Supporting unknown unicast traffic using policy-based encryption virtualized networks
AssigneeNicira, Inc.
InventorsSanal Pillai, Calvin Qian, Gang Xu, Bin Zan, Ganesan Chandrashekhar
Life of this patent
Estimating the term…
Abstract
Certain embodiments described herein are generally directed to enabling a group of host machines within a network to securely communicate an unknown unicast packet. In some embodiments, a key policy is defined exclusively for the secure communication of unknown unicast packets. The key policy is transmitted by a central controller to the group of host machines for negotiating session keys among each other when communicating unknown unicast packets.
Claims20
A method for use by a first host machine for securely communicating an unknown unicast packet, the method comprising:
- storing, at the first host machine, a single key policy exclusively for communication of unknown unicast (UU) packets with a plurality of host machines within a network, wherein the key policy is different from one or more other key policies used by the first host machine for communication of packets other than UU packets to one or more host machines of the plurality of host machines;
- receiving, at a virtual switch on the first host machine, a UU packet on a logical overlay layer 2 network;
- negotiating a session key with a second host machine using the key policy;
- encrypting the UU packet using the session key;
- and
- transmitting the encrypted UU packet to the second host machine.
A non-transitory computer readable medium comprising instructions to be executed in a first computer system, wherein the instructions when executed in the first computer system perform a method for securely communicating an unknown unicast packet, the method comprising:
- storing, at the first computer system, a single key policy exclusively for communication of unknown unicast (UU) packets with a plurality of computer systems within a network, wherein the key policy is different from one or more other key policies used by the first computer system for communication of packets other than UU packets to one or more computer systems of the plurality of computer systems;
- receiving, at a virtual switch on the first computer system, a UU packet on a logical overlay layer 2 network;
- negotiating a session key with a second computer system using the key policy;
- encrypting the UU packet using the session key;
- and transmitting the encrypted UU packet to the second computer system.
A first computer system, comprising:
- a memory comprising executable instructions;
- and a processor in data communication with the memory and configured to execute the executable instructions to cause the first computer system to perform operations comprising:
- storing, at the first computer system, a single key policy exclusively for communication of unknown unicast (UU) packets with a plurality of computer systems within a network, wherein the key policy is different from one or more other key policies used by the first computer system for communication of packets other than UU packets to one or more computer systems of the plurality of computer systems;
- receiving, at the first computer system, a UU packet;
- negotiating a session key with a second computer system using the key policy;
- encrypting the UU packet using the session key;
- and transmitting the encrypted UU packet to the second computer system.
Dependencies are inferred from the claim text.