Encrypted overlay network for physical attack resistance

Abstract

The present disclosure relates to an apparatus and method for protecting a server device from physical attacks. The apparatus and method can use an encrypted overlay network to securely communicate between a trusted network and one or more host computer devices on a network rack that communicates with the trusted network. The apparatus and method can generate a VPN tunnel to communicate directly with each host computer device on the network rack. The apparatus and method can use a VPN tunnel to securely transmit data packets between a trusted network and a host computer device.

Description

Background Art

[0001] As data centers used for cloud computing increase and / or data centers move to remote locations, a large number of computer devices may become vulnerable to physical attacks. For example, a physical attack on a server rack network may allow the attacker to access data traffic flowing between host computing devices on the rack network and data traffic flowing between the host computing devices and the network.

[0002] These and other problems exist in protecting server hardware from physical attacks. Summary of the invention

[0003] This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.

[0004] One example implementation relates to a method. The method may include establishing, at a virtual private network (VPN) server on a trusted network, a first trusted Internet Protocol (IP) address for a first host computer device of a plurality of host computer devices on a network rack in communication with the trusted network, wherein the first trusted IP address is associated with a physical IP address of the first host computer device. The method may include using the first trusted IP address to directly establish a first VPN tunnel between the first host computer device and the VPN server through the physical IP address of the first host computer. The method may include securely transmitting data packets between the first host computer device and the VPN server using the first VPN tunnel.

[0005] Another example implementation relates to a computer device. The computer device may include at least one memory to store data and instructions and at least one processor in communication with the at least one memory, wherein the at least one processor is operable to: establish a first trusted Internet Protocol (IP) address for a first host computer device among a plurality of host computer devices on a network chassis in communication with a trusted network, wherein the first trusted IP address is associated with a physical IP address of the first host computer device; use the first trusted IP address to directly establish a first VPN tunnel between the first host computer device and a VPN server through the physical IP address of the first host; and use the first VPN tunnel to securely transmit data packets between the first host computer device and the VPN server.

[0006] Another example implementation relates to a computer-readable medium storing instructions executable by a computer device. The computer-readable medium may include at least one instruction for causing the computer device to establish a first trusted Internet Protocol (IP) address for a first host computer device among a plurality of host computer devices on a network rack in communication with a trusted network, wherein the first trusted IP address is associated with a physical IP address of the first host computer device. The computer-readable medium may include at least one instruction for causing the computer device to directly establish a first VPN tunnel between the first host computer device and a VPN server through the physical IP address of the first host computer using the first trusted IP address. The computer-readable medium may include at least one instruction for causing the computer device to securely transmit data packets between the first host computer device and the VPN server using the first VPN tunnel.

[0007] Additional features and advantages will be set forth in the following description and will be apparent in part from the description or may be learned through practice of the teachings herein. The features and advantages of the present disclosure may be realized and obtained through the means and combinations particularly indicated in the appended claims. The features of the present disclosure may become more apparent from the following description and the appended claims or may be learned through practice of the present disclosure set forth below. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In the figure:

[0009] Figure 1 is a schematic diagram of an example system illustrating a secure communication channel between a trusted network and a switch of a network chassis according to implementations of the present disclosure.

[0010] Figure 2 is a schematic diagram illustrating an example system for communicating between a trusted network and a network chassis using an encrypted overlay network according to implementations of the present disclosure.

[0011] Figure 3 is a schematic diagram illustrating an example system for communicating between a trusted network and a network chassis using an encrypted overlay network according to implementations of the present disclosure.

[0012] Figure 4 is an example of a table for use with the system according to an implementation of the present disclosure.

[0013] Figure 5 is an example of a data packet header for use with a system according to an embodiment of the present disclosure.

[0014] Figure 6is a flow chart of an example method flow for generating an encrypted overlay network for communicating between a trusted network and one or more host computer devices of a network chassis according to implementations of the present disclosure.

[0015] Figure 7 Some components that may be included in a computer system are shown.

[0016] Specific implementation method

[0017] The present disclosure generally relates to using encrypted overlay networks to protect server devices from physical attacks. As data centers for cloud computing increase and / or data centers move to remote locations, a large number of computer devices may become vulnerable to physical attacks. Physical attacks may include using physical access to server devices to sniff, or otherwise leak network traffic moving through server network racks. Physical attacks may also include using physical access to server devices to tamper with or otherwise modify network data to attack host computer devices on server devices and / or attack data centers. Physical attacks may also include using physical access to server devices to inject malicious data packets to attack host computer devices on server devices and / or attack the entire data network. Currently, server network racks in data centers may have limited security measures to prevent physical attacks on network racks.

