Techniques for secure intra-node communication between edge devices
Techniques are described for implementing secure communications between edge devices providing cloud computing services in an edge environment. A computing cluster can include a plurality of cloud-computing edge devices. The computing cluster can implement a distributed control plane for performing operations related to managing cloud infrastructure resources within the computing cluster. The cloud-computing edge devices can be connected to an intra-node switch to form a substrate network. The data related to control plane operations may be transmitted over the substrate from one edge device to another, such that control plane operations can be performed at any suitable edge device in the cluster. The edge devices can use an encryption protocol to encrypt the data transmitted over the substrate network via the intra-node switch.
1. A computer-implemented method, comprising:
implementing, by a computing cluster comprising a plurality of cloud-computing edge devices, a distributed control plane in which each of the plurality of cloud-computing edge devices is configured to provision and manage cloud infrastructure resources of the computing cluster independent from communicating with a device that is external to the computing cluster, the plurality of cloud-computing edge devices being communicatively connected to one another via an intra-node switch of the computing cluster, each of the plurality of cloud-computing edge devices being individually configured to encrypt or decrypt control plane data transmitted via the intra-node switch based at least in part on each of the plurality of cloud-computing edge devices being previously provisioned with encryption keys and a root certificate for the computing cluster;
generating, by a first cloud-computing edge device of the distributed control plane, a message comprising data related to control plane operations corresponding to a first resource of the cloud infrastructure resources of the computing cluster;
generating, by the first cloud-computing edge device of the distributed control plane and based at least in part on an encryption protocol and a first data encryption key of the encryption keys provisioned on the first cloud-computing edge device, an encrypted message from the message comprising the data related to the control plane operations corresponding to the first resource of the cloud infrastructure resources of the computing cluster;
authenticating, by the first cloud-computing edge device using the root certificate, a second cloud-computing edge device of the distributed control plane;
responsive to the authentication, transmitting, by the first cloud-computing edge device to the second cloud-computing edge device of the distributed control plane, the encrypted message via the intra-node switch;
decrypting, by the second cloud-computing edge device using a second data encryption key of the encryption keys provisioned on the second cloud-computing edge device, the encrypted message to obtain the data related to the control plane operations corresponding to the first resource of the cloud infrastructure resources of the computing cluster; and
based at least in part on obtaining the data related to the control plane operations that correspond to the first resource of the cloud infrastructure resources of the computing cluster, executing, by the second cloud-computing edge device, an operation for provisioning or managing the first resource of the cloud infrastructure resources of the computing cluster.
2. The computer-implemented method of claim 1 , wherein the plurality of cloud-computing edge devices are communicatively connected to a client switch, and further comprising:
receiving, from the client switch at the first cloud-computing edge device, an additional message initiated from a client device, the additional message being encrypted with a second encryption protocol;
decrypting, by the first cloud-computing edge device and using the second encryption protocol, the additional message to obtain message data; and
executing, by the first cloud-computing edge device, one or more operations based at least in part on the message data obtained.
3. The computer-implemented method of claim 1 , wherein the first data encryption key is stored in a key storage at the first cloud-computing edge device, the first data encryption key encrypted with a third encryption protocol comprising a master key, the master key stored at a trusted platform module of the first cloud-computing edge device.
4. The computer-implemented method of claim 3 , further comprising:
retrieving, by the first cloud-computing edge device, the first data encryption key from the key storage; and
decrypting, by the trusted platform module, the first data encryption key using the master key.
5. The computer-implemented method of claim 2 , wherein the encryption protocol is different from the second encryption protocol.
6. The computer-implemented method of claim 1 , wherein the encryption protocol is a media access control security protocol.
7. A computing cluster, comprising:
an intra-node switch;
a plurality of cloud-computing edge devices communicatively connected to one another via the intra-node switch, the plurality of cloud-computing edge devices comprising one or more processors and one or more memories storing computer-executable instructions that, when executed with the one or more processors, cause the computing cluster to:
implement a distributed control plane in which each of the plurality of cloud-computing edge devices is configured to provision and manage cloud infrastructure resources of the computing cluster independent from communicating with a device that is external to the computing cluster, each of the plurality of cloud-computing edge devices being individually configured to encrypt or decrypt control plane data transmitted via the intra-node switch based at least in part on each of the plurality of cloud-computing edge devices being previously provisioned with encryption keys and a root certificate for the computing cluster;
generate, by a first cloud-computing edge device of the distributed control plane, a message comprising data related to control plane operations corresponding to a first resource of the cloud infrastructure resources of the computing cluster;
generate, by the first cloud-computing edge device of the distributed control plane and based at least in part on an encryption protocol and a first data encryption key of the encryption keys provisioned on the first cloud-computing edge device, an encrypted message from the message comprising the data related to the control plane operations corresponding to the first resource of the cloud infrastructure resources of the computing cluster;
authenticate, by the first cloud-computing edge device using the root certificate, a second cloud-computing edge device of the distributed control plane;
responsive to the authentication, transmit, by the first cloud-computing edge device to the second cloud-computing edge device of the distributed control plane, the encrypted message via the intra-node switch;
decrypt, by the second cloud-computing edge device using a second data encryption key of the encryption keys provisioned on the second cloud-computing edge device, the encrypted message to obtain the data related to the control plane operations corresponding to the first resource of the cloud infrastructure resources of the computing cluster; and
based at least in part on obtaining the data related to the control plane operations that correspond to the first resource of the cloud infrastructure resources of the computing cluster, execute, by the second cloud-computing edge device, an operation for provisioning or managing the first resource of the cloud infrastructure resources of the computing cluster.
