Virtual network pairs

• US 9,619,662 B1
• Filed: 01/11/2012
• Issued: 04/11/2017
• Est. Priority Date: 01/13/2011
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Beda, III, Joseph S., Petrescu-Prahova, Cristian, Kern, Christoph
• Primary Examiner(s): Srivastava, Vivek
• Assistant Examiner(s): Nirjhar, Nasim
• Application Number:
  US13/348,548
• Time in Patent Office: 1,917 Days
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 2101/663 Transport layer addresses, e.g. aspects of transmission control protocol [TCP] or user datagram protocol [UDP] ports
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5084 Providing for device mobility network addressing or numbering for mobility support in wireless networks H04W8/26; mobile IP H04W80/04
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213

Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for implementing virtual network pairs between virtual machines and other devices. In one aspect, a method includes associating each of a plurality of different virtual machine network addresses with a respective host machine network address; receiving, from a sender, a request for a source virtual machine to communicate with a destination virtual machine; determining that the source virtual machine is authorized to communicate with the destination virtual machine; selecting, from the associations, a host machine network address for the destination virtual machine; generating a token based at least partly on the selected host machine network address and on a secret key of the destination virtual machine, wherein the secret key is not known by the source virtual machine; and sending the selected host machine network address and generated token to the sender.

Claims

1. A method implemented by data processing apparatus, the method comprising:

maintaining, by a virtual machine registry service, a distinct secret key for each of a plurality of virtual machines executing on a plurality of host machines, wherein the secret key for each of the virtual machines (i) is known to a communication process that executes on the same host machine as the virtual machine and that manages network communication for the virtual machine, (ii) is not known to any of the plurality of virtual machines, and (iii) is used by the virtual machine registry service to authorize pairwise communications between the virtual machine and other virtual machines of the plurality of virtual machines;

maintaining, by the virtual machine registry service, data identifying pairs of virtual machines that are allowed to communicate with one another;

receiving, by the virtual machine registry service, a plurality of requests, each request being received from a respective source communication process that manages network communication for a respective source virtual machine, and each request being a request for a token that authenticates the respective source virtual machine as being authorized to communicate with a respective destination virtual machine to a respective destination communication process that manages network communication for the respective destination virtual machine;

for each request of the plurality of requests;

determining, by the virtual machine registry service, that the respective source virtual machine is authorized to communicate with the respective destination virtual machine by consulting the data identifying pairs of virtual machines that are allowed to communicate with one another;

determining, by the virtual machine registry service, a host machine network address for the respective destination virtual machine;

generating, by the virtual machine registry service, a token based at least partly on the host machine network address and the secret key of the respective destination virtual machine; and

sending, by the virtual machine registry service, the selected host machine network address and generated token to the respective source communication process for the respective source virtual machine for transmission to the respective destination communication process as evidence that the respective source virtual machine is authorized to communicate with the respective destination virtual machine.

2. The method of claim 1, wherein the respective source communication process that manages network communication for each source virtual machine executes in a user process space of a host operating system executing on the same host machine as the source virtual machine.

3. The method of claim 1, wherein the selected host machine network address comprises an Internet Protocol (IP) address of a respective host machine on which the respective destination virtual machine executes and a User Datagram Protocol (UDP) port for the respective destination virtual machine.

4. The method of claim 1, further comprising generating the token by creating a hash-based message authentication code from the host machine network address and the secret key of the respective destination virtual machine.

5. The method of claim 1, further comprising generating the token based at least in part on a network address of the respective source virtual machine.

6. The method of claim 1, further comprising sending data identifying a validity period for the generated token to the respective source communication process.

7. The method of claim 6, further comprising generating the token based at least in part on the validity period.

8. The method of claim 1, further comprising identifying that the respective destination virtual machine has migrated to a different host machine.

9. The method of claim 8, further comprising:

associating the virtual machine network address of the respective destination virtual machine with the host machine network address of the different host machine.

10. The method of claim 8, further comprising:

sending a message to the respective source communication process invalidating the previously sent host machine network address.

11. A system comprising:

one or more computers and one or more storage devices storing instructions that when executed by the one or more computers cause the one or more computers to perform operations comprising;

maintaining, by a virtual machine registry service, a distinct secret key for each of a plurality of virtual machines executing on a plurality of host machines, wherein the secret key for each of the virtual machines (i) is known to a communication process that executes on the same host machine as the virtual machine and that manages network communication for the virtual machine, (ii) is not known to any of the plurality of virtual machines, and (iii) is used by the virtual machine registry service to authorize pairwise communications between the virtual machine and other virtual machines of the plurality of virtual machines;

maintaining, by the virtual machine registry service, data identifying pairs of virtual machines that are allowed to communicate with one another;

receiving, by the virtual machine registry service, a plurality of requests, each request being received from a respective source communication process that manages network communication for a respective source virtual machine, and each request being a request for a token that authenticates the respective source virtual machine as being authorized to communicate with a respective destination virtual machine to a respective destination communication process that manages network communication for the respective destination virtual machine;

for each request of the plurality of requests;

determining, by the virtual machine registry service, that the respective source virtual machine is authorized to communicate with the respective destination virtual machine by consulting the data identifying pairs of virtual machines that are allowed to communicate with one another;

determining, by the virtual machine registry service, a host machine network address for the respective destination virtual machine;

generating, by the virtual machine registry service, a token based at least partly on the host machine network address and the secret key of the respective destination virtual machine; and

sending, by the virtual machine registry service, the selected host machine network address and generated token to the respective source communication process for the respective source virtual machine for transmission to the respective destination communication process as evidence that the respective source virtual machine is authorized to communicate with the respective destination virtual machine.