[0018] For example, data in transit across network racks may be stolen by an attacker. In addition, an attacker may modify data in transit across network racks. An attacker may also inject erroneous commands or data into the communication channel of a server rack. An attacker may also have physical access to one or more network ports of each host computer device on a network rack. Switches and / or host computer devices may be unsafe, and an attacker with physical access to the device may be able to delete or otherwise access memory, processors, and / or chips from the device. For example, an attacker may access the device and read information stored in the device and / or tamper with or modify data stored in the device. Another example may include an attacker deleting one or more memories, processors, and / or chips and replacing the deleted items with another. Another example may include an attacker using physical access to switches and / or host computer devices to insert or otherwise introduce bad data or viruses into the system. Therefore, an attacker may use physical access to a network rack to attack a host computer device and / or a wider network.

[0019] The present disclosure includes several practical applications that provide benefits and / or solve problems associated with physical attacks on server devices. The present disclosure can add boundaries between attackers that have physical access to network racks and / or network data. The present disclosure can use an encrypted overlay network to securely communicate between a trusted network and one or more network racks without requiring any changes to host computer devices on the network racks and / or data centers. The overlay network can have one or more policies about when to encrypt data going to other hosts and / or when to encrypt data going to the trusted network. In addition, the host computer devices and / or data centers can be unaware of the encrypted overlay network.

[0020] The present disclosure can encrypt all traffic between host computer devices with IP-level security at a secure smart network interface card (NIC). A secure smart NIC can be a NIC where all chips, components, and / or buses of the NIC are securely protected and properly booted. The present disclosure can also encrypt all host computer device traffic to a trusted network using a virtual private network (VPN), which can also be done at the smart NIC card.

[0021] The present disclosure can protect east-west data communications between a trusted network and a host computer device in a network rack by creating one or more encrypted VPN tunnels to securely communicate directly with the host computer device. The present disclosure can overlay data packets to the host computer device with an encrypted header. The encrypted header can include a trusted Internet Protocol (IP) address of the host computer device, so that the data packet can be transmitted using the encrypted VPN tunnel. The trusted IP address can be stored in a table and accessed when creating a secure data packet for transmission.

[0022] The present disclosure also protects inter-rack data transmission between different host computer devices in a network rack by encrypting data transmission between different host computer devices. In an implementation, the present disclosure protects north-south traffic between a network rack and a customer accessing the network rack through an enterprise network. Thus, data is encrypted on the network and protected while being transferred through all intermediate devices in the network.

[0023] Thus, the present disclosure protects network confidentiality and prevents unauthorized physical access to data stored on a network chassis and / or unauthorized access to data in transit through the network chassis.

[0024] Reference now Figure 1, an example system 100 is shown illustrating secure communications between a trusted network 104 and one or more switches 12 of a network rack 102 that communicates with the trusted network 104 via a network. In an implementation, the trusted network 104 may be a cloud computing system, and the one or more network racks 102 may be located in a remote location to which an attacker may have physical access.

[0025] The network racks 102 may each have a switch 12, which may have a communication channel 28 that the switch 12 uses to communicate with one or more host computer devices 16, 18, 20 on the network 102. The switches 12 may include top-of-rack (ToR) switches that include a complete computing device with a central processing unit (CPU), memory, and a bus.

[0026] The network rack 102 may include any number and type of computing cores and / or host computer devices 16, 18, 20 thereon. One or more virtual machines may be implemented on the host computer devices 16, 18, 20 of the server network rack 102. The switch 12 and / or the host computer devices 16, 18, 20 may include the following in combination: Figure 7 Describes features and functionality.

[0027] Each host computer device 16, 18, 20 may have a network interface card (NIC) 22, 24, 26 associated with the host computer device 16, 18, 20. In addition, each NIC 22, 24, 26 may have an IP address 23, 25, 27 that identifies the physical site IP address of each host computer device 16, 18, 20. The trusted network 104 may transmit data packets to and / or receive data packets from each host computer device 16, 18, 20 using the physical IP addresses 23, 25, 27.

