Method and Apparatus for Dynamically Creating Encryption Rules

• US 20150379280A1
• Filed: 06/30/2014
• Published: 12/31/2015
• Est. Priority Date: 06/30/2014
• Status: Active Application

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Thota, Kiran Kumar, Feroz, Azeem, Wiese, James C.
• Application Number:
  US14/320,581
• Publication Number:
  US 20150379280A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

For a host that executes one or more guest virtual machines (GVMs), some embodiments provide a novel encryption method for encrypting the data messages sent by the GVMs. The method initially receives a data message to send for a GVM executing on the host. The method then determines whether it should encrypt the data message based on a set of one or more encryption rules. When the process determines that it should encrypt the received data message, it encrypts the data message and forwards the encrypted data message to its destination; otherwise, the method just forwards the received data message unencrypted to its destination. In some embodiments, the host encrypts differently the data messages for different GVMs that execute on the host. When two different GVMs are part of two different logical overlay networks that are implemented on common network fabric, the method in some embodiments encrypts the data messages exchanged between the GVMs of one logical network differently than the data messages exchanged between the GVMs of another logical network. In some embodiments, the method can also encrypt different types of data messages from the same GVM differently. Also, in some embodiments, the method can dynamically enforce encryption rules in response to dynamically detected events, such as malware infections.

Claims

1. A method of providing encryption services on a computer that executes a plurality of virtual machines (VMs), the method comprising:

detecting an event on a particular VM;

generating an encryption rule for encrypting data messages that are sent from the particular VM; and

using the encryption rule to encrypt messages sent by the particular VM.

2. The method of claim 1, wherein generating the encryption rule comprises examining a plurality of encryption policies to determine whether an encryption rule needs to be specified for the detected event, wherein generating the encryption rule comprises generating the encryption rule based on the examination of the encryption policies.

3. The method of claim 1, wherein the event is a flow-based event.

4. The method of claim 1, wherein detecting the event comprises detecting an initiation of a flow between the particular VM and another VM.

5. The method of claim 1, wherein detecting the event comprises detecting existence of malware on the particular VM.

6. The method of claim 1, wherein detecting the event comprises detecting existence of malware on another VM.

7. The method of claim 1, wherein generating the encryption rule comprises forwarding the detected event to a set of controllers, said controller set determining whether an encryption rule needs to be specified for the detected event based on a set of encryption policies that are stored by the controller set, wherein generating the encryption rule comprises receiving the generated encryption rule from the controller set.

8. The method of claim 1, wherein generating the encryption rule comprises forwarding the detected event to a set of controllers, said controller set determining whether an encryption policy has to be provided to the computer to generate, at the computer, an encryption rule for the detected event.

9. The method of claim 1, wherein using the encryption rule comprises providing the encryption rule to an encryptor that intercepts data messages sent from the particular VM and encrypts the intercepted data messages based on the encryption rule.

10. The method of claim 9, wherein the encryption rule specifies an encryption key identifier that identifies an encryption key to use to encrypt the data messages, wherein the encryption key is also supplied to the encryptor, wherein before supplying the encryption key, the encryption key is retrieved from a key manager.

11. A non-transitory machine readable medium storing a program for providing encryption services on a computer that executes a plurality of virtual machines (VMs), the program comprising sets of instructions for:

detecting an event on a particular VM;

examining a plurality of encryption policies to determine whether an encryption rule needs to be specified for the detected event; and

specifying the encryption rule based on the examination of the encryption policies, said encryption rule for encrypting messages sent by the particular VM.

12. The non-transitory machine readable medium of claim 11, wherein the program further comprises a set of instructions for using the encryption rule to encrypt messages sent by the particular VM.

13. The non-transitory machine readable medium of claim 11, wherein the event is a flow-based event.

14. The non-transitory machine readable medium of claim 11, wherein the set of instruction for detecting the event comprises a set of instructions for detecting an initiation of a flow between the particular VM and another machine.

15. The non-transitory machine readable medium of claim 11, wherein the set of instruction for detecting the event comprises a set of instructions for detecting existence of malware on the particular VM.

16. The non-transitory machine readable medium of claim 11, wherein the set of instruction for detecting the event comprises a set of instructions for detecting for existence of malware on another VM.

17. The non-transitory machine readable medium of claim 11, wherein the set of instruction for examining the set of encryption policies comprises a set of instructions for forwarding the detected event to a set of controllers, said controller set examining the set of encryption policies to determine whether an encryption rule needs to be specified for the detected event.

18. The non-transitory machine readable medium of claim 11, wherein the set of instruction for examining the set of encryption policies comprises a set of instructions for forwarding the detected event to a set of controllers, said controller set determining whether an encryption policy has to be provided to the computer to generate, at the computer, an encryption rule for the detected event.