End-to-end network encryption from customer on-premise network to customer virtual cloud network using customer-managed keys
For end-to-end encryption of a virtual cloud network, a VPN tunnel from a customer device is terminated at a host network headend device using encryption keys secured in hardware and managed by the customer. The network headend device can be a card in a bare-metal server with one or more network virtualization devices. The network headend device is configured to receive a first key provisioned by a customer; receive a first data packet sent from a device of the customer; and decrypt the first data packet using the first key to obtain information. A network virtualization device is configured to receive the information from the network headend device; ascertain that the information is to be sent to a virtual machine in a virtual cloud network; ascertain that data in the virtual cloud network is configured to be encrypted; and encrypt the information with a second key to generate a second data packet before routing the second data packet to the virtual machine.
1 . A system comprising:
a network headend device comprising memory and providing an endpoint for a secured transmission link located within a virtual cloud network (“VCN”), wherein the network headend device is configured-to:
receive a first key provisioned by a customer;
receive a first data packet sent from a device of the customer; and
decrypt the first data packet using the first key to obtain information; and
a network virtualization device comprising memory, wherein the network virtualization device is configured to:
receive the information from the network headend device;
ascertain that the information is to be sent to a destination in the VCN;
generate a second data packet, wherein the second data packet comprises the information encrypted using a second key; and
route the second data packet to the destination in the VCN.
2 . The system of claim 1 , wherein the system is maintained by a host, and the host does not have access to the first key or the second key.
3 . The system of claim 1 , wherein both the network headend device and the network virtualization device are comprised in a VCN gateway associated with the VCN.
4 . The system of claim 3 , wherein the VCN gateway comprises a processor.
5 . The system of claim 3 , wherein the VCN gateway comprises a first network card associated with the VCN headend and a second network card associated with the network virtualization device.
6 . The system of claim 3 , wherein the VCN gateway is dedicated to the customer.
7 . The system of claim 3 , wherein the VCN headend and the network virtualization device share at least one of: a network card; a rack; or a room.
8 . The system of claim 3 , wherein the VCN gateway is configured to terminate an Internet Protocol SECurity (IPSec) tunnel.
9 . The system of claim 1 , wherein the network headend device is configured to be a termination point of an internet protocol security (IPSec) tunnel formed between the network headend device and a customer device.
10 . The system of claim 1 , wherein the first data packet is routed through the public Internet.
11 . The system of claim 1 , wherein the first data packet is routed through a set of private links, without using links in the public Internet.
12 . The system of claim 1 , wherein the destination in the VCN comprises a virtual machine.
13 . The system of claim 12 , wherein the network virtualization device supports the virtual machine in the virtual cloud network.
14 . The system of claim 1 , wherein the network headend device is dedicated to the customer, such that no other customers of a host use the network headend device.
15 . The system of claim 1 , wherein the network headend device is a first network headend device and the system further comprises a second network headend device configured to decrypt data from the customer.
16 . The system of claim 1 , wherein:
the network virtualization device is a first network virtualization device;
the virtual cloud network is a first virtual cloud network;
the system further comprises a second network virtualization device; and
the second network virtualization device is configured to receive data from the network headend device and encrypt data received from the network headend device for a second virtual cloud network using a third key.
17 . The system of claim 16 , wherein the first network virtualization device and the second network virtualization device are part of the same network interface card.
18 . A method comprising:
receiving, using a network headend device, a first key provisioned by a customer, the network headend device providing an endpoint for a secure transmission link within a virtual cloud network (“VCN”);
receiving a first data packet at the network headend device sent from a device of the customer;
decrypting the first data packet, using the first key, to obtain information;
receiving, using a network virtualization device, the information from the network headend device;
ascertaining that the information is to be sent to a destination in the VCN;
generate a second data packet, wherein the second data packet comprises the information encrypted using a second key; and
routing the second data packet to the destination in the VCN.
19 . A non-transitory computer-readable memory storing a plurality of instructions executable by one or more processors, the plurality of instructions comprising instructions that when executed by the one or more processors cause the one or more processors to perform processing comprising:
receiving, using a network headend device, a first key provisioned by a customer, the network headend device providing an endpoint for a secure transmission link within a virtual cloud network (“VCN”);
receiving a first data packet at the network headend device sent from a device of the customer;
decrypting the first data packet, using the first key, to obtain information;
receiving, using a network virtualization device, the information from the network headend device;
ascertaining that the information is to be sent to a destination in the VCN;
generate a second data packet, wherein the second data packet comprises the information encrypted using a second key; and
routing the second data packet to the destination in the VCN.