[0028] In an implementation, the trusted network 104 can use the VPN server 10 to establish a secure communication channel 14 between the trusted network 104 and the switch 12 of the network rack 102, so that the data packets transmitted between the trusted network 104 and the switch 12 can be encrypted. For example, the secure communication channel 14 can be an encrypted VPN connection. In this way, the switch 12 can store the connection information of the VPN connection and coordinate the transmission of data packets from the rack network to the trusted network data center.

[0029] However, even though the communications between the trusted network 104 and the switch 12 may be secure, the network chassis 102 may still be vulnerable to physical attacks. For example, the data communication channel 28 between the host computer devices 16, 18, 20 and the switch 12 may be unsecured, and therefore, an attacker with physical access to the communication channel 28 may be able to read or otherwise access data in transit across the communication channel 28. Therefore, additional security may be required to ensure that communications conducted over the data communication channel 28 can also be securely protected. For example, additional hop-to-hop security may be required to encrypt data traffic from the switch 12 to each NIC 22, 24, 26.

[0030] Reference now Figure 2 , shows an example system 200 for communicating between a trusted network 104 and one or more network chassis 102 using an encrypted overlay network. The trusted network 104 and the network chassis 102 may have a Figure 1 The trusted network 104 may communicate with one or more remote server network racks 102 via a wired or wireless network. The one or more remote server network racks 102 may span multiple geographic locations.

[0031] The network rack 102 may include thereon any number and kind of computing cores and / or host computer devices 16, 18, 20. In addition, one or more virtual machines may be implemented on the host computer devices 16, 18, 20 of the server network rack 102.

[0032] Each host computer device 16, 18, 20 may have an individual NIC 22, 24, 26. In an implementation, the NIC 22, 24, 26 may be a secure smart NIC capable of performing hardware acceleration techniques to perform encryption. A secure smart NIC may be a NIC in which all chips, components, and / or buses of the NIC are securely protected and / or properly booted. The NIC 22, 24, 26 may have a physical IP address 23, 25, 27 that identifies the physical location of the host computer device 16, 18, 20.

[0033] Trusted network 104 may include a VPN server 10, which may be used to communicate with host computer devices 16, 18, 20 on network chassis 102. VPN server 10 may include a complete computing device having one or more processors, memory, and / or buses. VPN server 10 may include the following combined Figure 7 Describes features and functionality.

[0034] In addition, the trusted network 104 may include an overlay network manager 30 that may receive one or more requests to use or otherwise access data of one or more host computer devices 16, 18, 20 on the network chassis 102. The overlay network manager 30 may coordinate the generation of an encrypted overlay network to securely communicate with the host computer devices 16, 18, 20 on the network chassis 102 for the requested data access. The overlay network manager 30 may be in communication with the VPN server 10 and / or may be a part of the VPN server 10.

[0035] The components of the overlay network manager 30 may include hardware, software, or both. For example, the components of the overlay network manager 30 may include one or more instructions stored on a computer-readable storage medium and executable by a processor of one or more computing devices. When executed by one or more processors, the computer executable instructions of one or more computing devices (e.g., VPN server 10) may perform one or more methods described herein. Alternatively, the components of the overlay network manager 30 may include hardware, such as a dedicated processing device for performing a specific function or group of functions. Additionally or alternatively, the components of the overlay network manager 30 may include a combination of computer executable instructions and hardware.

[0036] The VPN server 10 may receive a request or other notification from the overlay network manager 30 to generate an encrypted overlay network. The VPN server 10 may establish trusted IP addresses 33, 35, 37 corresponding to the physical IP addresses 23, 25, 27 of the host computer devices 16, 18, 20.

[0037] In an implementation, the VPN server 10 may use the physical IP addresses 23, 25, 27 to issue a broadcast message to one or more host computer devices 16, 18, 20 to establish a trusted IP address 33, 35, 37. The broadcast message may be an encrypted data packet using a public key. The host computer device 16, 18, 20 may respond to the broadcast message and the VPN server 10 may use the public key to initiate a peer-to-peer negotiation with the host computer device 16, 18, 20 to establish one or more secure VPN tunnels with the host computer device 16, 18, 20. In another implementation, a service may be used to exchange public keys between the VPN server 10 and one or more host computer devices 16, 18, 20.

