Security against side-channel attack in real-time virtualized networks
AssigneeNicira, Inc.
InventorsGang Xu, Bin Qian, Ganesan Chandrashekhar, Sujatha Sundararaman
Life of this patent
Estimating the term…
Abstract
Aspects of the present disclosure relate to adaptive and user-defined security against side-channel attacks in a virtual network. Traffic in the virtual network can be monitored at the hypervisor level and network security levels, such as padding and inclusion of dummy packets in the traffic stream, may be adaptively switched based on the monitored traffic information. In addition, user-defined security policies can be input to a management console. Thus, the security levels can be adaptive to real-time traffic bandwidth usage in the network and also flexibly specified by the user/administrator, which may be more efficient.
Claims19
A method for exchanging packets in a virtual data center, the method comprising:
- monitoring traffic in the virtual data center to obtain real-time bandwidth usage of the traffic;
- determining a security protection level for the traffic based, at least in part, on the real-time bandwidth usage of the traffic;
- and
- dynamically performing at least one of:
- padding of encrypted packets of the traffic or including of dummy packets with the traffic, at least in part in response to the real-time bandwidth usage of the traffic and the security protection level.
A non-transitory computer readable medium comprising instructions to be executed in a computer system, wherein the instructions when executed in the computer system perform a method for exchanging packets in a virtual data center, the method comprising:
- monitoring traffic in the virtual data center to obtain real-time bandwidth usage of the traffic;
- determining a security protection level for the traffic based, at least in part, on the real-time bandwidth usage of the traffic;
- and
- dynamically performing at least one of:
- padding of encrypted packets of the traffic or including of dummy packets with the traffic at least in part in response to the real-time bandwidth usage of the traffic and the security protection level.
A computer system comprising at least one processor coupled with a memory, wherein the memory stores system software for the at least one processor to execute a method for exchanging packets in a virtual data center, the method comprising:
- monitoring traffic in the virtual data center to obtain real-time bandwidth usage of the traffic;
- determining a security protection level for the traffic based, at least in part, on the real-time bandwidth usage of the traffic;
- and
- dynamically performing at least one of:
- padding of encrypted packets of the traffic or including of dummy packets with the traffic, at least in part in response to the real-time bandwidth usage of the traffic and the security protection level.
A computer system comprising:
- means for monitoring traffic in the virtual data center to obtain real-time bandwidth usage of the traffic;
- means for determining a security protection level for the traffic based, at least in part, on the real-time bandwidth usage of the traffic;
- and
- means for dynamically performing at least one of:
- padding of encrypted packets of the traffic or including of dummy packets with the traffic, at least in part in response to the real-time bandwidth usage of the traffic and the security protection level.
Dependencies are inferred from the claim text.