Transferring verifiable address rights between devices of a data center (DC) network
Techniques for transferring address rights (e.g., internet protocol address(es), media access control address(es), etc.) amongst devices in a data center network fabric. A data center (DC) authority (e.g., network controller and/or a service controller) of a data center network fabric may determine that a device in the network is to communicate on an address in the network. The DC authority may create and sign a token that indicates a verifiable authorization to communicate on the address. The token may allow any device that posses the token to communicate on the address, following verification from an associated network switch. Additionally, the token may be signed by a device in the network in possession of the token, and delegated to another device in the data center network fabric following a migration of a service from one server to another, for example.
1. A method comprising:
preventing a first server among servers in a data center fabric from communicating data from a range of addresses of a switch in the data center fabric, the switch providing switching services to the servers in the data center fabric;
determining that a service has been instantiated on the first server;
receiving a token at the first server, the token comprising a verifiable indication of authorization allowing the service to communicate from the range of addresses in the data center fabric;
sending one or more packets from the first server to the switch, the one or more packets including the token indicating the authorization allowing the service to communicate from the range of addresses;
communicating, by the first server, the data from a first address included in the range of addresses; and preventing the first server from communicating the data from a second address that is outside of the range of addresses.
2. The method of claim 1 , further comprising receiving the token from a network controller associated with the data center fabric, wherein the token is signed using a private key of the network controller.
3. The method of claim 1 , further comprising signing the token using a private key of the first server to generate a signed token, wherein sending the one or more packets includes sending the signed token.
4. The method of claim 1 , further comprising:
determining, by the first server, that the range of addresses is to be migrated to at least one of a different device or a different service;
signing, by the first server, an indication that the range of addresses is to be migrated to at least one of the different device or the different service; and
sending the indication into the data center fabric.
5. The method of claim 1 , further comprising:
determining, by the first server, that the range of addresses is to be migrated to at least one of a different device or a different service;
signing, by the first server, an indication that the range of addresses is to be migrated to at least one of the different device or the different service; and
sending the token to at least one of the different device or the different service.
6. The method of claim 5 , further comprising sending, to one or more devices associated with the data center fabric, an indication that the authorization to communicate from the range of addresses has been transferred to at least one of the different device or the different service.
7. The method of claim 1 , wherein the first address comprises at least one of an internet protocol (IP) address or a media access control (MAC) address.
8. A system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
preventing a first server among servers in a data center fabric from communicating data from a range of addresses of a switch in the data center fabric, the switch providing switching services to the servers in the data center fabric;
determining that a service has been instantiated on the first server;
receiving a token at the first server, the token comprising a verifiable indication of authorization allowing the service to communicate from a range of addresses in the data center fabric;
sending one or more packets from the first server to the switch in the data center fabric, the one or more packets including the token indicating the authorization allowing the service to communicate from the range of addresses;
communicating the data from a first address included in the range of addresses by the server; and
preventing the data from being communicated from a second address that is outside of the range of addresses.
9. The system of claim 8 , the operations further comprising receiving the token from a network controller associated with the data center fabric, wherein the token is signed using a private key of the network controller.
10. The system of claim 8 , the operations further comprising signing the token using a private key of the first server to generate a signed token, wherein sending the one or more packets includes sending the signed token.
11. The system of claim 8 , wherein the first address comprises at least one of an internet protocol (IP) address or a media access control (MAC) address.
12. The system of claim 8 , the operations further comprising:
determining, by the first server, that the range of addresses is to be migrated to at least one of a different device or a different service;
signing, by the first server, an indication that the range of addresses is to be migrated to at least one of the different device or the different service; and
sending the indication into the data center fabric.
13. The system of claim 8 , the operations further comprising:
determining, by the first server, that the range of addresses is to be migrated to at least one of a different device or a different service;
signing, by the first server, an indication that the range of addresses is to be migrated to at least one of the different device or the different service; and
sending the token to at least one of the different device or the different service.
14. The system of claim 13 , the operations further comprising sending, to one or more devices associated with the data center fabric, an indication that the authorization to communicate from the range of addresses has been transferred to at least one of the different device or the different service.
15. A method comprising:
allowing, by a network controller associated with a data center fabric, a switch in the data center fabric to provide switching services to servers in the data center fabric;
preventing, by the network controller, a first server in the data center fabric from communicating data from a range of addresses in the data center fabric;
determining, by the network controller associated with the data center fabric, that a service executing on the first server in the data center fabric is requesting to communicate from the range of addresses in the data center fabric;
signing a token indicating authorization allowing the service to communicate from the range of addresses; and
sending the token to the first server, the token being utilized by a switch in the data center fabric to (i) communicate the data from the first server from a first address included in the range of addresses on behalf of the service and (ii) prevent the service from communicating data from the first server from a second address that is outside of the range of addresses.
16. The method of claim 15 , wherein an address included in the range of addresses comprises at least one of an internet protocol (IP) address or a media access control (MAC) address.
17. The method of claim 15 , further comprising: receiving a request from the first server to transfer the authorization to communicate on the range of addresses to an additional second server in the data center fabric; signing an additional token indicating authorization to communicate from the range of addresses; and sending the additional token to the additional second server.
18. The method of claim 15 , wherein: receiving a request from the first server to transfer the authorization to communicate from the range of addresses to an additional a second server in the data center fabric; and sending, to one or more of the servers associated with the data center fabric, an indication that the authorization to communicate from the range of addresses is to be transferred from the first server to the additional second server.
19. The method of claim 15 , wherein signing the token comprises signing the token using a private key of the network controller.
20. The method of claim 15 , further comprising: determining, by the network controller, that the range of addresses is to be migrated to at least one of a different device or a different service; signing, by the network controller, an indication that the range of addresses is to be migrated to at least one of the different device or the different service; sending the indication into the data center fabric; and sending the token to at least one of the different device or the different service.