[0038] In an implementation, the secure NICs 22, 24, 26 may store VPN access information and / or public keys transmitted via broadcast messages. In another implementation, a public central repository storing trusted IP addresses 33, 35, 37 and / or public keys behind the VPN server 10 may share the trusted IP addresses 33, 35, 37 and / or public keys. In another implementation, the public keys may be used to encrypt data packets transmitted over the secure VPN tunnel.

[0039] The VPN server 10 may generate one or more trusted IP addresses 33, 35, 37 corresponding to the one or more physical IP addresses 23, 25, 27. In an implementation, as the host computer devices 16, 18, 20 respond to the broadcast message, the VPN server 10 may build a table having an association of the trusted IP addresses 33, 35, 37 with the physical IP addresses 23, 25, 27 of the host computer devices 16, 18, 20.

[0040] The VPN server 10 may establish one or more encrypted VPN tunnels with the host computer devices 16, 18, 20 using the trusted IP addresses 33, 35, 37. The VPN server 10 may establish one or more encrypted VPN tunnels with the host computer devices 16, 18, 20 using the associations between the trusted IP addresses 33, 35, 37 and the physical IP addresses 23, 25, 27 from the table. The VPN server 10 may establish a VPN tunnel 32a with the host computer device 16, thereby allowing the host computer device 16 to communicate directly with the trusted network 104 via the VPN tunnel 32a. For example, the VPN tunnel 32a may be generated on the physical IP address 23, and the trusted IP address 33 traffic may be sent within the VPN tunnel 32a. The VPN server 10 may also establish a VPN tunnel 32b with the host computer device 18, thereby allowing the host computer device 18 to communicate directly with the trusted network 104 using the VPN tunnel 32b. For example, the VPN tunnel 32b may be generated on the physical IP address 25, and the trusted IP address 35 traffic may be sent within the VPN tunnel 32b. In addition, the VPN server 10 can establish a VPN tunnel 32c with the host computer device 20, thereby allowing the host computer device 20 to communicate directly with the trusted network 104 using the VPN tunnel 32c. For example, the VPN tunnel 32c can be generated on the physical IP address 27, and the trusted IP address 37 traffic can be sent within the VPN tunnel 32c. In this way, the VPN server 10 can establish individual VPN tunnels 32a, 32b, 32c with each of the host computer devices 16, 18, 20 to securely transmit data packets between the host computer devices 16, 18, 20 and the trusted network 104. The host computer devices 16, 18, 20 can only know the trusted IP addresses 33, 35, 37 and can use the trusted IP addresses 33, 35, 37 when transmitting data packets and / or receiving data packets from the trusted network 104.

[0041] In addition, one or more secure communication channels 32d, 32e may be established between the various NICs 22, 24, 26 of the host computer devices 16, 18, 20 using the physical IP addresses 23, 25, 27. The one or more secure communication channels 32d, 32e may be established using a table 400 ( Figure 4) is established between physical IP addresses 23, 25, 27. For example, a tunnel may be established from physical IP address 23 and physical IP address 25 using table 400 that indexes physical IP address 23 to trusted IP address 33 and physical IP address 25 to trusted IP address 35. Thus, data packet 33 may be transmitted from trusted IP address 33 to trusted IP address 35 by encapsulating the data packet in secure communication channel 32d by directly sending the data packet using physical IP address 23 and physical IP address 25, respectively.

[0042] In one implementation, the VPN server 10 can establish one or more secure communication channels 32d, 32e between the various NICs 22, 24, 26 of the host computer devices 16, 18, 20. For example, when transmitting data packets between the host computer device 16 and the host computer device 18, the VPN server 10 can use the trusted IP address 33 of the host computer device 16 and the trusted IP address 35 of the host computer device 18 to establish the secure communication channel 32d. In addition, when transmitting data packets between the host computer device 18 and the host computer device 20, the VPN server 10 can use the trusted IP address 35 of the host computer device 18 and the trusted IP address 37 of the host computer device 20 to establish the secure communication channel 32e. In an implementation, the secure communication channels 32d, 32e can be encrypted VPN tunnels. In this way, data packets can be securely transmitted between the host computer devices 16, 18, 20.

