US 12,244,493 B2
Securing multiprotocol label switching (MPLS) payloads
Tarek Saad, Greely (CA); Manish Talwar, Lunenburg, MA (US); Raveendra Torvi, Mountain House, CA (US); Ajay Kachrani, Nashua, NH (US); and Kireeti Kompella, Los Altos, CA (US)
Assigned to Juniper Networks, Inc., Sunnyvale, CA (US)
Filed by Juniper Networks, Inc., Sunnyvale, CA (US)
Filed on Dec. 7, 2023, as Appl. No. 18/531,947.
Application 18/531,947 is a continuation of application No. 17/663,319, filed on May 13, 2022, granted, now 11,882,029.
Prior Publication US 2024/0106744 A1, Mar. 28, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 45/50 (2022.01); H04L 9/40 (2022.01); H04L 45/00 (2022.01); H04L 69/22 (2022.01)
CPC H04L 45/50 (2013.01) [H04L 45/66 (2013.01); H04L 63/0464 (2013.01); H04L 63/061 (2013.01); H04L 69/22 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method, comprising:
exchanging, by an egress network device of a multiprotocol label switching (MPLS) network, Internet key exchange (IKE) messages with an ingress network device of the MPLS network to establish a security association between the egress network device and the ingress network device;
receiving, by the egress network device, an MPLS packet that includes an MPLS header, a secure MPLS data header, and an MPLS payload;
processing, by the egress network device, the MPLS packet to determine a first label associated with a label-switched path (LSP) and to identify a secure function indicator;
determining, by the egress network device and based on the secure function indicator, whether or not to decrypt the MPLS payload; and
selectively performing:
decrypting, by the egress network device, based on the determination to decrypt, and based on using a secure function identified based on the secure MPLS data header, the MPLS payload to generate a decrypted packet, and performing one or more actions based on the decrypted packet, or
generating, by the egress network device and based on the determination not to decrypt, a second label, and updating the MPLS header to include the second label and not the first label,
wherein the MPLS packet is forwarded based on the second label.