Secure communications among tenant virtual machines in a cloud networking environment

1. A method comprising:

creating a first encryption key associated with a first tenant;

configuring the first encryption key in a host where a virtual machine associated with the first tenant is executing, the host including a network interface controller configured to have a virtual network interface function, the virtual network interface function executing on the host and being associated with the virtual machine of the first tenant;

causing the virtual network interface function to bind the first encryption key to the virtual machine of the first tenant;

causing the virtual network interface function to encrypt outgoing network traffic of the first tenant using the first encryption key;

causing the virtual network interface function to decrypt incoming network traffic for the first tenant using the first encryption key;

creating a second encryption key associated with the first tenant;

sending, to the host, the second encryption key;

causing the virtual network interface function to unbind the first encryption key to the virtual machine and bind the second encryption key to the virtual machine;

causing the virtual network interface function to encrypt outgoing network traffic of the first tenant using the second encryption key; and

causing the virtual network interface function to decrypt incoming network traffic for the first tenant using the second encryption key.

2. The method of claim 1 , further comprising:

creating a third encryption key associated with the first tenant;

sending, to the host, the third encryption key;

sending, to the host, an effectiveness time associated with the third encryption key;

causing, at the effectiveness time, the virtual network interface function to unbind the first encryption key to the virtual machine and bind the second encryption key to the virtual machine;

causing, at the effectiveness time, the virtual network interface function to encrypt outgoing network traffic of the first tenant using the second encryption key; and

causing, at the effectiveness time, the virtual network interface function to decrypt incoming network traffic for the first tenant using the second encryption key.

3. The method of claim 1 , further comprising:

sending, to the host, a message revoking the first encryption key, the revoking message rendering the first encryption key invalid for encrypting and decrypting network traffic.

4. The method of claim 1 , further comprising:

identifying, using network activity analysis, a second virtual machine requiring a quarantine, the second virtual machine executing on the host and associated with the first tenant;

creating a fourth encryption key associated with the first tenant;

sending, to the host, the fourth encryption key;

causing the virtual network interface function to unbind the first encryption key to the virtual machine and bind the fourth encryption key to the virtual machine,

causing the virtual network interface function to encrypt outgoing network traffic of the first tenant using the fourth encryption key;

causing the virtual network interface function to decrypt incoming network traffic for the first tenant using the fourth encryption key;

causing a second virtual network interface function executing on the host and associated with the second virtual machine to encrypt outgoing network traffic of the first tenant using the first encryption key; and

causing the second virtual network interface function to decrypt incoming network traffic for the first tenant using the first encryption key.

5. The method of claim 1 , wherein network traffic comprises an encrypted portion encrypted using the first encryption key, an unencrypted packet identification portion, and an unencrypted flow identification portion.

6. The method of claim 1 , wherein the first encryption key is created according to a policy of the first tenant.

7. A computer usable program product comprising one or more computer-readable storage devices, and program instructions stored on at least one of the one or more storage devices, the stored program instructions comprising:

program instructions to create a first encryption key associated with a first tenant;

program instructions to configure the first encryption key in a host where a virtual machine associated with the first tenant is executing, the host including a network interface controller configured to have a virtual network interface function, the virtual network interface function executing on the host and being associated with the virtual machine of the first tenant;

program instructions to cause the virtual network interface function to bind the first encryption key to the virtual machine;

program instructions to cause the virtual network interface function to encrypt outgoing network traffic of the first tenant using the first encryption key;

program instructions to cause the virtual network interface function to decrypt incoming network traffic for the first tenant using the first encryption key;

program instructions to create a second encryption key associated with the first tenant;

program instructions to send, to the host, the second encryption key;

program instructions to cause the virtual network interface function to unbind the first encryption key to the virtual machine and bind the second encryption key to the virtual machine;

program instructions to cause the virtual network interface function to encrypt outgoing network traffic of the first tenant using the second encryption key; and

program instructions to cause the virtual network interface function to decrypt incoming network traffic for the first tenant using the second encryption key.

