Distributed VPN service

Abstract

This disclosure relates to distributed VPN services. For a network comprising host machines for providing computing and networking resources and a VPN gateway for providing external access to those resources, a method for distributing encryption keys to hosts for encryption / decryption initiated / terminated at those hosts is described A novel method for the full payload of . These encryption keys are created or obtained by the VPN gateway based on network security negotiations with external networks / devices. These negotiated keys are then distributed to hosts via the network's control plane. In some embodiments, this creates a complete distributed mesh framework for processing cryptographic payloads.

Description

Background technique [0001] L2 and L3VPN (Virtual Private Networks) are common networking constructs in today's networking deployments that seek to extend reachable networks beyond the traditional data center perimeter in a secure manner. As the evolution of distributed multi-site data centers becomes a reality, and as the capacity of the services provided increases, choke point L2 and L3 encrypted services based on legacy appliances cannot meet the desired scale characteristics of such deployments. As multi-site data centers become more popular, the need to splice secure traffic moving across these sites in a more seamless and scalable manner becomes critical. [0002] For example, a VPN gateway installed on the perimeter of an Internet-facing enterprise internal network allows external networks (or devices) to connect into the network via tunneling mechanisms over SSL / DTLS or IKE / IPSec. All traffic between these networks must go through the tunnel endpoints. The tunnel end...

AI Technical Summary

Problems solved by technology

Therefore, the seamless splicing of multi-site data centers becomes more cumbersome on edge devices that accomplish this task

Images