Lightweight secure autonomic control plane

Patent metadata

Field	Value
Publication number	US-10819685-B2
Application number	US-201815910947-A
Country	US
Kind code	B2
Filing date	Mar 2, 2018
Priority date	Mar 2, 2018
Publication date	Oct 27, 2020
Grant date	Oct 27, 2020

Abstract

A network device includes a transmitter and a receiver to establish a secure connection with one or more network nodes as part of a Autonomic Control Plane (ACP) network. The network device also includes a processor coupled to the transmitter and receiver. The processor receives a request from an application to initiate a connection with a destination network node. The processor also receives packets from the application for transmission toward the destination network node. When the packets from the application are unencrypted, the processor end-to-end encrypts the unencrypted packets without notifying the application. The transmitter then transmits the encrypted packets towards the destination network node across the ACP network.

First claim

What is claimed is:

1. A network device comprising:
a transmitter and a receiver configured to establish a secure connection with one or more network nodes as part of an Autonomic Control Plane (ACP) network; and
a processor coupled to the transmitter and the receiver, the processor configured to:
receive a request from an application to initiate a connection with a destination network node;
receive application data-packets from the application for transmission toward the destination network node;
determine that the application data-packets are unencrypted;
end-to-end encrypt the application data-packets to generate encrypted application data-packets without notifying the application in response to determining that the application data-packets are unencrypted;
receive routing protocol data-packets;
determine that the routing protocol data-packets are unencrypted;
end-to-end encrypt the routing protocol data-packets to generate encrypted routing protocol data-packets in response to determining that the routing protocol data-packets are unencrypted; and
cause the transmitter to transmit the encrypted application data-packets and the encrypted routing protocol data-packets across the ACP network.

2. The network device of claim 1 , wherein the processor is further configured to perform no additional encryption when the packets from the application are encrypted by the application.

3. The network device of claim 1 , wherein the application data-packets are encrypted by the processor according to a Transport layer security (TLS) protocol, a datagram transport layer security protocol (dTLS), or combinations thereof.

4. The network device of claim 1 , wherein establishing the secure connection with the one or more network nodes includes:
transmitting encryption discovery unsolicited link local (NULL) Generic Autonomic Signaling Protocol (GRASP) discovery messages to the network nodes;
establishing a secure Transport layer security (TLS) connection for authentication; and
unblocking ports corresponding to authenticated network nodes.

5. The network device of claim 1 , wherein establishing the secure connection with the one or more network nodes further includes establishing multicast link-local communication connections with adjacent network nodes.

6. The network device of claim 1 , wherein the processor is further configured to determine that the destination network node is reachable via the ACP network prior to initiating a connection with the destination network node by employing an ACP routing table.

7. The network device of claim 6 , wherein the ACP routing table is populated by receiving Virtual Routing and Forwarding (VRF) addresses of network nodes in the ACP network as flooded by an ACP routing protocol.

8. The network device of claim 1 , wherein the processor is further configured to determine that the destination network node is reachable via the ACP network prior to initiating a connection with the destination network node by employing an address mapping service to determine an ACP Virtual Routing and Forwarding (VRF) address for the destination network node.

9. The network device of claim 8 , wherein the address mapping service:
employs the transmitter to flood a ACP Generic Autonomic Signaling Protocol (GRASP) discovery message across the ACP network; and
employs the receiver to receive the VRF for the destination network node in GRASP respond message in response to the GRASP discovery message.

10. The network device of claim 1 , wherein transmitting the encrypted application data-packets and the encrypted routing protocol data-packets across the ACP network includes:
tagging the encrypted application data-packets and the encrypted routing protocol data-packets to indicate membership in the ACP network; and
blocking all packets except for tagged encrypted application data-packets and tagged encrypted routing protocol data-packets.

11. The network device of claim 1 , wherein transmitting the encrypted packets towards the destination network node across the ACP network includes multicasting the encrypted packets by:
creating a plurality of secure end-to-end connections with a plurality of adjacent network nodes; and
unicasting the encrypted packets over the secure end-to-end connections.

12. The network device of claim 1 , wherein the processor is further configured to protect the secure connection against man-in-the-middle attacks by:
exchanging interface sent/received packet/byte counters and corresponding timestamps with adjacent network nodes in the ACP network; and
determining an intruder when a difference in a sent packet counter and a received packet counter over a specified time period exceeds an error threshold.

13. A method, implemented in a network device, the method comprising:
establishing, via a transmitter and a receiver, a secure connection with one or more network nodes as part of an Autonomic Control Plane (ACP) network;
receiving, at a processor, a request from an application to initiate a connection with a destination network node;
receiving, at the processor, application data-packets from the application for transmission toward the destination network node;
determining, using the processor, that the application data-packets are unencrypted;
end-to-end encrypting the application data-packets, using the processor, to generate encrypted application data-packets without notifying the application in response to determining that the application data-packets are unencrypted;
receiving, at the processor, routing protocol data-packets;
determining, using the processor, that the routing protocol data-packets are unencrypted;
end-to-end encrypting the routing protocol data-packets, using the processor, to generate encrypted routing protocol data-packets in response to determining that the routing protocol data-packets are unencrypted; and
transmitting, at the transmitter, the application data-packets and the encrypted routing protocol data-packets across the ACP network.

14. The method of claim 13 , wherein the unencrypted packets are link local multicast packets for a ACP routing protocol, and wherein end-to-end encrypting the unencrypted packets includes:
converting the unencrypted packets to a list of unicast packets; and
encrypting the unicast packets according to a datagram transport layer security (dTLS) protocol; and
transmitting the encrypted unicast packets as link-local unicast to neighboring network nodes.

15. The method of claim 13 , wherein establishing the secure connection with the one or more network nodes includes authenticating adjacent network nodes in the ACP network according to an encryption discovery unsolicited link local (NULL) Generic Autonomic Signaling Protocol (GRASP) protocol.

16. The method of claim 13 , further comprising protecting the secure connection against man-in-the-middle attacks by:
exchanging packet counters and corresponding timestamps with adjacent network nodes in the ACP network; and
determining an intruder when a difference in a sent packet counter and a received packet counter over a specified time period exceeds an error threshold calculated based on accuracy tolerance.

17. A non-transitory computer readable medium comprising a computer program product for use by a network device, the computer program product comprising computer executable instructions stored on the non-transitory computer readable medium such that when executed by a processor cause the network device to:
establish a secure connection with one or more network nodes as part of an Autonomic Control Pla

Assignees

• Futurewei Technologies Inc

Inventors

• Eckert Toerless
• Jiang Sheng
• Liu Bing

Classifications

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/0471 Primary

  applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title