Enforcing a segmentation policy using cryptographic proof of identity
A segmentation server defines a segmentation policy and distributes the segmentation policy to be enforced by a plurality of operating system (OS) instances. The segmentation policy includes rules controlling which workloads executing on the OS instances can communicate with other workloads and controlling how the workloads may communicate. When a connection between two OS instances is requested, each OS instance provides an identity and a cryptographic proof of the identity. The OS instances each authenticate the identity received from the other OS instance, and once authenticated, determines based on the authenticated identities if the rules permit the communication. If the rules permit the communication, the OS instances obtain session parameters that enable the OS instances to validate integrity of the messages communicated between the workloads and optionally encrypt the messages.
1. A method for enforcing a segmentation policy comprising:
sending, by a first operating system instance executing on a first computing device, a connection request from a first workload executing on the first operating system to a second workload executing on a second operating system instance on a second computing device;
providing, by the first operating system instance to the second operating system instance, a first identity and a first cryptographic proof of the first identity;
receiving, from the second operating system instance at the first operating system instance, a second identity and a second cryptographic proof of the second identity;
authenticating, by the first operating system instance, the second identity received from the second operating system instance based on the second cryptographic proof of the second identity;
responsive to authenticating the second identity received from the second operating system instance, determining, based on the second identity, if the second workload executing on the second operating system instance is permitted to communicate with the first workload according to management instructions stored by the first operating system instance;
responsive to determining that the second workload is permitted to communicate with the first workload, obtaining session parameters for communicating between the first workload and the second workload, wherein obtaining the session parameters comprises:
obtaining a first session identifier associated with the first OS instance and a second session identifier associated with the second OS instance;
obtaining session keys; and
negotiating data path algorithms; and
communicating messages between the first workload and the second workload in accordance with the session parameters, wherein communicating the messages comprises:
receiving a message from the second workload, the message containing the second session identifier for the second OS instance and a hash value;
verifying the second session identifier for the second OS instance; and
verifying the hash value based on the session keys to confirm integrity of the message.
2. The method of claim 1 , further comprising:
receiving, by the first operating system instance, one or more rules permitting communication between the first workload and one or more groups of workloads;
receiving membership information by the first operating system instance identifying workloads in the one or more groups; and
programming an enforcement mechanism of the first operating system to enable the first workload to communicate with each of the identified workloads in the one or more groups in accordance with the one or more rules.
3. The method of claim 2 , wherein the one or more rules identify the one or more groups of workloads by labels each describing a high-level characteristic of the one or more workloads in each group.
4. The method of claim 1 , wherein authenticating the second identity of the second operating system instance comprises:
obtaining a digital certificate associated with the second identity, the digital certificate including an identifier for the second identity, a public key associated with the second identity, and a digital signature;
verifying the digital signature to validate authenticity of the digital certificate; and
verifying the second proof of the second identity using the public key associated with the second identity in the digital certificate.
5. The method of claim 1 , wherein communicating the messages comprises:
encrypting transmitted messages using the session keys; and
decrypting received messages using the session keys.
6. The method of claim 1 , wherein the first identity comprises a machine identity for the first operating system.
7. The method of claim 1 , wherein the first identity comprises a user identity for a user logged into the first operating system.
8. A non-transitory computer-readable storage medium storing instructions for enforcing a segmentation policy, the instructions when executed by one or more processor causing the one or more processors to perform steps comprising:
sending, by a first operating system instance executing on a first computing device, a connection request from a first workload executing on the first operating system to a second workload executing on a second operating system instance on a second computing device;
providing, by the first operating system instance to the second operating system instance, a first identity and a first cryptographic proof of the first identity;
receiving, from the second operating system instance at the first operating system instance, a second identity and a second cryptographic proof of the second identity;
authenticating, by the first operating system instance, the second identity received from the second operating system instance based on the second cryptographic proof of the second identity;
responsive to authenticating the second identity received from the second operating system instance, determining, based on the second identity, if the second workload executing on the second operating system instance is permitted to communicate with the first workload according to management instructions stored by the first operating system instance;
responsive to determining that the second workload is permitted to communicate with the first workload, obtaining session parameters for communicating between the first workload and the second workload, wherein obtaining the session parameters comprises:
obtaining a first session identifier associated with the first OS instance and a second session identifier associated with the second OS instance;
obtaining session keys; and
negotiating data path algorithms; and
communicating messages between the first workload and the second workload in accordance with the session parameters, wherein communicating the messages comprises:
receiving a message from the second workload, the message containing the second session identifier for the second OS instance and a hash value;
verifying the second session identifier for the second OS instance; and
verifying the hash value based on the session keys to confirm integrity of the message.
