Method and Apparatus for Differently Encrypting Different Flows

• US 20150379278A1
• Filed: 06/30/2014
• Published: 12/31/2015
• Est. Priority Date: 06/30/2014
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Thota, Kiran Kumar, Feroz, Azeem, Wiese, James C.
• Granted Patent: US 9,792,447 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

For a host that executes one or more guest virtual machines (GVMs), some embodiments provide a novel encryption method for encrypting the data messages sent by the GVMs. The method initially receives a data message to send for a GVM executing on the host. The method then determines whether it should encrypt the data message based on a set of one or more encryption rules. When the process determines that it should encrypt the received data message, it encrypts the data message and forwards the encrypted data message to its destination; otherwise, the method just forwards the received data message unencrypted to its destination. In some embodiments, the host encrypts differently the data messages for different GVMs that execute on the host. When two different GVMs are part of two different logical overlay networks that are implemented on common network fabric, the method in some embodiments encrypts the data messages exchanged between the GVMs of one logical network differently than the data messages exchanged between the GVMs of another logical network. In some embodiments, the method can also encrypt different types of data messages from the same GVM differently. Also, in some embodiments, the method can dynamically enforce encryption rules in response to dynamically detected events, such as malware infections.

Claims

1. For a computer that executes at least one virtual machines (VM), an encryption method comprising:

from the VM, receiving different data messages that are part of first and second data flows from the VM; and

encrypting the data messages in the first flow differently than the data messages in the second flow.

2. The method of claim 1, wherein differently encrypting the data messages in the first and second flows comprises encrypting the data messages in the first flow, while not encrypting the data messages in the second flow.

3. The method of claim 1, wherein differently encrypting the data messages in the first and second flows comprises encrypting the data messages in the first flow by using a first encryption process, while encrypting the data messages in the second flow by using a second encryption process.

4. The method of claim 1, wherein differently encrypting the data messages in the first and second flows comprises encrypting the data messages in the first flow by using a first encryption key, while encrypting the data messages in the second flow by using a second encryption key.

5. The method of claim 1, wherein differently encrypting the data messages in the first and second flows comprises encrypting a first portion of each data message in the first flow, while encrypting a second portion of each data message in the second flow, wherein the first and second portions are different portions of their respective data messages.

6. The method of claim 1, where the first and second flows have different destinations.

7. The method of claim 1, where the first and second flows have the same destination.

8. The method of claim 7, where the same destination is another VM on another computer.

9. The method of claim 1 further comprising:

detecting start of a particular flow;

defining encryption rules for specifying how the data messages of the particular flow have to be encrypted;

providing the encryption rules to a set of encryptors that (i) intercepts data messages of the particular flow and other flows, (ii) determines whether to encrypt the data messages based on the encryption rules, (iii) encrypts the data messages upon determining to encrypt the data messages, and (iv) foregoes encrypting the data messages upon determining that no encryption is needed.

10. The method of claim 1 further comprising inserting in each encrypted data message an encryption identifier, said encryption identifier for allowing a destination of the data message to decrypt the encrypted data message.

11. The method of claim 10, wherein the encryption identifier is a key identifier that identifies an encryption key that was used to encrypt the data message.

12. The method of claim 10, wherein the encryption identifier is a key identifier that identifies decryption key that is needed to decrypt the data message.

13. The method of claim 10, wherein the encryption identifier is an encryption identifier that identifies an encryption process that was used to encrypt the data message.

14. The method of claim 10, wherein the encryption identifier is a decryption identifier that identifies decryption process that is needed to decrypt the data message.

15. The method of claim 10, wherein the encryption identifier is inserted in a header field of the data message.

16. A non-transitory machine readable medium storing a program for encrypting messages from a virtual machine (VM) that executes on a computer, the program comprising sets of instructions for:

from the VM, receiving different data messages that are part of first and second data flows from the VM; and

encrypting the data messages in the first flow differently than the data messages in the second flow.

17. The non-transitory machine readable medium of claim 16, wherein the set of instructions for differently encrypting the data messages in the first and second flows comprises a set of instructions for encrypting the data messages in the first flow, while not encrypting the data messages in the second flow.

18. The non-transitory machine readable medium of claim 16, wherein the set of instructions for differently encrypting the data messages in the first and second flows comprises a set of instructions for encrypting the data messages in the first flow by using a first encryption process, while encrypting the data messages in the second flow by using a second encryption process.

19. The non-transitory machine readable medium of claim 16, wherein the set of instructions for differently encrypting the data messages in the first and second flows comprises a set of instructions for encrypting the data messages in the first flow by using a first encryption key, while encrypting the data messages in the second flow by using a second encryption key.

20. The non-transitory machine readable medium of claim 16, wherein the set of instructions for differently encrypting the data messages in the first and second flows comprises a set of instructions for encrypting a first portion of each data message in the first flow, while encrypting a second portion of each data message in the second flow, wherein the first and second portions are different portions of their respective data messages.

31. The non-transitory machine readable medium of claim 16, wherein the set of instructions for differently encrypting data messages comprises sets of instructions for:

for each flow,

using a set of message attribute values to identify one encryption rule from a plurality of stored encryption rules, said identified encryption rule being an encryption rule that is defined for the flow;

retrieving an encryption parameter for an encryption process from the identified encryption rule; and

using the identified encryption parameter to encrypt the data messages of the flow.

21-30. -30. (canceled)