Efficient and secure hop-by-hop routing in hierarchical multi-region-fabric networks

A method, comprising:

• determining, by a device, a segment list corresponding to a segment route from a source device to a destination device via one or more authorized segment hop devices across a computer network;
• encrypting, by the device, the segment list into an encrypted segment list using a private key, wherein a public key corresponding to the private key is distributed only to authorized devices of the computer network;
• and
• causing, by the device, the encrypted segment list to be carried within packets forwarded from the source device to the destination device, wherein the packets are forwarded through the computer network with the encrypted segment list and an unencrypted header indicating a subsequent segment hop, and wherein only the one or more authorized segment hop devices are configured to decrypt the encrypted segment list to expose at least a next segment hop address and then forward the packets with the encrypted segment list and with the next segment hop address replacing the subsequent segment hop in the unencrypted header.

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the one or more network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process that is executable by the processor, the process comprising:
• receiving, as a device, a packet having an unencrypted header and an encrypted segment list, wherein the device is an authorized segment hop device and wherein a destination address within the unencrypted header matches an address of the device;
• decrypting, in response to the destination address within the unencrypted header matching the address of the device, the encrypted segment list to expose at least a next segment hop address in the encrypted segment list;
• replacing the destination address within the unencrypted header with the next segment hop address;
• and
• forwarding the packet toward the next segment hop address along with the encrypted segment list.