Methods and apparatus for providing a secure overlay network between clouds

• US 9,602,544 B2
• Filed: 12/05/2014
• Issued: 03/21/2017
• Est. Priority Date: 12/05/2014
• Status: Active Grant

• Current Assignee: ViaSat Incorporated
• Original Assignee: ViaSat Incorporated
• Inventors: Madhav, Praveen, Uberoy, Pawan
• Primary Examiner(s): Le, Chau
• Assistant Examiner(s): Chaudhry, Muhammad
• Application Number:
  US14/562,326
• Publication Number:
  US 20160164914A1
• Time in Patent Office: 837 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45579 I/O management, e.g. providing access to device drivers or storage
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70

Abstract

A process capable of automatically establishing a secure overlay network (“SON”) across different clouds is disclosed. The process, in one aspect, receives a first request from a first node in a first cloud for establishing a SON. After receiving a second request for connecting to the SON from a second node in a second cloud, a first connection is established connecting between the first node and the second node utilizing a network security protocol such as Internet Protocol Security (“IPSec”). After receiving a third request for connecting to the SON from a third node in a third cloud, a second connection is used to connect between the first node and the third node. A third connection is used to connect between the second node and the third node. Each subsequent request for connecting to the SON from a new node results in new connections between the new node and each existing node in the SON forming a full-mesh.

Claims

1. A communication network having a plurality of virtual machines (“

VMs”

), comprising;

a first private cloud configured to provide network services to a plurality of users, the first private cloud comprising a first edge input and output (“

I/O”

) port into and out of the first private cloud, the first private cloud further comprising a first server inside the first private cloud, the first server having a first interior I/O port;

a public cloud configured to provide cloud computing service to users, the public cloud comprising a second edge I/O port into and out of the public cloud, the public cloud further comprising a second server inside the public cloud, the second server having a second interior I/O port;

a communications network connecting the first edge I/O port of the first private cloud to the second edge I/O port of the public cloud;

an orchestrator coupled to the first private cloud and the public cloud, wherein the orchestrator is configured to establish a first point-to-point connection laid over the communications network for logically direct communication between the first interior I/O port of the first server inside the first private cloud and the second interior I/O port of the second server inside the public cloud in accordance with a network security protocol, wherein the orchestrator comprises a computer processor; and

a second private cloud coupled to the first private cloud and configured to provide network services to a plurality of users, wherein the orchestrator is configured to generate a second point-to-point connection between a first I/O port of the first server and a third I/O port of a third server in the second private cloud, wherein the orchestrator is configured to generate a third point-to-point connection between a second I/O port of the second server in the public cloud and the third I/O port of the third server in the second private cloud.

2. The network of claim 1, wherein the orchestrator is configured to establish a secure overlay network (“

SON”

) over an existing network to establish point-to-point connections in accordance with Internet Protocol Security (“

IPSec”

).

3. The network of claim 2, wherein the orchestrator is configured to utilize a plurality of icons on dashboards, wherein one of the plurality of icons is a selectable option for establishing SON.

4. The network of claim 3, wherein the orchestrator is configured to manage a cluster of point-to-point links generated in accordance with SON.

5. The network of claim 1, wherein:

the first edge I/O port of the first private cloud is disposed between the first interior I/O port of the first server in the first private cloud and the communications network, and

the second edge I/O port of the public cloud is disposed between the second interior I/O port of the second server in the public cloud and the communications network.

6. The network of claim 1, further comprising a dashboard coupled to the orchestrator and configured to interact with a user for facilitating a plurality of user selections before launching a virtual machine (“

VM”

).

7. The network of claim 1, further comprising a dashboard managed by the orchestrator and configured to receive a request from a user for establishing a secure overlay network (“

SON”

).

8. The network of claim 1, wherein the orchestrator provides a dashboard allowing a user to select a secure overlay network (“

SON”

) selection to establish a secure overlay network (“

SON”

) between the first server and the second server.

9. The network of claim 1, further comprising a dashboard managed by the orchestrator and configured to provide an option of creating a secure overlay network (“

SON”

) to a user via the communication network.

10. A method for generating network connections between cloud computing managed by an orchestrator, comprising:

presenting a dashboard including an option of creating a secure overlay network (“

SON”

) to a user by the orchestrator via a communication network, wherein the orchestrator comprises a computer processor;

receiving over the communication network a first selection requesting a first SON for a point-to-point connection from a first interior input and output (“

I/O”

) port of a first virtual server inside a first cloud;

receiving over the communication network a second selection requesting the first SON and a second SON from a second interior I/O port of a second virtual server inside a second cloud;

establishing a first point-to-point logically direct connection laid over an existing network between the first interior I/O port of the first virtual server and the second interior I/O port of the second virtual server in accordance with the first SON utilizing a network security protocol, wherein the existing network connects a first edge I/O port of the first cloud to a second edge I/O port of the second cloud;

receiving a third selection requesting the second SON from a third virtual server in a third cloud and establishing a second point-to-point connection between the second virtual server in the second cloud and the third virtual server in the third cloud in accordance with the second SON utilizing Internet Protocol Security (“

IPsec”

); and

receiving a fourth selection requesting the first SON and the second SON from a fourth virtual server in a fourth cloud and establishing a third point-to-point connection between the fourth virtual server in the fourth cloud and the third virtual server in the third cloud in accordance with the second SON utilizing Internet Protocol Security (“

IPsec”

).

11. The method of claim 10, further comprising establishing a fourth point-to-point connection between the fourth virtual server in the fourth cloud and the first virtual server in the first cloud in accordance with the first SON utilizing Internet Protocol Security (“

IPsec”

).

12. The method of claim 11, further comprising establishing a fifth point-to-point connection between the fourth virtual server in the fourth cloud and the second virtual server in the second cloud in accordance with the first and the second SON utilizing Internet Protocol Security (“

IPsec”

).

13. The method of claim 10, further comprising establishing a third point-to-point connection between a first server and a third server via IPsec.

14. The method of claim 10, wherein:

the first edge I/O port of the first cloud is disposed between the first interior I/O port of the first virtual server in the first cloud and the communication network, and

the second edge I/O port of the second cloud is disposed between the second interior I/O port of the second virtual server in the second cloud and the communication network.