US 12,750,350 B2 · Automatic encryption for cloud-native workloads

Abstract

Techniques for routing service mesh traffic based on whether the traffic is encrypted or unencrypted are described herein. The techniques may include receiving, from a first node of a cloud-based network, traffic that is to be sent to a second node of the cloud-based network and determining whether the traffic is encrypted or unencrypted. If it is determined that the traffic is encrypted, the traffic may be sent to the second node via a service mesh of the cloud-based platform. Alternatively, or additionally, if it is determined that the traffic is unencrypted, the traffic may be sent to the second node via an encrypted tunnel. In some examples, the techniques may be performed at least partially by a program running on the first node of the cloud-based network, such as an extended Berkeley Packet Filter (eBPF) program, and the like.

Claims19

Dependent claims

A method comprising:

causing establishment of a Layer-2 (L2) encrypted tunnel between a first pod and a second pod, wherein the L2 encrypted tunnel is configured to encrypt contents of data traffic located in any of Layer-3 (L3) through Layer-7 (L7);
receiving, from the first pod hosting a first container associated with a microservices application, traffic that is to be sent to the second pod;
determining that data within at least one of L3 through L7 of the traffic is unencrypted;
based at least in part on the data being unencrypted, determining to send the traffic through the L2 encrypted tunnel such that the data within the at least one of the L3 through L7 of the traffic is encrypted in the L2 encrypted tunnel;
based at least in part on the data located in any of L3-L7 being unencrypted, causing the traffic to be sent to the second pod via the L2 encrypted tunnel between the first pod and the second pod.

2 more elements

A system comprising:

one or more processors;
and
one or more non-transitory computer-readable media storing instructions that, when executed, cause the one or more processors to perform operations comprising:
causing establishment of a Layer-2 (L2) encrypted tunnel between a first container host and a second container host, wherein the L2 encrypted tunnel is configured to encrypt contents of data traffic located in any of Layer-3 (L3) through Layer-7 (L7);
receiving, from the first container host of an orchestration system for managing containerized microservices applications, traffic that is to be sent to the second container host of the orchestration system, the first container host and the second container host each hosting a container associated with a microservices application;
determining that data within at least one of L3 through L7 of the traffic is unencrypted;
based at least in part on the data being unencrypted, determining to send the traffic through the L2 encrypted tunnel such that the data within the at least one of the L3 through L7 of the traffic is encrypted in the L2 encrypted tunnel;
based at least in part on the data located in any of L3-L7 being unencrypted, causing the traffic to be sent to the second container host via the L2 encrypted tunnel between the first container host and the second container host.

5 more elements

One or more non-transitory computer-readable media storing instructions that, when executed, cause one or more processors to perform operations comprising:

causing establishment of a Layer-2 (L2) encrypted tunnel between a first container host and a second container host, wherein the L2 encrypted tunnel is configured to encrypt contents of data traffic located in any of Layer-3 (L3) through Layer-7 (L7);
receiving, from the first container host of an orchestration system for managing containerized microservices applications, traffic that is to be sent to the second container host of the orchestration system, the first container host and the second container host each hosting a container associated with a microservices application;
determining that data within at least one of L3 through L7 of the traffic is unencrypted;
based at least in part on the data being unencrypted, determining to send the traffic through the L2 encrypted tunnel such that the data within the at least one of the L3 through L7 of the traffic is encrypted in the L2 encrypted tunnel;
based at least in part on the data located in any of L3-L7 being unencrypted, causing the traffic to be sent to the second container host via the L2 encrypted tunnel between the first container host and the second container host.

2 more elements

Dependencies are inferred from the claim text.

Automatic encryption for cloud-native workloads

Life of this patent

Automatic encryption for cloud-native workloads

Life of this patent

Abstract

Claims19