Centralized management of private networks
Described herein are systems, methods, and software to manage private networks for computing elements. In one example, a computing element may obtain credential information associated with a user and generate a public-private key pair for the computing element. The computing element may further communicate the public key from the pair with metadata to a coordination service to register the computing element at the coordination service. Once registered, the computing element may receive communication information associated with one or more other computing elements that permit the computing element to communicate with the other computing elements.
1 . A method of operating a coordination service on one or more computing elements, the method comprising:
for each computing element of a plurality of computing elements of a private network:
receiving a public key from said computing element for encrypting private network traffic to said computing element;
identifying a private internet protocol (IP) address for said computing element on the private network; and
identifying a public IP address for said computing element; and
in response to determining a first computing element of the plurality of computing elements is permitted to access the private network:
distributing, to the first computing element, the public keys, the private IP addresses, and the public IP addresses associated with other computing elements comprising those of the plurality of computing elements other than the first computing element, wherein the first computing element creates an encapsulation of a packet directed to a destination private IP address, of the private IP addresses, assigned to a second computing element of the plurality of computing elements by encrypting the packet using a destination public key, of the public keys, associated with the second computing element, and transmit the encapsulation to a destination public IP address assigned to the second computing element; and
distributing, to the other computing elements, the private IP address and the public IP address identified for the first computing element and the public key received from the first computing element.
2 . The method of claim 1 , wherein the first computing element comprises a physical computing device or a virtual machine.
3 . The method of claim 1 , further comprising:
receiving an updated public key from the first computing element; and
distributing the updated public key to the other computing elements to replace the public key received from the first computing element.
4 . The method of claim 1 , further comprising:
identifying an updated public IP address for the first computing element; and
distributing the updated public IP address to the other computing elements to replace the public IP address identified for the first computing element.
5 . The method of claim 1 , further comprising:
determining the first computing element is no longer permitted to access the private network; and
removing the public key, the private IP address, and the public IP address associated with the first computing element at the other computing elements.
6 . The method of claim 1 , wherein determining the first computing element is permitted to access the private network comprises:
authenticating a user of the first computing element; and
determining the user is allowed to access the private network.
7 . A computing apparatus comprising:
a storage system comprising computer readable storage media;
a processing system operatively coupled to the storage system; and
program instructions stored on the storage system to provide a coordination service for a private network that, when executed by the processing system, direct the computing apparatus to:
for each computing element of a plurality of computing elements of the private network:
receive a public key from said computing element for encrypting private network traffic to said computing element;
identify a private internet protocol (IP) address for said computing element on the private network; and
identify a public IP address for said computing element; and
in response to determining a first computing element of the plurality of computing elements is permitted to access the private network:
distribute, to the first computing element, the public keys, the private IP addresses, and the public IP addresses associated with other computing elements comprising those of the plurality of computing elements other than the first computing element, wherein the first computing element creates an encapsulation of a packet directed to a destination private IP address, of the private IP addresses, assigned to a second computing element of the plurality of computing elements by encrypting the packet using a destination public key, of the public keys, associated with the second computing element, and transmit the encapsulation to a destination public IP address assigned to the second computing element; and
distribute, to the other computing elements, the private IP address and the public IP address identified for the first computing element and the public key received from the first computing element.
8 . The computing apparatus of claim 7 , wherein the first computing element comprises a physical computing device or a virtual machine.
9 . The computing apparatus of claim 7 , wherein the program instructions further direct the computing apparatus to:
receive an updated public key from the first computing element; and
distribute the updated public key to the other computing elements to replace the public key received from the first computing element.
10 . The computing apparatus of claim 7 , wherein the program instructions further direct the computing apparatus to:
identify an updated public IP address for the first computing element; and
distribute the updated public IP address to the other computing elements to replace the public IP address identified for the first computing element.
11 . The computing apparatus of claim 7 , wherein the program instructions further direct the computing apparatus to:
determine the first computing element is no longer permitted to access the private network; and
remove the public key, the private IP address, and the public IP address associated with the first computing element at the other computing elements.
12 . The computing apparatus of claim 7 , wherein to determine the first computing element is permitted to access the private network, the program instructions direct the computing apparatus to:
authenticate a user of the first computing element; and
determine the user is allowed to access the private network.
13 . A system comprising:
a plurality of computing devices;
a coordination service executing across one or more computers and configured to:
for each computing device of plurality of computing devices of a private network:
receive a public key from said computing device for encrypting private network traffic to said computing device;
identify a private internet protocol (IP) address for said computing device on the private network; and
identify a public IP address for said computing device; and
in response to determining a first computing device of the plurality of computing devices is permitted to access the private network:
distribute, to the first computing device, the public keys, the private IP addresses, and the public IP addresses associated with other computing devices comprising those of the plurality of computing devices other than the first computing device; and
distribute, to the other computing devices, the private IP address and the public IP address identified for the first computing device and the public key received from the first computing device; and
the first computing device configured to:
create an encapsulation of a packet directed to a destination private IP address, of the private IP addresses, assigned to a second computing device of the plurality of computing devices by encrypting the packet using a destination public key, of the public keys, associated with the second computing device; and
transmit the encapsulation to a destination public IP address assigned to the second computing device.
14 . The system of claim 13 , wherein the coordination service is further configured to:
receive an updated public key from the first computing device; and
distribute the updated public key to the other computing devices to replace the public key received from the first computing device.
15 . The system of claim 13 , wherein the coordination service is further configured to:
identify an updated public IP address for the first computing device; and
distribute the updated public IP address to the other computing devices to replace the public IP address identified for the first computing device.
16 . The system of claim 13 , wherein the first computing device is further configured to:
receive a second packet from a source computing device of the plurality of computing devices; and
decrypt the second packet using a private key local to the first computing device, wherein the private key is a pair with the public key provided to the coordination service by the first computing device.
17 . The system of claim 13 , wherein the first computing device is further configured to:
identify a second packet directed to a destination computing device in the plurality of computing devices;
encrypting the second packet using a second destination public key, of the public keys, associated with the destination computing device; and
communicating the encrypted second packet to the destination computing device using a second destination public IP address, of the public IP addresses, for the second computing device.