Methods and apparatus for secure routing of data packets

An arrangement in a name server configured to support forwarding of data packets in routers of a packet-switched network, the arrangement comprising:

• a receiving unit configured to receive a request from a sending end-node related to getting data packets across to a receiving end-node in a communication session;
• a determining unit configured to determine a transmission path with a series of hops from the sending end-node to the receiving end-node;
• a computing unit configured to compute a semi-dynamic parameter for each hop in the path based on a predefined router-associated key;
• and
• a providing unit configured to provide at least the computed semi-dynamic parameters to the sending end-node in response to the request, thereby enabling the sending end-node to compute a dynamic parameter for each hop in the path based on the semi-dynamic parameters and packet-specific information related to a data packet, and to send the data packet with a set of computed dynamic parameters and the packet-specific information over the packet-switched network through the transmission path.

A method in a sending end-node of supporting a forwarding operation in routers of a packet-switched network when sending data packets, the method comprising:

• sending a request to a name server related to getting data packets across to a receiving end-node in a communication session;
• receiving semi-dynamic parameters from the name server, each semi-dynamic parameter being associated with a hop in a transmission path from the sending end-node to the receiving end-node;
• generating packet-specific information related to a data packet to send;
• computing a dynamic parameter for each hop in the path based on the corresponding semi-dynamic parameter and the generated packet-specific information;
• and
• sending the data packet with the computed dynamic parameters and the packet-specific information over the packet-switched network through the transmission path, thereby enabling the routers to compute a dynamic for each available outgoing link or candidate hop in at least one router in the transmission path based on the packet-specific information in the packet, and to match the computed dynamic parameters with the dynamic parameters in the packet.

An arrangement in a sending end-node configured to support a forwarding operation in routers of a packet-switched network when sending data packets, the arrangement comprising:

• a first sending unit configured to send a request to a name server related to getting data packets across to a receiving end-node in a communication session;
• a receiving unit configured to receive semi-dynamic parameters from the name server, each semi-dynamic parameter being associated with a hop in a transmission path from the sending end-node to the receiving end-node;
• a generating unit configured to generate packet-specific information related to a data packet to send;
• a computing unit configured to compute a dynamic parameter for each hop in the path based on at least the corresponding semi-dynamic parameter and the generated packet-specific information;
• and
• a second sending unit adapted to send the data packet with the computed dynamic parameters and the packet-specific information over the packet-switched network through the transmission path, thereby enabling the routers to compute a dynamic parameter for each available outgoing link or candidate hop in at least one router in the transmission path based on the packet-specific information in the packet, and to match the computed dynamic parameters with the dynamic parameters in the packet.

A method in a router of a packet-switched network of performing a forwarding operation, the method comprising:

• receiving a data packet coming from a sending end-node in a communication session and comprising dynamic parameters, and packet-specific information related to the data packet, each dynamic parameter being associated with a hop in a transmission path from the sending end-node to a receiving end-node;
• computing or retrieving a semi-dynamic parameter for each available outgoing link or candidate hop in the router, based on a predefined router-associated key;
• computing a dynamic parameter for each outgoing link or candidate hop in the router based on the corresponding computed semi-dynamic parameter and the packet-specific information in the received packet;
• determining whether any of the computed dynamic parameters matches any of the dynamic parameters in the received packet;
• and
• forwarding the packet on an outgoing link or candidate hop corresponding to the matching computed dynamic parameter if a match is found and discarding the packet if a match is not found.

An arrangement in a router of a packet-switched network, configured to perform a forwarding operation, the arrangement comprising:

• a receiving unit configured to receive a data packet coming from a sending end-node in a communication session and comprising dynamic parameters and packet-specific information related to the data packet, each dynamic parameter being associated with a hop in a transmission path from the sending end-node to a receiving end-node;
• a computing unit configured to compute or retrieve a semi-dynamic parameter for each available outgoing link or candidate hop in the router, each semi-dynamic parameter being computed based on a predefined router-associated key, and to compute a dynamic parameter for each available outgoing link or candidate hop in the router based on the corresponding computed semi-dynamic parameter and the packet-specific information in the received packet;
• a determining unit configured to determine whether any of the computed dynamic parameters matches any of the dynamic parameters in the received packet;
• and
• a forwarding unit configured to forward the packet on an outgoing link or candidate hop corresponding to a matching computed dynamic parameter, or discard the packet if no matching computed dynamic parameter is found.

A method of supporting a forwarding operation in routers of a packet-switched network, the method comprising:

• a name server receiving a request from a sending end-node related to getting data packets across to a receiving end-node in a communication session;
• the name server determining a transmission path with a series of hops from the sending end-node to the receiving end-node;
• the name server computing a semi-dynamic parameter for each hop in the path based on a predefined router-associated key;
• the name server providing at least the computed semi-dynamic parameters to the sending end-node in response to the request;
• the sending end-node generating packet-specific information related to a data packet to send;
• the sending end-node computing a dynamic parameter for each hop in the path based on the corresponding semi-dynamic parameter and the generated packet-specific information;
• the sending end-node sending the data packet with the computed dynamic parameters and the packet-specific information over the packet-switched network through the transmission path;
• a router in the transmission path receiving the packet and computing or retrieving a semi-dynamic parameter for each available outgoing link or candidate hop in the router, each semi-dynamic parameter being computed based on at least the predefined router-associated key;
• the router computing a dynamic parameter for each available outgoing link or candidate hop in the router based on the corresponding computed semi-dynamic parameter and the packet-specific information in the received packet;
• and
• the router determining whether any of the computed dynamic parameters matches any of the dynamic parameters in the received packet, and if a match is found in the previous step, forwarding the packet on an outgoing link or candidate hop corresponding to the matching computed dynamic parameter, otherwise discarding the packet.