Supporting unknown unicast traffic using policy-based encryption virtualized networks

Patent metadata

Field	Value
Publication number	US-11316837-B2
Application number	US-201916661967-A
Country	US
Kind code	B2
Filing date	Oct 23, 2019
Priority date	Jul 19, 2017
Publication date	Apr 26, 2022
Grant date	Apr 26, 2022

Abstract

Certain embodiments described herein are generally directed to enabling a group of host machines within a network to securely communicate an unknown unicast packet. In some embodiments, a key policy is defined exclusively for the secure communication of unknown unicast packets. The key policy is transmitted by a central controller to the group of host machines for negotiating session keys among each other when communicating unknown unicast packets.

First claim

We claim:

1. A method for use by a first host machine for securely communicating packets, the method comprising:
storing, at the first host machine, a shared key policy comprising a master key or information for use in generating the master key, wherein the master key is exclusively for communication of certain one or more types of packets with a group of host machines within a network, wherein one or more destination media access control (MAC) addresses of the certain one or more types of packets are not included in a forwarding table of a virtual switch on the first host machine, and wherein the shared key policy is shared by the first host machine and the group of host machines;
receiving, at the virtual switch, a packet of the certain one or more types of packets on a logical overlay layer 2 network, wherein a destination MAC address of the packet is not included in the forwarding table of the virtual switch;
negotiating one or more session keys with a plurality of host machines in the group of host machines using the shared key policy;
replicating the packet to produce a plurality of packets;
encrypting the plurality of packets using the one or more session keys; and
transmitting the encrypted plurality of packets to the plurality of host machines.

2. The method of claim 1 , wherein the first host machine receives the packet from a source virtual machine on the first host machine.

3. The method of claim 1 , wherein the packet is an unknown unicast (UU) packet, and wherein:
the one or more session keys comprise a number of session keys, each of the number of session keys corresponding to a different one of the plurality of host machines; and
each of the plurality of packets is encrypted with a different session key from the number of session keys.

4. The method of claim 1 , wherein the one or more session keys are generated based on the master key.

5. The method of claim 1 , wherein the shared key policy includes a flag for use by the group of host machines to identify the shared key policy for exclusively communicating the certain one or more types of packets.

6. The method of claim 1 , wherein the shared key policy is transmitted by a central controller to all host machines in the group of host machines.

7. The method of claim 1 , wherein the shared key policy is generated automatically by a manager entity.

8. A non-transitory computer readable medium having instructions stored thereon that, when executed by a first computer system, cause the first computer system to perform a method comprising:
storing, at the first computer system, a shared key policy comprising a master key or information for use in generating the master key, wherein the master key is exclusively for communication of certain one or more types of packets with a group of computer systems within a network, wherein one or more destination media access control (MAC) addresses of the certain one or more types of packets are not included in a forwarding table of a virtual switch on the first computer system, and wherein the shared key policy is shared by the first computer system and the group of computer systems;
receiving, at the virtual switch, a packet of the certain one or more types of packets on a logical overlay layer 2 network, wherein a destination MAC address of the packet is not included in the forwarding table of the virtual switch;
negotiating one or more session keys with a plurality of computer systems in the group of computer systems using the shared key policy;
replicating the packet to produce a plurality of packets;
encrypting the plurality of packets using the one or more session keys; and
transmitting the encrypted plurality of packets to the plurality of computer systems.

9. The non-transitory computer readable medium of claim 8 , wherein the first computer system receives the packet from a source virtual machine on the first computer system.

10. The non-transitory computer readable medium of claim 8 , wherein the packet is an unknown unicast (UU) packet, and wherein:
the one or more session keys comprise a number of session keys, each of the number of session keys corresponding to a different one of the plurality of computer systems; and
each of the plurality of packets is encrypted with a different session key from the number of session keys.

11. The non-transitory computer readable medium of claim 8 , wherein the one or more session keys are generated based on the master key.

12. The non-transitory computer readable medium of claim 8 , wherein the shared key policy includes a flag for use by the group of computer systems to identify the shared key policy for exclusively communicating the certain one or more types of packets.

13. The non-transitory computer readable medium of claim 8 , wherein the shared key policy is transmitted by a central controller to all computer systems in the group of computer systems.

14. The non-transitory computer readable medium of claim 8 , wherein the shared key policy is generated automatically by a manager entity.

15. A first computer system, comprising:
a memory comprising executable instructions; and
a processor in data communication with the memory and configured to execute the instructions to cause the first computer system to perform a method comprising:
storing, at the first computer system, a shared key policy comprising a master key or information for use in generating the master key, wherein the master key is exclusively for communication of certain one or more types of packets with a group of computer systems within a network, wherein one or more destination media access control (MAC) addresses of the certain one or more types of packets are not included in a forwarding table of a virtual switch on the first computer system, and wherein the shared key policy is shared by the first computer system and the group of computer systems;
receiving, at the virtual switch, a packet of the certain one or more types of packets on a logical overlay layer 2 network, wherein a destination MAC address of the packet is not included in the forwarding table of the virtual switch;
negotiating one or more session keys with a plurality of computer systems in the group of computer systems using the shared key policy;
replicating the packet to produce a plurality of packets;
encrypting the plurality of packets using the one or more session keys; and
transmitting the encrypted plurality of packets to the plurality of computer systems.

16. The first computer system of claim 15 , wherein the first computer system receives the packet from a source virtual machine on the first computer system.

17. The first computer system of claim 15 , wherein the packet is an unknown unicast (UU) packet, and wherein:
the one or more session keys comprise a number of session keys, each of the number of session keys corresponding to a different one of the plurality of computer systems; and
each of the plurality of packets is encrypted with a different session key from the number of session keys.

18. The first computer system of claim 15 , wherein the one or more session keys are generated based on the master key.

19. The first computer system of claim 15 , wherein the shared key policy includes a flag for use by the group of computer systems to identify the shared key policy for exclusively communicating the certain one or more types of packets.

20. The first computer system of claim 15 , wherein the shared key policy is transmitted by a central controller to all computer systems in the group of

Assignees

• Nicira Inc

Inventors

• Pillai Sanal
• Qian Calvin
• Xu Gang
• Zan Bin
• Chandrashekhar Ganesan

Classifications

• H04L2101/622

  Layer-2 addresses, e.g. medium access control [MAC] addresses · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L12/4633

  Interconnection of networks using encapsulation techniques, e.g. tunneling · CPC title

• H04L12/4641

  Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title