Apparatus to automatically establish or modify mutual authentications amongst the components in a software defined networking (SDN) solution

Patent metadata

Field	Value
Publication number	US-11265316-B2
Application number	US-202016998371-A
Country	US
Kind code	B2
Filing date	Aug 20, 2020
Priority date	Sep 11, 2019
Publication date	Mar 1, 2022
Grant date	Mar 1, 2022

Abstract

The disclosure provides an approach for establishing authentication between components in a network. Embodiments deploying a node of a monitoring appliance in response to a request and providing a token for accessing a network manager to the node of the monitoring appliance. Embodiments include generating, by the node of the monitoring appliance, a certificate of the node of the monitoring appliance and providing the certificate of the node of the monitoring appliance to the network manager with the token for accessing the network manager. Embodiments include adding, by the network manager, based on the token for accessing the network manager, the certificate of the node of the monitoring appliance to a first trust store and providing, by the network manager, a network manager certificate to the node of the monitoring appliance. Embodiments include adding, by the node of the monitoring appliance, the network manager certificate to a second trust store.

First claim

We claim:

1. A method of establishing mutual authentication between components in a network, comprising:
receiving, by a virtualization manager, a request to deploy a node of a monitoring appliance, wherein the request comprises a token for accessing a network manager;
deploying, by the virtualization manager, the node of the monitoring appliance in response to the request;
providing, by the virtualization manager, the token for accessing the network manager to the node of the monitoring appliance;
generating, by the node of the monitoring appliance, a certificate of the node of the monitoring appliance;
providing, by the node of the monitoring appliance, the certificate of the node of the monitoring appliance to the network manager with the token for accessing the network manager;
adding, by the network manager, based on the token for accessing the network manager, the certificate of the node of the monitoring appliance to a first trust store;
providing, by the network manager, a network manager certificate to the node of the monitoring appliance; and
adding, by the node of the monitoring appliance, the network manager certificate to a second trust store.

2. The method of claim 1 , wherein providing, by the node of the monitoring appliance, the certificate of the node of the monitoring appliance to the network manager with the token for accessing the network manager comprises providing, by a messaging broker located in the node of the monitoring appliance, the certificate of the node of the monitoring appliance and the token for accessing the network manager to an agent of the monitoring appliance located in the network manager.

3. The method of claim 1 , further comprising:
providing, by the network manager, a host certificate of a given host machine to the node of the monitoring appliance;
adding, by the node of the monitoring appliance, the host certificate to the second trust store.

4. The method of claim 1 , further comprising:
providing, by an additional node of the monitoring appliance, a respective certificate of the additional node of the monitoring appliance to the network manager with the token for accessing the network manager;
adding, by the network manager, based on the token for accessing the network manager, the respective certificate of the additional node of the monitoring appliance to the first trust store;
providing, by the network manager, the respective certificate of the additional node of the monitoring appliance to the node of the monitoring appliance; and
adding, by the node of the monitoring appliance, the respective certificate of the additional node of the monitoring appliance to the second trust store.

5. The method of claim 4 , further comprising:
sending, by the network manager, an undeployment request for the node of the monitoring appliance to the virtualization manager;
removing, by the virtualization manager, the node of the monitoring appliance from the network;
removing, by the network manager, the certificate of the node of the monitoring appliance from the first trust store.

6. The method of claim 5 , further comprising:
sending, by the network manager, an identifier of the node of the monitoring appliance to the additional node of the monitoring appliance; and
removing, by the additional node of the monitoring appliance, the certificate of the node of the monitoring appliance from a third trust store.

7. The method of claim 1 , further comprising:
sending, by the network manager, an updated network manager certificate to the node of the monitoring appliance;
adding, by the node of the monitoring appliance, the updated network manager certificate to the second trust store; and
sending, by the node of the monitoring appliance, a notification to the network manager that the updated network manager certificate was successfully imported.

8. The method of claim 7 , further comprising:
removing, by the network manager, the network manager certificate;
providing, by the network manager, an identifier of the network manager certificate to the node of the monitoring appliance; and
removing, by the node of the monitoring appliance, the network manager certificate from the second trust store.

9. A non-transitory computer readable medium comprising instructions that, when executed by one or more processors of a computing system, cause the computing system to perform a method of establishing mutual authentication between components in a network, the method comprising:
receiving, by a virtualization manager, a request to deploy a node of a monitoring appliance, wherein the request comprises a token for accessing a network manager;
deploying, by the virtualization manager, the node of the monitoring appliance in response to the request;
providing, by the virtualization manager, the token for accessing the network manager to the node of the monitoring appliance;
generating, by the node of the monitoring appliance, a certificate of the node of the monitoring appliance;
providing, by the node of the monitoring appliance, the certificate of the node of the monitoring appliance to the network manager with the token for accessing the network manager;
adding, by the network manager, based on the token for accessing the network manager, the certificate of the node of the monitoring appliance to a first trust store;
providing, by the network manager, a network manager certificate to the node of the monitoring appliance; and
adding, by the node of the monitoring appliance, the network manager certificate to a second trust store.

10. The non-transitory computer readable medium of claim 9 , wherein providing, by the node of the monitoring appliance, the certificate of the node of the monitoring appliance to the network manager with the token for accessing the network manager comprises providing, by a messaging broker located in the node of the monitoring appliance, the certificate of the node of the monitoring appliance and the token for accessing the network manager to an agent of the monitoring appliance located in the network manager.

11. The non-transitory computer readable medium of claim 9 , wherein the method further comprises:
providing, by the network manager, a host certificate of a given host machine to the node of the monitoring appliance;
adding, by the node of the monitoring appliance, the host certificate to the second trust store.

12. The non-transitory computer readable medium of claim 9 , wherein the method further comprises:
providing, by an additional node of the monitoring appliance, a respective certificate of the additional node of the monitoring appliance to the network manager with the token for accessing the network manager;
adding, by the network manager, based on the token for accessing the network manager, the respective certificate of the additional node of the monitoring appliance to the first trust store;
providing, by the network manager, the respective certificate of the additional node of the monitoring appliance to the node of the monitoring appliance; and
adding, by the node of the monitoring appliance, the respective certificate of the additional node of the monitoring appliance to the second trust store.

13. The non-transitory computer readable medium of claim 12 , wherein the method further comprises:
sending, by the network manager, an undeployment request for the node of the monitoring appliance to the virtualization manager;
removing, by the virtualization manager, the node of the monitoring appliance from the network;
removing, by the network manager, the certificate of the node of the monitoring appliance from the first trust store.

Assignees

• Vmware Inc

Inventors

• Wen Ming
• Palencia Edilmo
• Lu Russell
• Gunda Laxmikant Vithal
• Petrus Margaret

Classifications

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/0869 Primary

  for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273) · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title