[0043] Therefore, even if an attacker has physical access to the data communication channel 28, the NICs 22, 24, 26, and / or the host computer devices 16, 18, 20, the attacker may not be able to read the data in transit and / or modify or inject data into the system because the attacker cannot communicate with the system without the public key. In addition, since each of the host computer devices 16, 18, 20 communicates directly with the trusted network 104 via an individual encrypted VPN tunnel, the switch 12 may not participate in the transmission of data packets between the host computer devices 16, 18, 20 and the trusted network 104. Therefore, even if an attacker has access to the switch 12, the attacker cannot use the switch 12 to attack the data center or the trusted network 104.

[0044] Thus, the system 200 may be used to protect network confidentiality and prevent unauthorized physical access to data stored on and / or in transit through the network chassis 102 .

[0045] Reference now Figure 3, shows another implementation of an example system 200 for communicating between a trusted network 104 and one or more network chassis 102 and between one or more clients 34 of an enterprise network 106 using an encrypted overlay network. The network 104 and the network chassis 102 may have a Figure 1 and Figure 2 Features similar to those described in .

[0046] In an implementation, the VPN server 10 of the trusted network 104 may want to communicate with multiple host computer devices 16, 18, 20 simultaneously. Therefore, the VPN server 10 may access multiple trusted IP addresses 33, 35, 37 for multiple host computer devices 16, 18, 20. For example, the VPN server 10 may access the server's table 400 ( Figure 4 The trusted IP addresses 33 , 35 , 37 may select a first trusted IP address 33 associated with the first host computer device 16 and a second trusted IP address 35 associated with the second host computer device 18 .

[0047] VPN server 10 may use first trusted IP address 33 and second trusted IP address 35 to generate an encrypted VPN tunnel 32f for communicating with host computer device 16 and host computer device 18. For example, first trusted IP address 33 and second trusted IP address 35 may be provided by VPN server 10 to host computer device 16 and host computer device 18, thereby allowing first trusted IP address 33 and second trusted IP address 35 to communicate with trusted network 104. Encrypted VPN tunnel 32f may be generated by physical IP address 23 and physical IP address 25. Physical IP address 23 and physical IP address 25 may send encrypted data packets inside encrypted VPN tunnel 32f, in which first trusted IP address 33 and second trusted IP address 35 data packets are sent. In this way, both host computer device 16 and host computer device 18 may transmit data packets to trusted network 104 and / or receive data packets from trusted network 104 via the same encrypted VPN tunnel 32f.

[0048] In addition, VPN server 10 can access table 400 to identify trusted IP address 37 of host computer device 20. VPN server 10 can use trusted IP address 37 to generate encrypted VPN tunnel 32g with host computer device 20. Therefore, host computer device 20 can use encrypted VPN tunnel 32g to send data packets to and / or receive data packets from trusted network 104, while host computer device 18 and / or host computer device 16 can communicate with trusted network 104 using encrypted VPN tunnel 32f.

[0049] In another implementation, one or more customers 34 or other third parties may send a request to communicate directly with one or more host computer devices 16, 18, 20 on the network chassis 102. The customers 34 may be able to access the host computer devices 16, 18, 20 via the enterprise network 106. The host computer devices 16, 18, 20 may each have an associated client address 43, 45, 47 that identifies the host computer device 16, 18, 20 to the customers 34 or third parties. In an implementation, the customers 34 may be able to access the host computer devices 16, 18, 20 through a telecommunications network using a mobile device. The client addresses 43, 45, 47 may be in a telecommunications address space that allows a mobile device to communicate with the client addresses 43, 45, 47. The customers 34 may be able to communicate with the host computer devices 16, 18, 20 using the client addresses 43, 45, 47 in a variety of ways. For example, the customers 34 may establish a connection 36 to the host computer device 16 using the client address 43. The client 34 may be identified as being outside the trusted network 104, and therefore, the connection 36 may be an unencrypted communication channel. Another option may include establishing an encrypted communication channel 32h using an overlay network to communicate with the client 34 via the host computer device 18. The overlay network may have one or more policies for when to encrypt data going to other hosts and / or when to encrypt data going to the trusted network 104. In addition, the overlay network may have one or more policies for whether to encrypt the client address 43, 45, 47 and / or whether to continue encryption to the destination. Therefore, the system 200 provides flexibility in communicating with different host computer devices 16, 18, 20 and / or different clients 34.