8. The computer usable program product of claim 7 , further comprising:

program instructions to create a third encryption key associated with the first tenant;

program instructions to send, to the host, the third encryption key;

program instructions to send, to the host, an effectiveness time associated with the third encryption key;

program instructions to cause, at the effectiveness time, the virtual network interface function to unbind the first encryption key to the virtual machine and bind the second encryption key to the virtual machine;

program instructions to cause, at the effectiveness time, the virtual network interface function to encrypt outgoing network traffic of the first tenant using the second encryption key; and

program instructions to cause, at the effectiveness time, the virtual network interface function to decrypt incoming network traffic for the first tenant using the second encryption key.

9. The computer usable program product of claim 7 , further comprising:

program instructions to send, to the host, a message revoking the first encryption key, the revoking message rendering the first encryption key invalid for encrypting and decrypting network traffic.

10. The computer usable program product of claim 7 , further comprising:

program instructions to identifying, using network activity analysis, a second virtual machine requiring a quarantine, the second virtual machine executing on the host and associated with the first tenant;

program instructions to create a fourth encryption key associated with the first tenant;

program instructions to send, to the host, the fourth encryption key;

program instructions to cause the virtual network interface function to unbind the first encryption key to the virtual machine and bind the fourth encryption key to the virtual machine,

program instructions to cause the virtual network interface function to encrypt outgoing network traffic of the first tenant using the fourth encryption key;

program instructions to cause the virtual network interface function to decrypt incoming network traffic for the first tenant using the fourth encryption key;

program instructions to cause a second virtual network interface function executing on the host and associated with the second virtual machine to encrypt outgoing network traffic of the first tenant using the first encryption key; and

program instructions to cause the second virtual network interface function to decrypt incoming network traffic for the first tenant using the first encryption key.

11. The computer usable program product of claim 7 , wherein network traffic comprises an encrypted portion encrypted using the first encryption key, an unencrypted packet identification portion, and an unencrypted flow identification portion.

12. The computer usable program product of claim 7 , wherein the first encryption key is created according to a policy of the first tenant.

13. The computer usable program product of claim 7 , wherein the computer usable code is stored in a computer readable storage device in a data processing system, and wherein the computer usable code is transferred over a network from a remote data processing system.

14. The computer usable program product of claim 7 , wherein the computer usable code is stored in a computer readable storage device in a server data processing system, and wherein the computer usable code is downloaded over a network to a remote data processing system for use in a computer readable storage device associated with the remote data processing system.

15. A computer system comprising one or more processors, one or more computer-readable memories, and one or more computer-readable storage devices, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the stored program instructions comprising:

program instructions to create a first encryption key associated with a first tenant;

program instructions to configure the first encryption key in a host where a virtual machine associated with the first tenant is executing, the host including a network interface controller configured to have a virtual network interface function, the virtual network interface function executing on the host and being associated with the virtual machine of the first tenant;

program instructions to cause the virtual network interface function to bind the first encryption key to the virtual machine;

program instructions to cause the virtual network interface function to encrypt outgoing network traffic of the first tenant using the first encryption key;

program instructions to cause the virtual network interface function to decrypt incoming network traffic for the first tenant using the first encryption key;

program instructions to create a second encryption key associated with the first tenant;

program instructions to send, to the host, the second encryption key;

program instructions to cause the virtual network interface function to unbind the first encryption key to the virtual machine and bind the second encryption key to the virtual machine;

program instructions to cause the virtual network interface function to encrypt outgoing network traffic of the first tenant using the second encryption key; and

program instructions to cause the virtual network interface function to decrypt incoming network traffic for the first tenant using the second encryption key.

16. The system of claim 15 , further comprising:

program instructions to create a third encryption key associated with the first tenant;

program instructions to send, to the host, the third encryption key;

program instructions to send, to the host, an effectiveness time associated with the third encryption key;

program instructions to cause, at the effectiveness time, the virtual network interface function to unbind the first encryption key to the virtual machine and bind the second encryption key to the virtual machine;

program instructions to cause, at the effectiveness time, the virtual network interface function to encrypt outgoing network traffic of the first tenant using the second encryption key; and

program instructions to cause, at the effectiveness time, the virtual network interface function to decrypt incoming network traffic for the first tenant using the second encryption key.

17. The system of claim 15 , further comprising:

program instructions to send, to the host, a message revoking the first encryption key, the revoking message rendering the first encryption key invalid for encrypting and decrypting network traffic.