9. The non-transitory computer-readable storage medium of claim 8 , the steps further comprising:
receiving, by the first operating system instance, one or more rules permitting communication between the first workload and one or more groups of workloads;
receiving membership information by the first operating system instance identifying workloads in the one or more groups; and
programming an enforcement mechanism of the first operating system to enable the first workload to communicate with each of the identified workloads in the one or more groups in accordance with the one or more rules.
10. The non-transitory computer-readable storage medium of claim 9 , wherein the one or more rules identify the one or more groups of workloads by labels each describing a high-level characteristic of the one or more workloads in each group.
11. The non-transitory computer-readable storage medium of claim 8 , wherein authenticating the second identity of the second operating system instance comprises:
obtaining a digital certificate associated with the second identity, the digital certificate including an identifier for the second identity, a public key associated with the second identity, and a digital signature;
verifying the digital signature to validate authenticity of the digital certificate; and verifying the second proof of the second identity using the public key associated with the
second identity in the digital certificate.
12. The non-transitory computer-readable storage medium of claim 8 , wherein communicating the messages comprises:
encrypting transmitted messages using the session keys; and
decrypting received messages using the session keys.
13. The non-transitory computer-readable storage medium of claim 8 , wherein the first identity comprises a machine identity for the first operating system.
14. The non-transitory computer-readable storage medium of claim 8 , wherein the first identity comprises a user identity for a user logged into the first operating system.
15. A computing device comprising:
one or more processors; and
a non-transitory computer-readable storage medium storing instructions for enforcing a segmentation policy, the instructions when executed by the one or more processor causing the one or more processors to perform steps comprising:
sending, by a first operating system instance executing on a first computing device, a connection request from a first workload executing on the first operating system to a second workload executing on a second operating system instance on a second computing device;
providing, by the first operating system instance to the second operating system instance, a first identity and a first cryptographic proof of the first identity;
receiving, from the second operating system instance at the first operating system instance, a second identity and a second cryptographic proof of the second identity;
authenticating, by the first operating system instance, the second identity received from the second operating system instance based on the second cryptographic proof of the second identity;
responsive to authenticating the second identity received from the second operating system instance, determining, based on the second identity, if the second workload executing on the second operating system instance is permitted to communicate with the first workload according to management instructions stored by the first operating system instance;
responsive to determining that the second workload is permitted to communicate with the first workload, obtaining session parameters for communicating between the first workload and the second workload, wherein obtaining the session parameters comprises:
obtaining a first session identifier associated with the first OS instance and a second session identifier associated with the second OS instance;
obtaining session keys; and
negotiating data path algorithms; and
communicating messages between the first workload and the second workload in accordance with the session parameters, wherein communicating the messages comprises:
receiving a message from the second workload, the message containing the second session identifier for the second OS instance and a hash value;
verifying the second session identifier for the second OS instance; and
verifying the hash value based on the session keys to confirm integrity of the message.
16. The computing device of claim 15 , the steps further comprising:
receiving, by the first operating system instance, one or more rules permitting communication between the first workload and one or more groups of workloads;
receiving membership information by the first operating system instance identifying
workloads in the one or more groups; and
programming an enforcement mechanism of the first operating system to enable the first workload to communicate with each of the identified workloads in the one or more groups in accordance with the one or more rules.
17. The computing device of claim 16 , wherein the one or more rules identify the one or more groups of workloads by labels each describing a high-level characteristic of the one or more workloads in each group.
18. The computing device of claim 15 , wherein authenticating the second identity of the second operating system instance comprises:
obtaining a digital certificate associated with the second identity, the digital certificate including an identifier for the second identity, a public key associated with the second identity, and a digital signature;
verifying the digital signature to validate authenticity of the digital certificate; and
verifying the second proof of the second identity using the public key associated with the second identity in the digital certificate.
19. The computing device of claim 15 , wherein communicating the messages comprises:
encrypting transmitted messages using the session keys; and
decrypting received messages using the session keys.
20. The computing device of claim 15 , wherein the first identity comprises a machine identity for the first operating system.
21. The computing device of claim 15 , wherein the first identity comprises a user identity for a user logged into the first operating system.