Performing context-rich attribute-based encryption on a host
Some embodiments provide a context engine that supplies contextual-attributes to several context-based service engines on its host computer. Different embodiments use different types of context-based service engines. For instance, in some embodiments, the attribute-based service engines include an encryption engine that performs context-based encryption or decryption operations to encrypt data messages from the machines, or to decrypt data messages received for the machines.
1. A method of encrypting data messages sent by a first machine executing on a first host computer with a plurality of other machines, the method comprising:
at an encryption module executing on the first host computer independently of the first machine,
receiving a data message sent by the first machine addressed to a second machine executing on a second host computer;
identifying a set of attributes associated with the first machine, the set of attributes including attributes other than layer 2 (L2), layer 3 (L3), and layer 4 (L4) data-message header values;
using the identified set of attributes to identify an encryption rule;
encrypting the data message based on the encryption rule; and
sending, separately from the data message, an out-of-band message to the second host computer, the out-of-band message comprising an identifier for identifying the data message and a key identifier for identifying a key for decrypting the encrypted data message.
2. The method of claim 1 , wherein the identified set of attributes includes an application identifier that identifies a traffic type for a payload data contained within a data message flow of the data message.
3. The method of claim 1 , wherein the identified set of attributes includes an identifier of a user logged on to the first machine.
4. The method of claim 3 , wherein the user identifier is a group identifier.
5. The method of claim 3 , wherein the user identifier is an identifier that identifies a single individual.
6. The method of claim 1 , wherein the identified set of attributes includes a threat level associated with an application that executes on the first machine.
7. The method of claim 6 , wherein the application is an application that sent the data message.
8. The method of claim 6 , wherein the application is not an application that sent the data message.
9. A non-transitory machine readable medium storing a program for encrypting data messages sent by a first machine executing on a first host computer with a plurality of other machines, the program comprising sets of instructions for:
receiving a data message sent by the first machine addressed to a second machine executing on a second host computer;
identifying a set of attributes associated with the first machine, the set of attributes including attributes other than layer 2 (L2), layer 3 (L3), and layer 4 (L4) data-message header values;
using the identified set of attributes to identify an encryption rule;
encrypting the data message based on the encryption rule; and
sending, separately from the data message, an out-of-band message to the second host computer, the out-of-band message comprising an identifier for identifying the data message and a key identifier for identifying a key for decrypting the encrypted data message.
10. The non-transitory machine readable medium of claim 9 , wherein the set of instructions for identifying the set of attributes comprises a set of instructions for providing an identifier contained within the data message to a context-resolving engine to obtain at least a subset of the attributes that includes non-L2-L4 header values.
11. The non-transitory machine readable medium of claim 10 , wherein the identifier provided to the context-resolving engine comprises source IP (Internet Protocol) address, destination IP address, source port, destination port, and protocol header values of the data message.
12. The non-transitory machine readable medium of claim 10 , wherein the identifier provided to the context-resolving engine comprises a service tag embedded in the header values of the data message.
13. The non-transitory machine readable medium of claim 9 , wherein the first machine is a virtual machine (VM).
14. The non-transitory machine readable medium of claim 9 , wherein the first machine is a container.
15. The non-transitory machine readable medium of claim 9 , wherein the encryption rule comprises the key identifier that is used to identify the key for encrypting the data message.
16. The non-transitory machine readable medium of claim 9 , wherein the identified set of attributes includes an identifier of a user logged on to the first machine.
17. The non-transitory machine readable medium of claim 16 , wherein the user identifier is a group identifier.