Zero-trust packet routing
OwnerW. Daniel Hillisinventor
Life of this patent
Estimating the term…
Abstract
Embodiments of the invention concern zero-trust packet routing. Zero-trust packet routing (ZPR) is a way of implementing policy-enforcing networks with tight integration into identity and device management systems. Unlike conventional networks, which route traffic based only on the information inside of the packets, ZPR networks forward every packet based on the authenticated identity of the users and services that communicate through those packets, and global policies that govern their communications.
Claims27
A method for moving IP-format packets though a network, comprising:
- encapsulating IP-format packets into a compressed form by replacing any of addresses, ports, protocols, and other header fields of the IP packet with a visa identifier;
- and
- binding each packet to the identity and permissions of a sender each time a node processes a packet;
- wherein a same visa identifier that determines what is done with the packet certifies that the identities of both a sender and receiver have been authenticated;
- wherein said same visa identifier certifies that a policy allows the packet to be sent by the sender to the receiver under certain specific conditions;
- wherein all said information is derived from said same visa identifier;
- and
- wherein certification is inseparably bound to a destination and to said specific conditions.
A method for moving IP-format packets though a network, comprising:
- encapsulating IP-format packets into a compressed form by replacing any of addresses, ports, protocols, and other header fields of the IP packet with a visa identifier:
- tracking a number and size of messages that have been transmitted in each class of traffic;
- and
- reserving bandwidth for a specific use by defining a special class of traffic that has a higher priority than other traffic;
- wherein said visa identifier grants permission to send a specific amount of said high-priority by-reservation-only traffic within a specified time interval;
- based on said visa identifier, a visa service reserving bandwidth in different classes for specific purposes;
- wherein availability of said reserved bandwidth is guaranteed when a total bandwidth that can be reserved is not allowed to be greater than the amount of high-priority traffic that can be carried;
- and
- wherein said traffic classes are allowed to use additional unreserved bandwidth when it is available.
A method for moving IP-format packets though a network, comprising:
- encapsulating IP-format packets into a compressed form by replacing any of addresses, ports, protocols, and other header fields of the IP packet with a visa identifier;
- tracking a number and size of messages that have been transmitted;
- implementing limits on an amount of information that can be transmitted under a particular permission;
- and
- based on said visa identifier, a visa service using reserving bandwidth based on permission;
- wherein additional bandwidth is not made available once a reserved bandwidth is exhausted.
In a network consisting of a set of communicating nodes and internal services, including a visa service and an administrative service, a method comprising:
- encapsulating IP-format packets into a compressed form by replacing any of addresses, ports, protocols, and other header fields of the IP packet with a visa identifier providing one or more individual instances of said network;
- wherein each individual instance of said network comprises its own communication policies;
- and
- wherein every node of said network enforces said policies.
In a network consisting of a set of communicating nodes and internal services, including a visa service and an administrative service, a method comprising:
- defining an agent's identity as a collection of authenticated attributes, with values that are uniquely associated with said authenticated attribute within a network in which IP-format packets are encapsulated into a compressed form by replacing any of addresses, ports, protocols, and other header fields of the IP packet with a visa identifier;
- wherein said authenticated attribute comprises at least one immutable attribute of that which is being authenticated.
A method for transmitting a packet across a packet-switched communications network consisting of multiple nodes, comprising:
- transmitting packets from a first communicator to a first node of the network which is associated with a source address;
- transmitting packets from a second node of the network to a second communicator which is associated with a destination address;
- each node communicating bidirectionally with a visa service;
- the visa service determining communications policies of the network;
- the visa service determining when the transmission of a first packet is compliant with the policies of the network;
- wherein when a first packet is transmitted to the first node of the network, the first node communicates with the visa server information derived from the first packet to determine if the delivery of the first packet is compliant with the policies of the network;
- and
- wherein the first packet is delivered to the second node only if it is compliant with policies as determined by the visa service.
Dependencies are inferred from the claim text.