Internet packet provenance to verify packet validity and control packet usage

A method comprising:

• receiving, at a tunnel, a packet including an indication of a source from which the packet originated, the packet being encrypted with a first layer of encryption;
• encrypting provenance data and the packet with a second layer of encryption that provides a multi-tiered encryption stack for the packet, the provenance data to accompany the packet encrypted with the first layer of encryption and including embedded provenance information to validate the source from which the packet originated and embedded usage policy information to control usage of the packet, the provenance data not being a header of the packet or trailer of the packet;
• and
• outputting, from the tunnel, the provenance data and the packet encrypted with the second layer of encryption.

An apparatus comprising:

• a memory;
• and
• at least one processor coupled to the memory and configured to:
• receive, at a tunnel, a packet including an indication of a source from which the packet originated, the packet being encrypted with a first layer of encryption;
• encrypt provenance data and the packet with a second layer of encryption that provides a multi-tiered encryption stack for the packet, the provenance data to accompany the packet encrypted with the first layer of encryption, the provenance data including embedded provenance information to validate the source from which the packet originated and an embedded usage policy information to control a usage of the packet, the provenance data not being a header of the packet or a trailer of the packet;
• and
• output, from the encryption tunnel, the provenance data and the packet encrypted with the second layer of encryption.

A method comprising:

• receiving, a destination, an encrypted packet that has been encrypted with a a multi-tiered encryption stack having first and second layers of encryption;
• decrypting the second layer of encryption packet to reveal provenance data and the packet encrypted with the first layer of encryption, the provenance data accompanying the packet encrypted with the first layer of encryption and including embedded provenance information to validate the source from which the packet originated and embedded usage policy information to control usage of the packet, the provenance data not being a header of the packet or trailer of the packet;
• decrypting the packet that is encrypted with a first layer of encryption based on the packet being validated using the information included in the provenance data;
• and
• outputting the decrypted packet upon being decrypted based on the packet being validated using the information included in the provenance data.

A network arrangement comprising:

• a plurality of endpoints communicably coupled together to form a network, one or more endpoints communicably coupled to the public Internet;
• and
• one or more endpoint proxies in communication with the plurality of endpoints, wherein Internet Protocol (IP) packets originating from endpoints on the network have embedded provenance data, outside of a header and a trailer of the packet, including information to validate a source from which each packet originated and embedded usage policy information to control usage of the packet, and
• at least one endpoint proxy to
• validate and authorize individual packets of the IP packets for traversing the network by comparing the information against endpoint cache policies and permissions, and
• prevent, block and/or quarantine packets from unknown sources on the public Internet from traversing the network upon determining that the packets do not have the provenance data cached at the proxy.