Security for virtual extensible local area networks
Presented herein are embodiments of mechanisms to add security in the communication of messages between devices, particularly in the context of VXLAN (Virtual eXtensible Local Area Network (LAN)) environments. When a VXLAN device sends a multicast message to discover other devices in the network, there is possibilities for rogue devices to respond and then receive data that is not intended for them. In one or more embodiments, information handling systems operating as a VTEP (VXLAN tunnel endpoint) may use enhanced encryption that is shared with other authorized VTEP—but not shared with rough VTEP devices—to verify other authorized VTEPs. In one or more embodiments, information used to verify a VTEP device is included in the message, such as included in the header, which a properly configured receiving VTEP will recognize and use to verify that that sending VTEP is not a rogue device.
1. A computer-implemented method comprising:
generating a unique encryption code using an encryption module having an encryption type and at least one of a secret key and a secret text;
selecting a position in the unique encryption code;
identifying a corresponding set of values at that position in the unique encryption code; and
generating a message that includes a value representing the position in the unique encryption code and the corresponding set of values at that position in the unique encryption code for use for a receiver to verify a sender of the message.
2. The computer-implemented method of claim 1 wherein the message is an Address Resolution Protocol message and the sender is a VTEP device.
3. The computer-implemented method of claim 1 wherein the step of generating a unique encryption code using an encryption module having an encryption type and at least one of a secret key and a secret text further comprises:
combining additional data with the secret text as an input when generating the unique encryption code.
4. The computer-implemented method of claim 3 wherein the additional data comprises a Media Access Control of the sender of the message.
5. The computer-implemented method of claim 1 further comprising the steps of:
responsive to receiving a reply message, identifying in the reply message a second value indicating a second position and a corresponding set of values in a second unique encryption code;
generating the second unique encryption code using at least the secret key, the secret text, and the encryption module having the encryption type; and
determining whether the values at the second position in the second unique encryption code match the corresponding set of values in the reply message.
6. The computer-implemented method of claim 5 further comprising the steps of:
responsive to determining that the values at the second position in the second unique encryption code match the corresponding set of values in the reply message, adding a MAC address of a remote device that generated the reply message to a networking table as a verified device.
7. The computer-implemented method of claim 5 further comprising the steps of:
responsive to determining that the values at the second position in the second unique encryption code do not match the corresponding set of values in the reply message:
not adding a MAC address of a remote device that generated the reply message to a networking table as a verified device;
adding the MAC address of the remote device to a blocked list or an untrusted device list; or
both.
8. A computer-implemented method comprising:
receiving at a receiving device a message sent from a sending device; and
responsive to the receiving device identifying an indicator in a message that indicates enhanced verification, performing steps comprising:
identifying in the message a value indicting a position in a unique encryption code and a corresponding set of values that should exist at that position in the unique encryption code;
generating the unique encryption code using an encryption module having an encryption type and at least one of a secret key and a secret text, wherein the sending device and the receiving device each has access to an encryption module having the encryption type and each knows the at least one of the secret key and the secret text; and
responsive to determining that the values at the same position in the unique encryption code match the corresponding set of values in the message, adding a MAC address of the sending device that generated the message to a networking table as a verified device for which data traffic may be sent to, received from, or both.
9. The computer-implemented method of claim 8 wherein the message is an Address Resolution Protocol message and the sending device and the receiving device are VTEP devices.
10. The computer-implemented method of claim 8 wherein the indicator is a bit in a header of the message and the value indicating the position and the corresponding set of values is also in a header of the message.
11. The computer-implemented method of claim 9 wherein the step of generating the unique encryption code using an encryption module having an encryption type and at least one of a secret key and a secret text, comprises:
combining additional data with the secret text as an input when generating the unique encryption code, in which the additional data that is combined with the secret text is known according to a rule known to the sending device and the receiving device.
12. The computer-implemented method of claim 8 further comprising the steps of:
responsive to determining that the values at the same position in the unique encryption code do not match the corresponding set of values in the message:
not adding a MAC address of the sending device to a networking table as a verified device;
adding the MAC address of the sending device to a blocked list or an untrusted device list; or
both.
13. The computer-implemented method of claim 8 further comprising the steps of responsive to determining that the values at the same position in the unique encryption code match the corresponding set of values in the message, further comprises:
generating a second unique encryption code using at least the secret key, the secret text, and the encryption module having an encryption type;
selecting a position in the second unique encryption code;
identifying a corresponding set of values at that position in the second unique encryption code;
generating a reply message that includes the position in the second unique encryption code and the corresponding set of values at that position; and
sending the reply message to the sending device.
14. The computer-implemented method of claim 13 wherein the step of generating a second unique encryption code using at least the secret key, the secret text, and the encryption module having an encryption type comprises:
combining additional data with the secret text as an input when generating the second unique encryption code.
15. The computer-implemented method of claim 8 wherein the position is a byte position and the value represents that byte position in the unique encryption code and the corresponding set of values are the values at that byte position in the unique encryption code.
16. An information handling system comprising:
one or more processors; and
a non-transitory computer-readable medium or media comprising one or more sets of instructions which, when executed by at least one of the one or more processors, causes steps to be performed comprising:
generating a unique encryption code using an encryption module having an encryption type and at least one of a secret key and a secret text;
selecting a position in the unique encryption code;
identifying a corresponding set of values at that position in the unique encryption code; and
generating a message that includes a value representing the position in the unique encryption code and the corresponding set of values at that position in the unique encryption code for use for a receiver of the packet to verify a sender of the message.
17. The information handling system of claim 16 wherein the step of generating a unique encryption code using an encryption module having an encryption type and at least one of a secret key and a secret text further comprises:
combining additional data with the secret text as an input when generating the unique encryption code.
18. The information handling system of claim 17 wherein the additional data comprises a Media Access Control of the sender of the message.
19. The information handling system of claim 16 wherein the non-transitory computer-readable medium or media further comprises one or more sets of instructions which, when executed by at least one of the one or more processors, causes steps to be performed comprising:
responsive to receiving a reply message, identifying in the reply message a second value indicating a second position and a corresponding set of values in a second unique encryption code;
generating the second unique encryption code using at least the secret key, the secret text, and the encryption module having the encryption type; and
determining whether the values at the second position in the second unique encryption code match the corresponding set of values in the reply message.
20. The information handling system of claim 19 wherein the non-transitory computer-readable medium or media further comprises one or more sets of instructions which, when executed by at least one of the one or more processors, causes steps to be performed comprising:
responsive to determining that the values at the second position in the second unique encryption code match the corresponding set of values in the reply message, adding a MAC address of a remote device that generated the reply message to a networking table as a verified device.
21. The information handling system of claim 19 wherein the non-transitory computer-readable medium or media further comprises one or more sets of instructions which, when executed by at least one of the one or more processors, causes steps to be performed comprising:
responsive to determining that the values at the second position in the second unique encryption code do not match the corresponding set of values in the reply message:
not adding a MAC address of a remote device that generated the reply message to a networking table as a verified device;
adding the MAC address of the remote device to a blocked list or an untrusted device list; or
both.