[0050] Reference now Figure 4 , the example table 400 shows the trusted IP addresses 33, 35, 37 and the host computer devices 16, 18, 20 ( Figure 1-3 )'s physical IP addresses 23, 25, 27. . Table 400 may include a column for a trusted network 402 with the trusted IP addresses 33, 35, 37 of the host computer devices 16, 18, 20. Table 400 may also include a column for a site address space 404 with the physical IP addresses 23, 25, 27 of the host computer devices 16, 18, 20. Table 400 may also include a plurality of rows 406, 408, 410. Each row 406, 408, 410 may show an association between a trusted IP address 33, 35, 37 and a corresponding physical IP address 23, 25, 27. Table 400 may be updated as new host computer devices are identified and / or removed from network racks 102 ( Figure 1-3 ) is removed and dynamically updated.

[0051] The VPN server 10 may use the table 400 in establishing one or more VPN tunnels 32 for communicating with the host computer devices 16, 18, 20. In addition, the VPN server 10 may use the table 400 for determining headers for data packets for transmission to the one or more host computer devices 16, 18, 20. For example, the VPN server 10 may access rows 406, 408, 410 in the table 400 to identify the physical IP addresses 23, 25, 27 of the host computer device 16 and the corresponding trusted IP addresses 33, 35, 37. The VPN server 10 may generate an encrypted header with the trusted IP addresses 33, 35, 37 for use in transmitting data packets between the trusted network 104 and the host computer devices 16, 18, 20. In addition, when transmitting data packets between the host computer devices 16, 18, 20, the VPN server 10 may generate an encrypted header with the trusted IP addresses 33, 35, 37.

[0052] Thus, VPN server 10 can use table 400 to build an association between trusted IP addresses 33, 35, 37 of a trusted network and site physical IP addresses 23, 25, 27 of host computer devices 16, 18, 20. In addition, VPN server 10 can use table 400 to generate an encrypted overlay network for communication between trusted network 104 and one or more host computer devices 16, 18, 20 on network chassis 102.

[0053] Reference now Figure 5 , an example of a data packet header 500 for use by a VPN server 10 to transmit data packets between a trusted network 104 and one or more host computer devices 16, 18, 20 on a network chassis 102 in communication with the trusted network 104, and / or to transmit data packets between host computer devices 16, 18, 20 on a network chassis in communication with the trusted network 104.

[0054] In an implementation, data packet header 500 may have a first portion 502 that identifies the physical IP address 23 of first host computer device 16 and the physical IP address 25 of second host computer device 18. Thus, data packet 500 may be transmitted from first host computer device 16 to second host computer device 18. Data packet header 500 may also have an encryption portion 504 for encrypting the data packet. Data packet header 500 may also have a third portion 506 that identifies the trusted IP address 33 of first host computer device 16 and the trusted IP address 35 of second host computer device 18. Third portion 506 of data packet header 500 may be used to transmit data packet 500 between first host computer device 16 and second host computer device 18.

[0055] Reference now Figure 6 , VPN server 10( Figure 2 ) can use the example method 600 to generate an encrypted overlay network for use in a trusted network 104 ( Figure 2 ) and one or more server network racks 102 ( Figure 2 ) of one or more host computer devices 16, 18, 20 ( Figure 2 ) to communicate with each other. The actions of method 600 can refer to Figures 1 to 3 The architecture is discussed below.

[0056] At 602, method 600 may include establishing a first trusted IP address for a first host computer device of a plurality of host computer devices on a network rack. A VPN server 10 of a trusted network 104 may receive a request or other notification to generate an encrypted overlay network to communicate with a plurality of host computer devices 16, 18, 20 on the network rack 102. For example, the trusted network 104 may want to transmit and / or receive data packets to and / or from one or more host computer devices 16, 18, 20.

[0057] The VPN server 10 can establish a trusted IP address 33, 35, 37 corresponding to the physical IP address 23, 25, 27 of the host computer device 16, 18, 20. In an implementation, the VPN server 30 can send a broadcast message to the physical address 23, 25, 27 of one or more host computer devices 16, 18, 20 to establish the trusted IP address 33, 35, 37. The broadcast message can be an encrypted data packet with a public key. The host computer device 16, 18, 20 can respond to the broadcast message and the VPN server 10 can start a point-to-point negotiation with each host computer device 16, 18, 20 to establish one or more secure VPN tunnels with each host computer device 16, 18, 20. In another implementation, the service can be used to exchange keys between the VPN server 10 and one or more host computer devices 16, 18, 20.