12. The system of claim 11, wherein the respective source communication process that manages network communication for each source virtual machine executes in a user process space of a host operating system executing on the same host machine as the source virtual machine.

13. The system of claim 11, wherein the selected host machine network address comprises an Internet Protocol (IP) address of a respective host machine on which the respective destination virtual machine executes and a User Datagram Protocol (UDP) port for the respective destination virtual machine.

14. The system of claim 11, the operations further comprising generating the token by creating a hash-based message authentication code from the host machine network address and the secret key of the respective destination virtual machine.

15. The system of claim 11, the operations further comprising generating the token based at least in part on a network address of the respective source virtual machine.

16. The system of claim 11, the operations further comprising:

sending data identifying a validity period the generated token to the respective source communication process.

17. The system of claim 16, the operations further comprising generating the token based at least in part on the validity period.

18. The system of claim 11, the operations further comprising:

identifying that the respective destination virtual machine has migrated to a different host machine.

19. The system of claim 18, the operations further comprising:

associating the virtual machine network address of the respective destination virtual machine with the host machine network address of the different host machine.

20. The system of claim 18, the operations further comprising:

sending a message to the respective source communication process invalidating the previously sent host machine network address.

21. A non-transitory computer storage medium encoded with a computer program, the program comprising instructions that when executed by data processing apparatus cause the data processing apparatus to perform operations comprising:

one or more computers and one or more storage devices storing instructions that when executed by the one or more computers cause the one or more computers to perform operations comprising;

maintaining, by a virtual machine registry service, a distinct secret key for each of a plurality of virtual machines executing on a plurality of host machines, wherein the secret key for each of the virtual machines (i) is known to a communication process that executes on the same host machine as the virtual machine and that manages network communication for the virtual machine, (ii) is not known to any of the plurality of virtual machines, and (iii) is used by the virtual machine registry service to authorize pairwise communications between the virtual machine and other virtual machines of the plurality of virtual machines;

maintaining, by the virtual machine registry service, data identifying pairs of virtual machines that are allowed to communicate with one another;

receiving, by the virtual machine registry service, a plurality of requests, each request being received from a respective source communication process that manages network communication for a respective source virtual machine, and each request being a request for a token that authenticates the respective source virtual machine as being authorized to communicate with a respective destination virtual machine to a respective destination communication process that manages network communication for the respective destination virtual machine;

for each request of the plurality of requests;

determining, by the virtual machine registry service, that the respective source virtual machine is authorized to communicate with the respective destination virtual machine by consulting the data identifying pairs of virtual machines that are allowed to communicate with one another;

determining, by the virtual machine registry service, a host machine network address for the respective destination virtual machine;

generating, by the virtual machine registry service, a token based at least partly on the host machine network address and the secret key of the respective destination virtual machine; and

sending, by the virtual machine registry service, the selected host machine network address and generated token to the respective source communication process for the respective source virtual machine for transmission to the respective destination communication process as evidence that the respective source virtual machine is authorized to communicate with the respective destination virtual machine.

22. The computer storage medium of claim 21, wherein the respective source communication process that manages network communication for each source virtual machine executes in a user process space of a host operating system executing on the same host machine as the source virtual machine.

23. The computer storage medium of claim 21, wherein the selected host machine network address comprises an Internet Protocol (IP) address of a respective host machine on which the respective destination virtual machine executes and a User Datagram Protocol (UDP) port for the respective destination virtual machine.

24. The computer storage medium of claim 21, the operations further comprising generating the token by creating a hash-based message authentication code from the host machine network address and the secret key of the respective destination virtual machine.

25. The computer storage medium of claim 21, the operations further comprising generating the token based at least in part on a network address of the respective source virtual machine.

26. The computer storage medium of claim 21, the operations further comprising:

sending data identifying a validity period for the generated token to the respective source communication process.

27. The computer storage medium of claim 26, the operations further comprising generating the token based at least in part on the validity period.

28. The computer storage medium of claim 21, the operations further comprising:

identifying that the respective destination virtual machine has migrated to a different host machine.

29. The computer storage medium of claim 28, the operations further comprising:

associating the virtual machine network address of the respective destination virtual machine with the host machine network address of the different host machine.

30. The computer storage medium of claim 28, the operations further comprising:

sending a message to the respective source communication process invalidating the previously sent host machine network address.