Securing an overlay network against attack
The techniques herein provide for enhanced overlay network-based transport of traffic, such as IPsec traffic, e.g., to and from customer branch office locations, facilitated through the use of the Internet-based overlay routing infrastructure. This disclosure describes a method of providing integrity protection for traffic on the overlay network.
1. A method operative in an overlay network configured to provide UDP-based packet transport across the publicly-routed Internet between and among regions of co-located servers, the regions comprising at least one ingress edge region, and at least one egress gateway region, comprising:
associating a private key pair to each region of co-located servers;
deriving a shared secret across a pair of regions, the region pair operating according to a trust scheme;
using the shared secret to generate a key;
using the key and additional data to compute an integrity check value (ICV), wherein the integrity check value is unique to the region pair; and
incorporating the ICV into an overlay network packet header associated with each data packet communicated between the region pair during a flow.
2. The method as described in claim 1 further including:
receiving the data packet at a machine in the region pair;
determining whether ICV is valid; and
forwarding the data packet at least in part upon a determination that the ICV is valid.
3. The method as described in claim 1 wherein the region pair comprises the ingress edge region and the egress gateway region, and wherein the data packet is associated with the flow between these regions.
4. The method as described in claim 3 wherein the flow is a unidirectional UDP connection between a machine in the ingress edge region, and a machine in the egress gateway region.
5. The method as described in claim 1 wherein the flow also passes through one or more additional regions.
6. The method as described in claim 1 wherein the other data comprises source and destination Internet Protocol (IP) addresses, and data derived from one or more data fields of the overlay network packet header.
7. The method as described in claim 1 wherein the shared secret is derived by the ingress edge region using a private key of the ingress edge region, and a public key of the egress gateway region, and wherein the shared secret is derived by the egress edge region using a private key of the egress edge region and the public key of the ingress edge region.
8. The method as described in claim 1 wherein the trust scheme comprises a set of trust levels, wherein at least a first trust level in the set has a different degree of trust as compared to a second trust level.
9. The method as described in claim 1 wherein the region pair comprises a collection of regions in the overlay network that are managed according to a same trust level in the trust scheme.
10. The method as described in claim 9 wherein associating the private key pair ensures that a region cannot impersonate another region outside of its trust level.