# US 2023/0054738 A1 · Advertising bgp destination secure path requirement in global internet

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2023/0054738 A1
- Document ID: US20230054738A1
- Status: Published application
- Kind: A1
- Application number: 17/406,321
- Filed: 2021-08-19
- Published: 2023-02-23
- Earliest claimed: 2021-08-19
- Assignees: Cisco Technology, Inc.
- Applicants: Cisco Technology, Inc.
- Inventors: Swadesh Agrawal; Dhananjaya Kasargod Rao; Jakob Heitz; Eric Voit
- Web page: https://patentgrep.com/patent/US20230054738A1

## CPC

- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)}
- H04L 9/3247: {involving digital signatures}
- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L 45/02: Topology update or discovery
- H04L 45/54: {Organization of routing tables}
- H04L 45/74: Address processing for routing
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 45/04: {Interdomain routing, e.g. hierarchical routing}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Disclosed are systems, apparatuses, methods, and computer-readable media for secure network routing. A method includes: receiving, at a network node, an advertisement message for a network route including an IP address prefix; receiving, at the network node, a route origin authorization associated with the IP address prefix, the route origin authorization including a digital signature and a security requirement of a route to a destination that corresponds to the IP address prefix; determining, by the network node, one or more network nodes satisfies the security requirement to yield a determination; and determining, by the network node, to route network traffic to the IP address prefix based on the determination. In one example, the method can include, when the one or more network nodes satisfies the security requirement, advertising the route to the one or more network nodes that satisfies the security requirement.

## Claims

### Claim 1

A method comprising:
receiving, at a network node, an advertisement message for a network route including an IP address prefix;
receiving, at the network node, a route origin authorization associated with the IP address prefix, the route origin authorization including a digital signature and a security requirement of a route to a destination that corresponds to the IP address prefix;
determining, by the network node, one or more network nodes that satisfy the security requirement to yield a determination; and
determining, by the network node, to route network traffic to the IP address prefix based on the determination.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
storing network routes in a routing table corresponding to the one or more network nodes, wherein a network route to another network node that does not satisfy the security requirement for the IP address prefix is omitted from the routing table.

### Claim 3 (depends on 2)

The method of claim 2, further comprising:
receiving an instruction indicating that a certificate associated with the digital signature is revoked; and
updating the routing table exclude routes to the IP address prefix.

### Claim 4 (depends on 1)

The method of claim 1, wherein the advertisement of the route is included in a border gateway protocol (BGP) update message.

### Claim 5 (depends on 1)

The method of claim 1, wherein the digital signature is generated using an End Entity (EE) certificate of the route origin authorization.

### Claim 6 (depends on 4)

The method of claim 4, wherein the EE certificate is generated using a certificate authority (CA) certificate.

### Claim 7 (depends on 1)

The method of claim 1, wherein the one or more network nodes that satisfy the security requirement include a trusted platform module.

### Claim 8 (depends on 1)

The method of claim 1, wherein determining whether to route network traffic to the IP address prefix, comprises:
receiving network traffic to be relayed to the destination that corresponds to the IP address prefix;
determining to route the network traffic based on the security requirement.

### Claim 9 (depends on 1)

The method of claim 1, wherein determining whether to the route network traffic to the IP address prefix comprises:
receiving network traffic to be relayed to the destination;
determining a route to the destination that best corresponds to the security requirement.

### Claim 10 (depends on 1)

The method of claim 1, wherein determining whether to the route network traffic to the IP address prefix comprises:
when the one or more network nodes satisfies the security requirement, advertising the route to the one or more network nodes that satisfies the security requirement.

### Claim 11

A network device for routing network traffic, comprising:
a transceiver; and
one or more processors coupled to the transceiver, the one or more processors being configured to execute computer-readable instructions stored on one or more associated memories to:
receive an advertisement message for a network route including an IP address prefix,
receive a route origin authorization associated with the IP address prefix, the route origin authorization including a digital signature and security requirement of a route to a destination that corresponds to the IP address prefix,
determine whether one or more network nodes satisfies the security requirement to yield a determination, and
determine whether to route network traffic to the IP address prefix based on the determination.

### Claim 12 (depends on 12)

This is a fake claim due to claim 12 not existing in the original document. This is specifically inserted for the purpose of pushing the document through.

### Claim 13 (depends on 12)

The network device of claim 12, wherein the one or more processors are configured to execute the computer-readable instructions to:
store network routes in a routing table corresponding to the one or more network nodes, wherein a network route to another network node that does not satisfy the security requirement for the IP address prefix is omitted from the routing table.

### Claim 14 (depends on 13)

The network device of claim 13, wherein the one or more processors are configured to execute the computer-readable to:
receive an instruction indicating that a certificate associated with the digital signature is revoked; and
update the routing table to exclude routes to the IP address prefix.

### Claim 15 (depends on 12)

The network device of claim 12, the digital signature is signed by an End Entity (EE) certificate of the route origin authorization.

### Claim 16 (depends on 15)

The network device of claim 15, the EE certificate is generated using a certificate authority certificate.

### Claim 17 (depends on 11)

The network device of claim 11, wherein the instructions further cause the processor to:
determine whether to the route network traffic to the IP address prefix:
receive network traffic to be relayed to the destination that corresponds to the IP address prefix; and
determine to route the network traffic based on the security requirement.

### Claim 18 (depends on 11)

The network device of claim 11, wherein the instructions further cause the processor to:
receive network traffic to be relayed to the destination; and
determine a route to the destination that best corresponds to the security requirement.

### Claim 19 (depends on 12)

The network device of claim 12, wherein the one or more processors are configured to execute the computer-readable to:
when the one or more network nodes satisfies the security requirement, advertise the route to the one or more network nodes that satisfies the security requirement.

### Claim 20

One or more non-transitory computer readable media comprising computer-readable instructions, which when executed by a one or more processors at a network node, cause the network node to:
receive an advertisement message for a network route including an IP address prefix;
receive a route origin authorization associated with the IP address prefix, the route origin authorization including a digital signature and security requirement of a route to a destination that corresponds to the IP address prefix;
determine whether one or more network nodes satisfies the security requirement to yield a determination; and
determine whether to route network traffic to the IP address prefix based on the determination.