Method and apparatus for avoiding unwanted data packets

An apparatus in a router of a packet-switched network, for controlling transmission of data packets in the network, the apparatus comprising:

• an ingress unit that receives a data packet comprising an ingress tag derived from a sender key or router key using a first tag derivation function TDF known by the router, wherein the sender key or the router key have been encoded by the first TDF to conceal the sender key or the router key from a third party that does not know the first TDF;
• a tag matching unit that executes a matching operation to the received ingress tag and at least one entry in a forwarding table, said entry comprising an ingress key and a corresponding outgoing port number, using said first TDF to decode the ingress key in the said entry in the forwarding table to determine whether the received ingress tag matches the decoded ingress key in said entry;
• and
• an egress unit that sends the data packet to a next hop node, wherein in response to finding a matching entry in the forwarding table, the data packet is sent from an outgoing port indicated in the matching entry in the forwarding table, and in response to not finding a matching entry in the forwarding table the data packet is discarded.

A method of controlling transmission of data packets in a packet-switched network, comprising the following steps performed by a Domain Name Server (DNS) system:

• registering destination keys for end-hosts in the network;
• distributing router keys to routers in the network, each router key being derived from a registered destination key representing an end-host and/or from network topology information;
• receiving an address query from a first end-host regarding a second end-host;
• creating a sender key by applying a key derivation function KDF to at least a destination key associated with the second end-host, wherein the created sender key conceals the destination key associated with the second end-host;
• and
• sending the created sender key to the first end-host in response to said address query, thereby enabling the first end-host to get across data packets to the second end-host by attaching a sender tag generated from said sender key to a transmitted data packet, the sender tag directing said transmitted data packet to the second end-host.

An apparatus in a Domain Name Server (DNS) server system for controlling transmission of data packets in a packet-switched network, comprising:

• a host database for registering destination keys associated with end-hosts;
• a router key manager that distributes router keys to routers in the network, each router key being derived from a destination key representing an end-host and/or from network topology information;
• and
• an address query manager that receives an address query from a first end-host regarding a second end-host, create a sender key by applying a key derivation function to at least a destination key associated with the second end-host, wherein the created sender key conceals the destination key associated with the second end-host, and to send the created sender key to the first end-host in response to the address query, thereby enabling the first end-host to get across data packets to the second end-host by attaching a sender tag generated from said sender key to a transmitted data packet, the sender tag directing said transmitted data packet to the second end-host.

A method of enabling control of transmission of data packets in a packet-switched network, comprising the following steps performed by an end-host equipment used by a first end-host:

• sending an address query for a second end-host to a Domain Name Server (DNS) system;
• receiving a sender key from the DNS system in response to said address query, the sender key being derived from a destination key associated with the second end-host by applying a key derivation function KDF to at least said destination key of the second end-host, wherein the sender key conceals the destination key associated with the second end-host;
• creating a sender tag by applying a tag derivation function TDF to at least the received sender key;
• attaching the created sender tag to data packets directed to the second end-host;
• and
• sending said data packets to a first-hop router.

An apparatus in an end-host equipment for use by a first end-host and for enabling control of transmission of data packets in a packet-switched network, the apparatus comprising:

• an address query unit that sends an address query for a second end-host to a Domain Name Server (DNS) system, and to receive a sender key from the DNS system derived from a destination key of the second end-host, in response to said query, wherein the sender key conceals the destination key associated with the second end-host;
• a tag creating unit that creates a sender tag by applying a tag derivation function TDF to at least the received sender key;
• and
• a packet sending unit that attaches the sender tag to data packets and then sending the data packets to a first-hop router.