Upstream approach for secure cryptography key distribution and management for multi-site data centers

A system comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• receiving, at a multi-site controller (MSC) for a multi-site network and from a first site of the multi-site network, a request to distribute an encryption key to a second site of the multi-site network, wherein the request includes a value associated with the encryption key;
• sending, from the MSC and to the second site, the encryption key and the value, wherein the encryption key is configured to decrypt encrypted packets sent from the first site;
• receiving, at the MSC and from the second site, an acknowledgment that the encryption key was received at the second site;
• and
• sending, from the MSC and to the first site, a confirmation that the encryption key and the value were received at the second site.

A method performed at a first site in a multi-site network that includes a first site and a second site, the method comprising:

• receiving, at a first software-defined networking (SDN) controller that manages the first site and from a multi-site controller (MSC) for the multi-site network, an encryption key and an indication that the encryption key is configured to decrypt encrypted packets sent from the second site of the multi-site network, wherein the encryption key was sent to the MSC from a second SDN controller that manages the second site;
• storing, by the first SDN controller and at the first site, an association between the encryption key and a value indicating the second site;
• deploying, by the first SDN controller, the encryption key to a network device in the first site that is configured to receive traffic from the second site;
• sending a deployment status to the MSC indicating the deployment of the encryption key to the network device;
• receiving, at the first site, an encrypted packet from the second site;
• determining that the encrypted packet was sent from the second site;
• identifying the encryption key based at least in part on the encrypted packet being sent from the second site and the association between the encryption key and the value;
• and
• decrypting the encrypted packet using the encryption key.