End-to-end security in a cloud adaptive overlay network
AssigneeLenovo Enterprise Solutions (Singapore) Pte. Ltd.
InventorsBogdan Cosmin Chifor, Andrei Ion Bunghez
Life of this patent
Estimating the term…
Abstract
A hypervisor receives an outbound network packet from a first virtual machine for secure communication with a second virtual machine, wherein the network packet includes source and destination logical network addresses, a first payload, and a network packet integrity value determined using a cryptographic session key for a current secure session between the first and second virtual machines. The hypervisor transforms the outbound network packet by replacing the logical network addresses with current physical network addresses and subsequently recalculating the network packet integrity value. The transformed outbound network packet in then transmitted onto a network for delivery to the second virtual machine.
Claims19
A computer program product comprising a non-volatile computer readable medium and non-transitory program instructions embodied therein, the program instructions being configured to be executable by a processor to cause the processor to perform operations comprising:
- receiving an outbound network packet from a first virtual machine to a second virtual machine, wherein the outbound network packet includes a source address field including a logical network address of the first virtual machine, a destination address field including a logical network address of the second virtual machine, a first payload, and a network packet integrity field including a first network packet integrity value for the outbound network packet that is determined using a cryptographic session key for a current secure session between the first and second virtual machines;
- receiving the cryptographic session key from the first virtual machine;
- transforming the outbound network packet received from the first virtual machine to form a transformed outbound network packet by:
- replacing the logical network address of the first virtual machine in the source address field with a physical network address of the first virtual machine;
- replacing the logical network address of the second virtual machine in the destination address field with a physical network address of the second virtual machine;
- and
- replacing the first network packet integrity value in the network packet integrity field with a second network packet integrity value for the transformed outbound network packet, wherein the second network packet integrity value is determined using the cryptographic session key after replacing the logical network address of the first virtual machine in the source address field with a physical network address of the first virtual machine and replacing the logical network address of the second virtual machine in the destination address field with a physical network address of the second virtual machine;
- and
- transmitting the transformed outbound network packet onto a network for delivery to the second virtual machine.
A method, comprising:
- a first hypervisor receiving an outbound network packet from a first virtual machine to a second virtual machine, wherein the first virtual machine runs on the first hypervisor, and wherein the outbound network packet includes a source address field including a logical network address of the first virtual machine, a destination address field including a logical network address of the second virtual machine, a first payload, and a network packet integrity field including a first network packet integrity value for the outbound network packet that is determined using a cryptographic session key for a current secure session between the first and second virtual machines;
- the first hypervisor receiving the cryptographic session key from the first virtual machine;
- the first hypervisor transforming the outbound network packet received from the first virtual machine to form a transformed outbound network packet by:
- replacing the logical network address of the first virtual machine in the source address field with a physical network address of the first virtual machine;
- replacing the logical network address of the second virtual machine in the destination address field with a physical network address of the second virtual machine;
- and
- replacing the first network packet integrity value in the network packet integrity field with a second network packet integrity value for the transformed outbound network packet, wherein the second network packet integrity value is determined using the cryptographic session key after replacing the logical network address of the first virtual machine in the source address field with a physical network address of the first virtual machine and replacing the logical network address of the second virtual machine in the destination address field with a physical network address of the second virtual machine;
- and
- the first hypervisor transmitting the transformed outbound network packet onto a network for delivery to the second virtual machine.
Dependencies are inferred from the claim text.