Securely managing and diagnosing network middleboxes

Patent metadata

Field	Value
Publication number	US-10608959-B2
Application number	US-201715701396-A
Country	US
Kind code	B2
Filing date	Sep 11, 2017
Priority date	Sep 11, 2017
Publication date	Mar 31, 2020
Grant date	Mar 31, 2020

Abstract

The disclosure provides an approach for managing and diagnosing middleboxes in a cloud computing system. In one embodiment, a network operations center, that is located remote to a virtualized cloud computing system and communicates with the cloud computing system via a wide area network, controls network middleboxes in the cloud computing system through a secure routing module inside a gateway of the cloud computing system. The secure routing module is configured to receive, from an authenticated management application and via a secure communication channel, packets intended for managing network middleboxes. In turn, the secure routing module establishes secure communication channels with the target middleboxes, translates the identified packets to protocols and/or application programming interfaces (APIs) of the target middleboxes, and transmits the translated packets to the target middleboxes.

First claim

We claim:

1. A computer-implemented method of managing a network middlebox in a computing system, comprising:
receiving a network packet from a management application via a first secure communication channel established with the management application; and
responsive to determining the received packet includes a request for managing the network middlebox:
translating the received packet to at least one of a protocol or an application programming interface (API) associated with the network middlebox,
determining that the management application has been authenticated to communicate with the network middlebox prior to transmitting the translated packet, and
transmitting the translated packet to the network middlebox via a second secure communication channel established with the network middlebox.

2. The method of claim 1 , wherein:
the determining, translating, and transmitting steps are performed by a gateway in the computing system; and
the gateway authenticates the management application.

3. The method of claim 2 , wherein:
a single port is opened in the network middlebox; and
the single port is configured to only allow packets from the gateway.

4. The method of claim 2 , wherein a single port is opened in the gateway for communicating with the management application over a wide area network (WAN).

5. The method of claim 2 , wherein the gateway is a virtual appliance.

6. The method of claim 1 , further comprising, determining the request for managing the network middlebox is permitted to be transmitted to the network middlebox.

7. The method claim 1 , wherein the received packet is transmitted from the management application, located remote to the computing system, over a wide area network (WAN).

8. The method of claim 1 , wherein the translated packet is transmitted to the network middlebox via a data network through which packets that do not include requests for managing network middleboxes are also transmitted.

9. The method of claim 1 , wherein the request specifies at least one of a configuration change for the network middlebox or diagnostic information to collect from the network middlebox.

10. A non-transitory computer-readable storage medium comprising instructions, which when executed by a computer system, causes the computer system to carry out operations for managing a network middlebox, comprising:
receiving a network packet from a management application via a first secure communication channel established with the management application; and
responsive to determining, by a virtual gateway appliance that authenticates the management application, the received packet includes a request for managing the network middlebox:
translating, by the virtual gateway appliance, the received packet to at least one of a protocol or an application programming interface (API) associated with the network middlebox, and
transmitting, by the virtual gateway appliance, the translated packet to the network middlebox via a second secure communication cannel established with the network middlebox, wherein:
a single port is opened in the network middlebox; and
the single port opened in the network middlebox is configured to only allow packets from the gateway appliance.

11. The computer-readable storage medium of claim 10 , wherein a single port is opened in the gateway appliance for communicating with the management application over a wide area network (WAN).

12. The computer-readable storage medium of claim 10 , the operations further comprising, determining that the management application has been authenticated to communicate with the network middlebox, prior to translating the received packet and transmitting the translated packet.

13. The computer-readable storage medium of claim 10 , the operations further comprising, determining the request for managing the network middlebox is permitted to be transmitted to the network middlebox.

14. The computer-readable storage medium of claim 10 , wherein the translated packet is transmitted to the network middlebox via a data network through which packets that do not include requests for managing network middleboxes are also transmitted.

15. The computer-readable storage medium of claim 10 , wherein the request specifies at least one of a configuration change for the network middlebox or diagnostic information to collect from the network middlebox.

16. A computer-implemented method of managing a network middlebox in a computing system, comprising:
receiving a network packet from a management application via a first secure communication channel established with the management application; and
responsive to determining the received packet includes a request for managing the network middlebox:
translating the received packet to at least one of a protocol or an application programming interface (API) associated with the network middlebox, and
transmitting the translated packet to the network middlebox via a second secure communication channel established with the network middlebox, wherein the translated packet is transmitted to the network middlebox via a data network through which packets that do not include requests for managing network middleboxes are also transmitted.

Assignees

• Vmware Inc

Inventors

• Cui Leon
• Ekbote Siddharth
• Sabin Todd
• Wu Weiqing
• Masurekar Uday

Classifications

• G06F11/0766

  Error or fault reporting or storing · CPC title

• H04L63/0263

  Rule management · CPC title

• G06F21/82

  Protecting input, output or interconnection devices · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title