Managing encryption keys of secure tunnels in multi-tenant edge devices
Disclosed are systems, apparatuses, methods, computer readable medium, and circuits for managing encryption keys in a multi-tenant network edge device. According to at least one example, a method includes: receiving tenant resource information at the multi-tenant network edge device; generating at least one parent encryption key; generating a plurality of child encryption keys; creating a routing connection to a network controller for each tenant in the plurality of tenants; transmitting the at least one parent encryption key and the plurality of child encryption keys to the network controller for distribution to the plurality of tenants; receiving a plurality of advertisements of transport locators from the network controller, wherein each advertisement includes a parent encryption key or a child encryption key; selecting a set of encryption keys from the plurality of advertisements; and forming a secure tunnel.
1. A method for managing encryption keys in a multi-tenant network edge device, the method comprising:
receiving tenant resource information at the multi-tenant network edge device, wherein the multi-tenant network edge device is configured to send and receive network data for a plurality of tenants, and wherein the tenant resource information includes at least one network transport interface for a first tenant;
generating at least one parent encryption key based on a number of network interfaces supported by the plurality of tenants;
generating a plurality of child encryption keys, wherein at least one child encryption key is generated for each tenant in the plurality of tenants;
creating a routing connection to a network controller for each tenant in the plurality of tenants;
transmitting the at least one parent encryption key and the plurality of child encryption keys to the network controller for distribution to the plurality of tenants;
receiving a plurality of advertisements of transport locators from the network controller, wherein each advertisement includes a parent encryption key or a child encryption key;
selecting a set of encryption keys from the plurality of advertisements; and
forming a secure tunnel with each tenant of the plurality of tenants using child encryption keys included in the set of encryption keys.
2. The method of claim 1 , wherein the set of encryption keys is based on the number of tenants and the number of network interfaces.
3. The method of claim 1 , further comprising:
configuring a secure tunnel with another multi-tenant network edge device based on a parent encryption key and a key received from the another multi-tenant network edge device.
4. The method of claim 1 , wherein each transport locator in the plurality of advertisements includes a key type, a security parameter index, and a sequence number.
5. The method of claim 4 , wherein the set of encryption keys is selected based on a largest sequence number for the first tenant in the event multiple encryption keys for the first tenant are received.
6. The method of claim 1 , wherein each tenant is configured to interface with the multi-tenant network edge device using a different encryption key for each interface.
7. The method of claim 6 , wherein the network controller is configured to advertise the at least one parent encryption key to the multi-tenant network edge device and advertise the plurality of child encryption keys to the plurality of tenants.
8. A multi-tenant network edge device for managing encryption keys, comprising:
a storage configured to store instructions; and
a processor configured to execute the instructions and cause the processor to:
receive tenant resource information at the multi-tenant network edge device, wherein the multi-tenant network edge device is configured to send and receive network data for a plurality of tenants, and wherein the tenant resource information includes at least one network transport interface for a first tenant;
generate at least one parent encryption key based on a number of network interfaces supported by the plurality of tenants;
generate a plurality of child encryption keys, wherein at least one child encryption key is generated for each tenant in the plurality of tenants;
create a routing connection to a network controller for each tenant in the plurality of tenants;
transmit the at least one parent encryption key and the plurality of child encryption keys to the network controller for distribution to the plurality of tenants;
receive a plurality of advertisements of transport locators from the network controller, wherein each advertisement includes a parent encryption key or a child encryption key;
select a set of encryption keys from the plurality of advertisements; and
form a secure tunnel with each tenant of the plurality of tenants using child encryption keys included in the set of encryption keys.
9. The multi-tenant network edge device of claim 8 , wherein the set of encryption keys is based on the number of tenants and the number of network interfaces.
10. The multi-tenant network edge device of claim 8 , wherein the processor is configured to execute the instructions and cause the processor to: configure a secure tunnel with another multi-tenant network edge device based on a parent encryption key and a key received from the another multi-tenant network edge device.
11. The multi-tenant network edge device of claim 8 , wherein each transport locator in the plurality of advertisements includes a key type, a security parameter index, and a sequence number.
12. The multi-tenant network edge device of claim 11 , wherein the set of encryption keys is selected based on a largest sequence number for the first tenant in the event multiple encryption keys for the first tenant are received.
13. The multi-tenant network edge device of claim 8 , wherein each tenant is configured to interface with the multi-tenant network edge device using a different encryption key for each interface.
14. The multi-tenant network edge device of claim 12 , wherein the network controller is configured to advertise the at least one parent encryption key to the multi-tenant network edge device and advertise the plurality of child encryption keys to the plurality of tenants.
15. A non-transitory computer readable medium comprising instructions, the instructions, when executed by a computing system, cause the computing system to:
receive tenant resource information at a multi-tenant network edge device, wherein the multi-tenant network edge device is configured to send and receive network data for a plurality of tenants, and wherein the tenant resource information includes at least one network transport interface for a first tenant;
generate at least one parent encryption key based on a number of network interfaces supported by the plurality of tenants;
generate a plurality of child encryption keys, wherein at least one child encryption key is generated for each tenant in the plurality of tenants;
create a routing connection to a network controller for each tenant in the plurality of tenants;
transmit the at least one parent encryption key and the plurality of child encryption keys to the network controller for distribution to the plurality of tenants;
receive a plurality of advertisements of transport locators from the network controller, wherein each advertisement includes a parent encryption key or a child encryption key;
select a set of encryption keys from the plurality of advertisements; and
form a secure tunnel with each tenant of the plurality of tenants using child encryption keys included in the set of encryption keys.
16. The computer readable medium of claim 15 , wherein the set of encryption keys is based on the number of tenants and the number of network interfaces.
17. The computer readable medium of claim 15 , wherein the computer readable medium further comprises instructions that, when executed by the computing system, cause the computing system to: configure a secure tunnel with another multi-tenant network edge device based on a parent encryption key and a key received from the another multi-tenant network edge device.
18. The computer readable medium of claim 15 , each transport locator in the plurality of advertisements includes a key type, a security parameter index, and a sequence number.
19. The computer readable medium of claim 15 , wherein each tenant is configured to interface with the multi-tenant network edge device using a different encryption key for each interface.
20. The computer readable medium of claim 19 , wherein the network controller is configured to advertise the at least one parent encryption key to the multi-tenant network edge device and advertise the plurality of child encryption keys to the plurality of tenants.