Infrastructure level LAN security
Techniques are disclosed for securing traffic flowing across multi-tenant virtualized infrastructures using group key-based encryption. In one embodiment, an encryption module of a virtual machine (VM) host intercepts layer 2 (L2) frames sent via a virtual NIC (vNIC). The encryption module determines whether the vNIC is connected to a “secure wire,” and invokes an API exposed by a key management module to encrypt the frames using a group key associated with the secure wire, if any. Encryption may be performed for all frames from the vNIC, or according to a policy. In one embodiment, the encryption module may be located at a layer farthest from the vNIC, and encryption may be transparent to both the VM and a virtual switch. Unauthorized network entities which lack the group key cannot decipher the data of encrypted frames, even if they gain access to such frames.
1. A method of providing encryption keys comprising:
generating first and second different encryption keys for first and second secure wires;
in response to a selection of a first machine to add to the first secure wire, associating an interface of the first machine with the first secure wire and using the first key at a first host computer on which the first machine executes in order for the first host computer to encrypt and decrypt messages exchanged between the first machine and a plurality of other machines connected to the first secure wire on at least a second host computer without the first host computer being required to negotiate any key for the first secure wire on a point-to-point basis with any other host computer including the second host computer; and
in response to a selection of a second machine to add to the second secure wire, associating an interface of the second machine with the second secure wire and using the second key at a third host computer on which the second machine executes in order for the third host computer to encrypt and decrypt messages exchanged between the second machine and a plurality of other machines connected to the second secure wire on at least a fourth host computer without the third host computer being required to negotiate any key for the second secure wire on a point-to-point basis with any other host computer including the fourth host computer.
2. The method of claim 1 , wherein each secure wire is established for a logical layer 2 (L2) network that stretches across Layer 3 (L3) boundaries.
3. The method of claim 2 further comprising receiving, for each secure wire, a selection of the logical L2 network on which the secure wire is to be enabled.
4. The method of claim 3 further comprising:
identifying, for each secure wire, a selection of two or more virtual network interface cards (vNICs) of two or more machines to add to the secure wire;
wherein using each encryption key comprises providing each encryption key to each host computer on which each identified vNIC for that key is defined.
5. The method of claim 1 , wherein each host computer encrypts the messages for a secure wire by:
identifying data messages sent by a machine connected to the first secure wire as the data messages are en route to a physical network interface card (pNIC) of the host computer; and
encrypting the identified intercepted data messages before supplying the encrypted data messages to a pNIC of the host computer.
6. The method of claim 5 , wherein each host computer includes with each of encrypted data message at least one of (i) a value which identifies the encryption key, (ii) an encoded encryption initialization vector value, and (iii) a signed hash value used to authenticate the encrypted data message and ensure data integrity.
7. The method of claim 5 , wherein the identified data messages are encrypted according to IEEE MAC Security Standard (MACSec) frame format.
8. The method of claim 5 , wherein the encrypting for each secure wire is performed based on one or more policies specifying which traffic has to be encrypted.
9. The method of claim 1 , wherein
the first and second encryption keys are generated by a management server, and
each encryption key is securely transmitted from the management server to two or more host computers.
10. The method of claim 1 , wherein the first secure wire is enabled on a virtual extensible LAN (VXLAN).
11. A non-transitory machine readable medium storing a program which when executed by at least one processing unit provides encryption keys, the program comprising sets of instructions for:
generating first and second different encryption keys for first and second secure wires;
in response to a selection of a first machine to add to the first secure wire, providing the first key to a first host computer on which the first machine executes in order for the first host computer to encrypt and decrypt messages exchanged between the first machine and a plurality of other machines connected to the first secure wire on at least a second host computer without the first host computer being required to negotiate any key for the first secure wire on a point-to-point basis with any other host computer including the second host computer; and
in response to a selection of a second machine to add to the second secure wire, providing the second key to a third host computer on which the second machine executes in order for the third host computer to encrypt and decrypt messages exchanged between the second machine and a plurality of other machines connected to the second secure wire on at least a fourth host computer without the third host computer being required to negotiate any key for the second secure wire on a point-to-point basis with any other host computer including the fourth host computer.
12. The non-transitory machine readable medium of claim 11 , wherein each secure wire is established for a logical layer 2 (L2) network that stretches across Layer 3 (L3) boundaries.
13. The non-transitory machine readable medium of claim 12 , the program further comprises a set of instructions for receiving, for each secure wire, a selection of the logical L2 network on which the secure wire is to be enabled.
14. The non-transitory machine readable medium of claim 13 , the program further comprises a set of instructions for:
identifying, for each secure wire, a selection of two or more virtual network interface cards (vNICs) of two or more machines to add to the secure wire;
wherein the set of instructions for providing each encryption key comprises a set of instructions for providing each encryption key to each host computer on which each identified vNIC for that key is defined.
15. The non-transitory machine readable medium of claim 11 , wherein each host computer encrypts the messages for a secure wire, the host computer comprises sets of instructions for:
identifying data messages sent by a machine connected to the first secure wire as the data messages are en route to a physical network interface card (pNIC) of the host computer; and
encrypting the identified intercepted data messages before supplying the encrypted data messages to a pNIC of the host computer.
16. The non-transitory machine readable medium of claim 15 , wherein each host computer includes with each of encrypted data message at least one of (i) a value which identifies the encryption key, (ii) an encoded encryption initialization vector value, and (iii) a signed hash value used to authenticate the encrypted data message and ensure data integrity.
17. The non-transitory machine readable medium of claim 15 , wherein the identified data messages are encrypted according to IEEE MAC Security Standard (MACSec) frame format.
18. The non-transitory machine readable medium of claim 15 , wherein the set of instructions for encrypting for each secure wire is performed based on one or more policies specifying which traffic has to be encrypted.
19. The non-transitory machine readable medium of claim 11 , wherein
the first and second encryption keys are generated by a management server, and
each encryption key is securely transmitted from the management server to two or more host computers.
20. The non-transitory machine readable medium of claim 11 , wherein the first secure wire is enabled on a virtual extensible LAN (VXLAN).