A mechanism for providing customer VCN network encryption using customer-managed keys in network virtualization devices.

Abstract

To allow a customer to control network keys in a virtual cloud network, a network interface card such as a smart NIC is used to provide encryption such as a network encryption virtual function (NEVF) for virtual machines. The NEVF includes a memory device (e.g., SRAM) and a crypto processor (e.g., a crypto core). The memory device stores an encryption key. The crypto processor encrypts data to and from the virtual machines in the virtual cloud network using the encryption key. A key management service can be used to securely transfer the encryption key to the NEVF. Having one NEVF per virtual machine can allow a customer to manage encryption keys for the virtual cloud network.

Images