8. The computing cluster of claim 7 , wherein the plurality of cloud-computing edge devices are communicatively connected to a client switch, and wherein the one or more memories store further instructions that, when executed by the one or more processors, cause the computing cluster to further:
receive, from the client switch at the first cloud-computing edge device, an additional message initiated from a client device, the additional message being encrypted with a second encryption protocol;
decrypt, by the first cloud-computing edge device and using the second encryption protocol, the additional message to obtain message data; and
execute, by the first cloud-computing edge device, one or more operations based at least in part on the message data obtained.
9. The computing cluster of claim 7 , wherein the first data encryption key stored in a key storage at the first cloud-computing edge device, the first data encryption key encrypted with a third encryption protocol comprising a master key, the master key stored at a trusted platform module of the first cloud-computing edge device.
10. The computing cluster of claim 9 , wherein the one or more memories store further instructions that, when executed by the one or more processors, cause the computing cluster to further:
retrieve, by the first cloud-computing edge device, the first data encryption key from the key storage; and
decrypt, by the trusted platform module, the first data encryption key using the master key.
11. The computing cluster of claim 8 , wherein the encryption protocol is different from the second encryption protocol.
12. The computing cluster of claim 7 , wherein the encryption protocol is a media access control security protocol.
13. A non-transitory computer-readable storage medium comprising executable instructions that, when executed by one or more processors of a computing cluster comprising a plurality of cloud-computing edge devices, cause the computing cluster to:
implement a distributed control plane in which each of the plurality of cloud-computing edge devices is configured to provision and manage cloud infrastructure resources of the computing cluster independent from communicating with a device that is external to the computing cluster, the plurality of cloud-computing edge devices being communicatively connected to one another via an intra-node switch of the computing cluster, each of the plurality of cloud-computing edge devices being individually configured to encrypt or decrypt control plane data transmitted via the intra-node switch based at least in part on each of the plurality of cloud-computing edge devices being previously provisioned with encryption keys and a root certificate for the computing cluster;
generate, by a first cloud-computing edge device of the distributed control plane, a message comprising data related to control plane operations corresponding to a first resource of the cloud infrastructure resources of the computing cluster;
generate, by the first cloud-computing edge device of the distributed control plane and based at least in part on an encryption protocol and a first data encryption key of the encryption keys provisioned on the first cloud-computing edge device, an encrypted message from the message comprising the data related to the control plane operations corresponding to the first resource of the cloud infrastructure resources of the computing cluster;
authenticate, by the first cloud-computing edge device using the root certificate, a second cloud-computing edge device of the distributed control plane;
responsive to the authentication, transmit, by the first cloud-computing edge device to the second cloud-computing edge device of the distributed control plane, the encrypted message via the intra-node switch;
decrypt, by the second cloud-computing edge device using a second data encryption key of the encryption keys provisioned on the second cloud-computing edge device, the encrypted message to obtain the data related to the control plane operations corresponding to the first resource of the cloud infrastructure resources of the computing cluster; and
based at least in part on obtaining the data related to the control plane operations that correspond to the first resource of the cloud infrastructure resources of the computing cluster, execute, by the second cloud-computing edge device, an operation for provisioning or managing the first resource of the cloud infrastructure resources of the computing cluster.
14. The non-transitory computer-readable storage medium of claim 13 , wherein the plurality of cloud-computing edge devices are communicatively connected to a client switch, and further comprising additional instructions that, when executed by the one or more processors, cause the computing cluster to further:
receive, from the client switch at the first cloud-computing edge device, an additional message initiated from a client device, the additional message being encrypted with a second encryption protocol;
decrypt, by the first cloud-computing edge device and using the second encryption protocol, the additional message to obtain message data; and
execute, by the first cloud-computing edge device, one or more operations based at least in part on the message data obtained.
15. The non-transitory computer-readable storage medium of claim 13 , wherein the first data encryption key stored in a key storage at the first cloud-computing edge device, the first data encryption key encrypted with a third encryption protocol comprising a master key, the master key stored at a trusted platform module of the first cloud-computing edge device.
16. The non-transitory computer-readable storage medium of claim 15 , further comprising additional instructions that, when executed by the one or more processors, cause the computing cluster to further:
retrieve, by the first cloud-computing edge device, the first data encryption key from the key storage; and
decrypt, by the trusted platform module, the first data encryption key using the master key.
17. The non-transitory computer-readable storage medium of claim 13 , wherein the encryption protocol is a media access control security protocol.
18. The computer-implemented method of claim 1 , wherein the first data encryption key and the second data encryption key are the same.
19. The computing cluster of claim 7 , wherein the first data encryption key and the second data encryption key are the same.
20. The non-transitory computer-readable storage medium of claim 13 , wherein the first data encryption key and the second data encryption key are the same.