INFRASTRUCTURE LEVEL LAN SECURITY

• US 20140226820A1
• Filed: 02/12/2013
• Published: 08/14/2014
• Est. Priority Date: 02/12/2013
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: CHOPRA, Amit, MASUREKAR, Uday
• Granted Patent: US 9,930,066 B2
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0457 wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics

Abstract

Techniques are disclosed for securing traffic flowing across multi-tenant virtualized infrastructures using group key-based encryption. In one embodiment, an encryption module of a virtual machine (VM) host intercepts layer 2 (L2) frames sent via a virtual NIC (vNIC). The encryption module determines whether the vNIC is connected to a “secure wire,” and invokes an API exposed by a key management module to encrypt the frames using a group key associated with the secure wire, if any. Encryption may be performed for all frames from the vNIC, or according to a policy. In one embodiment, the encryption module may be located at a layer farthest from the vNIC, and encryption may be transparent to both the VM and a virtual switch. Unauthorized network entities which lack the group key cannot decipher the data of encrypted frames, even if they gain access to such frames.

Claims

1. A method for securing traffic in a multi-tenant virtualized infrastructure, comprising:

intercepting a Layer 2 (L2) frame sent via a first virtual network interface card (vNIC) in route to a first physical network interface card (pNIC);

determining a first secure wire to which the first vNIC is connected, wherein the first secure wire is enabled on a first L2 domain;

encrypting payload data of the L2 frame using a first encryption key associated with the first secure wire.

2. The method of claim 1, wherein the intercepting and determining are performed by an encryption module of a virtual machine (VM) host on which one or more virtual machines (VMs) run, wherein the encryption module is at a farthest layer from the first vNIC, and wherein the encrypting is performed by a key management module of the VM host, the key management module exposing an application programming interface (API) which the encryption module invokes for the encrypting.

3. The method of claim 2, wherein the intercepting, determining, and encrypting do not require configuration changes to operating systems of the VMs.

4. The method of claim 2, wherein the VMs and applications and processes running in the VMs are unaware of the existence of the secure wire.

5. The method of claim 2, further comprising, fetching, by the key management module, the first encryption key, wherein the first encryption key is securely transmitted from a management server.

6. The method of claim 1, further comprising:

receiving, via a second pNIC, the transmitted encrypted frame;

intercepting the encrypted frame as the encrypted frame is in transit to a second vNIC from the second pNIC;

decrypting payload data of the encrypted frame using the first encryption key.

7. The method of claim 6, wherein the frame is encrypted according to IEEE MAC Security Standard (MACSec) frame format.

8. The method of claim 6, further comprising, adding to the L2 frame a value which indicates an EtherType, a value which identifies the first encryption key, an encoded encryption initialization vector value, or a signed hash value used to authenticate the encrypted frame and ensure data integrity of the encrypted frame.

9. The method of claim 1, wherein the encrypting is performed based on a policy, the policy specifying which traffic out of the first vNIC to encrypt.

10. The method of claim 1, wherein the secure wire is enabled on a virtual extensible LAN (VXLAN).

16. The computer-readable storage medium of claim 10, the operations further comprising:

receiving, via a second pNIC, the transmitted encrypted frame;

intercepting the encrypted frame as the encrypted frame is in transit to a second vNIC from the second pNIC;

decrypting payload data of the encrypted frame using the first encryption key.

17. The computer-readable storage medium of claim 16, wherein the frame is encrypted according to IEEE MAC Security Standard (MACSec) frame format.

18. The computer-readable storage medium of claim 16, the operations further comprising, adding to the L2 frame a value which indicates an EtherType, a value which identifies the first encryption key, an encoded encryption initialization vector value, or a signed hash value used to authenticate the encrypted frame and ensure data integrity of the encrypted frame.

11. A non-transitory computer-readable storage medium embodying computer program instructions for reducing perceived read latency, the computer program instructions implementing operations for securing traffic in a multi-tenant virtualized infrastructure, the operations comprising:

intercepting, by an encryption module of a first virtual machine (VM) host, an L2 frame sent via a first virtual network interface card (vNIC) as the L2 frame is en route to a first physical network interface card (pNIC);

determining a first secure wire to which the first vNIC is connected, wherein the first secure wire is enabled on a first L2 domain;

modifying, by the encryption module, the L2 frame to generate an encrypted frame, wherein the modifying includes encrypting payload data of the L2 frame using a first encryption key shared by vNICs connected to the first secure wire; and

transmitting the encrypted frame over a network, wherein the transmitting is performed via the first pNIC.

12. The computer-readable storage medium of claim 11, wherein the intercepting and determining are performed by an encryption module of a virtual machine (VM) host on which one or more virtual machines (VMs) run, wherein the encryption module is at a farthest layer from the first vNIC, and wherein the encrypting is performed by a key management module of the VM host, the key management module exposing an application programming interface (API) which the encryption module invokes for the encrypting.

13. The computer-readable storage medium of claim 12, wherein the intercepting, determining, and encrypting do not require configuration changes to operating systems of the VMs.

14. The computer-readable storage medium of claim 12, wherein the VMs and applications and processes running in the VMs are unaware of the existence of the secure wire.

15. The computer-readable storage medium of claim 12, the operations further comprising, fetching, by a key management module of the VM host, the first encryption key, wherein the first encryption key is securely transmitted from a management server.

19. The computer-readable storage medium of claim 11, wherein the encrypting is performed based on a policy, the policy specifying which traffic out of the first vNIC to encrypt.

20. The computer-readable storage medium of claim 11, wherein the secure wire is enabled on a virtual extensible LAN (VXLAN).

21. A system, comprising:

a processor; and

a memory, wherein the memory includes a program for reducing perceived read latency, the program being configured to perform operations for securing traffic in a multi-tenant virtualized infrastructure comprising;

Without making any changes to existing VM and applications running inside VM, intercepting a Layer 2 (L2) frame sent via a first virtual network interface card (vNIC) in route to a first physical network interface card (pNIC);

determining a first secure wire to which the first vNIC is connected, wherein the first secure wire is enabled on a first L2 domain;

encrypting payload data of the L2 frame using a first encryption key associated with the first secure wire.