US 11,770,358 B2 · Security for virtual extensible local area networks

Abstract

Presented herein are embodiments of mechanisms to add security in the communication of messages between devices, particularly in the context of VXLAN (Virtual eXtensible Local Area Network (LAN)) environments. When a VXLAN device sends a multicast message to discover other devices in the network, there is possibilities for rogue devices to respond and then receive data that is not intended for them. In one or more embodiments, information handling systems operating as a VTEP (VXLAN tunnel endpoint) may use enhanced encryption that is shared with other authorized VTEP—but not shared with rough VTEP devices—to verify other authorized VTEPs. In one or more embodiments, information used to verify a VTEP device is included in the message, such as included in the header, which a properly configured receiving VTEP will recognize and use to verify that that sending VTEP is not a rogue device.

Claims21

Dependent claims

A computer-implemented method comprising:

generating a unique encryption code using an encryption module having an encryption type and at least one of a secret key and a secret text;
selecting a position in the unique encryption code;
identifying a corresponding set of values at that position in the unique encryption code;
and
generating a message that includes a value representing the position in the unique encryption code and the corresponding set of values at that position in the unique encryption code for use for a receiver to verify a sender of the message.

2 more elements

A computer-implemented method comprising:

receiving at a receiving device a message sent from a sending device;
and
responsive to the receiving device identifying an indicator in a message that indicates enhanced verification, performing steps comprising:
identifying in the message a value indicting a position in a unique encryption code and a corresponding set of values that should exist at that position in the unique encryption code;
generating the unique encryption code using an encryption module having an encryption type and at least one of a secret key and a secret text, wherein the sending device and the receiving device each has access to an encryption module having the encryption type and each knows the at least one of the secret key and the secret text;
and
responsive to determining that the values at the same position in the unique encryption code match the corresponding set of values in the message, adding a MAC address of the sending device that generated the message to a networking table as a verified device for which data traffic may be sent to, received from, or both.

4 more elements

An information handling system comprising:

one or more processors;
and
a non-transitory computer-readable medium or media comprising one or more sets of instructions which, when executed by at least one of the one or more processors, causes steps to be performed comprising:
generating a unique encryption code using an encryption module having an encryption type and at least one of a secret key and a secret text;
selecting a position in the unique encryption code;
identifying a corresponding set of values at that position in the unique encryption code;
and
generating a message that includes a value representing the position in the unique encryption code and the corresponding set of values at that position in the unique encryption code for use for a receiver of the packet to verify a sender of the message.

5 more elements

Dependencies are inferred from the claim text.

Security for virtual extensible local area networks

Life of this patent

Security for virtual extensible local area networks

Life of this patent

Abstract

Claims21