Securing an overlay network against attack
AssigneeAkamai Technologies, Inc.
InventorsBrandon O. Williams, Liza Alenchery, Yixin Jin
Life of this patent
Estimating the term…
Abstract
The techniques herein provide for enhanced overlay network-based transport of traffic, such as IPsec traffic, e.g., to and from customer branch office locations, facilitated through the use of the Internet-based overlay routing infrastructure. This disclosure describes a method of providing integrity protection for traffic on the overlay network.
Claims20
A method operative in an overlay network configured to provide UDP-based packet transport across the publicly-routed Internet between and among regions, the regions comprising at least one ingress edge region, and at least one egress gateway region, comprising:
- associating a private key pair to each region;
- deriving a shared secret across a pair of regions, the region pair operating according to a trust scheme;
- using the shared secret to generate a key;
- using the key and additional data to compute an integrity check value (ICV), wherein the integrity check value is unique to the region pair;
- and
- incorporating the ICV into an overlay network packet header associated with each data packet communicated between the region pair during a flow.
A method operative in an overlay network configured to provide UDP-based packet transport across the publicly-routed Internet between and among regions, the regions comprising at least one ingress edge region, and at least one egress gateway region, comprising:
- organizing multiple regions into a collective, the collective associated with a trust level of a multi-level trust scheme;
- having each of the machines in the multiple regions of the collective subscribe to a collection of keying materials, the collection being associated with the trust level of the collective, as well as one or more other trust levels lower in the multi-level trust scheme;
- having a pair of regions use the keying materials to generate a key;
- using the key to generate a message authentication code;
- and
- applying the message authentication code to data packets within a flow across the region pair to prevent attack.
A method for overlay network integrity protection, comprising:
- configuring a set of regions of the overlay network according to a multi-level trust scheme, whereby a first region associated with a first trust level is unable to represent itself to a second region associated with a second trust level as more trusted than it is;
- and
- associating region pairs within a trust level with a per-region pair integrity check value (ICV), the ICV being associated with each data packet of a flow across a particular region pair.
Dependencies are inferred from the claim text.