Secure data transfer in a virtual environment

• US 20120016977A1
• Filed: 07/15/2010
• Published: 01/19/2012
• Est. Priority Date: 07/15/2010
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Li, Qingqing, Robertson, Matthew, Hebbani Raghavendra, Rao Sandeep
• Granted Patent: US 8,856,317 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/148 Migration or transfer of sessions

Abstract

In one embodiment, a method includes receiving at one of a plurality of servers, a request from a client for a secure communication session, storing context information associated with the secure communication session at a virtual context server in communication with the servers, and establishing the secure communication session between one of the servers and the client. The context information includes a session identifier, a secret, and a session state. The stored context information is available to the servers to allow the secure communication session to move between the servers. An apparatus for secure data transfer in a virtual environment is also disclosed.

Claims

1. A method comprising:

receiving at one of a plurality of servers, a request from a client for a secure communication session;

storing context information associated with said secure communication session at a virtual context server in communication with said plurality of servers, said context information comprising a session identifier, a secret, and a session state; and

establishing said secure communication session between one of said plurality of servers and the client;

wherein said stored context information is available to said plurality of servers to allow said secure communication session to move between said plurality of servers.

2. The method of claim 1 further comprising moving said secure communication session with said client from one of said plurality of servers to another of said plurality of servers.

3. The method of claim 1 wherein said plurality of servers comprises physical servers located within a cloud network.

4. The method of claim 1 wherein said plurality of servers comprises virtual machines located at one or more of the servers and configured to move between the servers.

5. The method of claim 1 wherein said plurality of servers comprises one or more logical groups of physical servers.

6. The method of claim 1 wherein at least one of said plurality of servers comprises a monitoring device for monitoring traffic over said secure communication session.

7. The method of claim 1 wherein the virtual context server comprises a session context server and a redundant context store.

8. The method of claim 1 wherein said secure communication session comprises a Secure Socket Layer (SSL) or Transport Layer Security (TLS) session.

9. The method of claim 1 wherein said plurality of servers belong to a trusted group configured to have access to said secure communication session.

10. An apparatus comprising:

a processor for receiving at one of a plurality of servers, a request from a client for a secure communication session, sharing context information associated with said secure communication session with a virtual context server in communication with said plurality of servers, said context information comprising a session identifier, a secret, and a session state, and establishing said secure communication session with the client; and

memory for at least temporarily storing said context information;

wherein the virtual context server shares said context information with said plurality of servers to allow said secure communication session to move between said plurality of servers.

11. The apparatus of claim 10 wherein said plurality of servers comprises physical servers located within a cloud network.

12. The apparatus of claim 10 wherein said plurality of servers comprises virtual machines located at one or more of the servers and configured to move between the servers.

13. The apparatus of claim 10 wherein said plurality of servers comprises one or more logical groups of physical servers.

14. The apparatus of claim 10 wherein at least one of said plurality of servers comprises a monitoring device for monitoring traffic over said server communication session.

15. The apparatus of claim 10 wherein the virtual context server comprises a session context server and a redundant context store.

16. The apparatus of claim 10 wherein the processor is further configured to communicate said context information over a secure data plane containing said plurality of servers.

17. Logic encoded in one or more tangible media for execution and when executed operable to:

receive at one of a plurality of servers, a request from a client for a secure communication session;

store context information associated with said secure communication session at a virtual context server in communication with said plurality of servers, said context information comprising a session identifier, a secret, and a session state; and

establish said secure communication session with the client;

wherein said stored context information is available to said plurality of servers to allow said secure communication session to move between said plurality of servers.

18. The logic of claim 17 wherein the logic is operable to:

identify a virtual machine;

obtain new context information; and

continue an existing secure communication session between said virtual machine and another client.

19. The logic of claim 17 wherein said plurality of servers comprises physical servers located within a cloud network.

20. The logic of claim 17 wherein said plurality of servers comprises virtual machines located at one or more of the servers and configured to move between the servers.