source node in the network and a destination node in the network, the communication link including at least one intermediate node in the network between the source node and the destination node, the method comprising:

• providing the source node with a source node public digital signature verification key and a respective source node private digital signature key associated with said public digital signature verification key;
• providing the destination node with said source node public digital signature verification key associated with the source node private digital signature key;
• at the source node:
• building a signaling message including a sequence of Information Elements;
• for each Information Element, calculating an Information Element hash value of the Information Element;
• calculating a sequence hash value of a concatenation of the calculated Information Element hash values;
• generating a source node digital signature by digitally signing the calculated sequence hash value, said digitally signing comprising exploiting the source node private digital signature key and the source node public digital signature verification key;
• including the source node digital signature in the signaling message, and sending the signaling message;
• at the intermediate node:
• receiving the signaling message and forwarding it to the destination node directly or via a next intermediate node;
• at the destination node:
• receiving the signaling message.

A method of protecting signaling messages in a hop-by-hop network communication link between a source node in the network and a destination node in the network, the communication link including at least one intermediate node in the network between the source node and the destination node, the method comprising:

• providing the source node and the at least one intermediate node with a public encryption key;
• providing the destination node and authorized intermediate nodes among said at least one intermediate node with a private destination node decryption key and respective private intermediate node decryption keys, the decryption keys being associated with the public encryption key, wherein said private decryption key has embedded therein a respective node attribute set including at least one node attribute, particularly an identifier of the node or an expiry time/date of said private decryption key;
• at the source node:
• encrypting at least one Information Element to obtain an encrypted Information Element, by exploiting the public encryption key and embedding an access policy in said encrypting, and including the encrypted Information Element in the sequence of Information Elements;
• at the destination node and said authorized intermediate node:
• decrypting the encrypted Information Element exploiting the destination node private decryption key and the respective authorized intermediate node private decryption key, to obtain a decrypted Information Element.