[0058] In an implementation, the secure NICs 22, 24, 26 of the host computer devices 16, 18, 20 may store the VPN access information and / or the public key transmitted via the broadcast message. In another implementation, a public central repository storing the trusted IP addresses 33, 35, 37 and / or the public key behind the VPN server 10 may share the trusted IP addresses 33, 35, 37 and / or the public key. In another implementation, the public key may be used to encrypt data packets transmitted over the secure VPN tunnel.

[0059] The VPN server 10 may generate one or more trusted IP addresses 33, 35, 37 that correspond to one or more physical IP addresses 23, 25, 27. In an implementation, as host computer devices 16, 18, 20 respond to broadcast messages, the VPN server 10 may construct a table 400 ( Figure 4 ), table 400 has associations of trusted IP addresses 33, 35, 37 with physical IP addresses 23, 25, 27. VPN server 10 may use table 400 to identify trusted IP addresses 33, 35, 37 for each of host computer devices 16, 18, 20. For example, row 406 of table 400 ( Figure 4 ) may identify that the first trusted IP address 33 may correspond to the physical IP address 23 of the first host computer device 16. Row 408 of table 400 ( Figure 4 ) may identify that the second trusted IP address 35 may correspond to the physical IP address 25 of the second host computer device 18. Row 410 of table 400 ( Figure 4 ) may identify that the third trusted IP address 37 may correspond to the physical address 27 of the third host computer device 20.

[0060] At 604, method 600 may include generating a first VPN tunnel directly between the first host computer device and the VPN server using the first trusted IP address. VPN server 10 may establish one or more encrypted VPN tunnels with host computer devices 16, 18, 20 using the trusted IP addresses 33, 35, 37. For example, VPN server 10 may establish VPN tunnel 32a with host computer device 16, thereby allowing host computer device 16 to communicate directly by sending data packets to and / or receiving data packets from trusted network 104 via VPN tunnel 32a. VPN tunnel 32a may be created or connected through physical IP address 23, and physical IP address 23 may send encrypted data packets within VPN tunnel 32a, within which trusted IP address 33 traffic may be sent.

[0061] At 606, method 600 may include securely transmitting data packets between the first host computer device and the VPN server using the first VPN tunnel. The VPN server 10 may generate an encrypted header with the trusted IP address 33 for transmitting data packets between the trusted network 104 and the first host computer device 16. In addition, when transmitting data packets between the host computer devices 16, 18, 20, the VPN server 10 may generate an encrypted header with the trusted IP addresses 33, 35, 37.

[0062] In one implementation, VPN server 10 may use table 400 to determine a header for a data packet to be transmitted to one or more host computer devices 16, 18, 20. For example, VPN server 10 may access row 406 in table 400 to identify physical IP address 23 and corresponding trusted IP address 33 of host computer device 16. VPN server 10 may generate an encrypted header using information from table 400. Thus, data packets may flow through physical IP address 23 using trusted IP address 33, and VPN server 10 may use first VPN tunnel 32a to securely transmit data packets to and / or receive data packets from first host computer device 16.

[0063] At 608, method 600 may optionally include establishing a second trusted IP address for a second host computer device in the plurality of host computer devices on the network rack. VPN server 10 may use table 400 to identify the trusted IP addresses 33, 35, 37 for each host computer device 16, 18, 20. For example, VPN server 10 may access row 408 to identify that the second trusted IP address 35 corresponds to the physical IP address 25 of the second host computer device 18.

[0064] At 610, method 600 may optionally include generating a second VPN tunnel directly between the second host computer device and the VPN server using the second trusted IP address. VPN server 10 may also establish VPN tunnel 32b with host computer device 18, thereby allowing host computer device 18 to communicate directly with trusted network 104 using VPN tunnel 32b. For example, VPN tunnel 32b may be created or connected through physical IP address 25, and physical IP address 25 may send encrypted data packets within VPN tunnel 32b, within which trusted IP address 35 traffic may be sent. Thus, VPN server 10 may establish individual VPN tunnels 32a, 32b, 32c on respective physical IP addresses 23, 25, 27 of each host computer device 16, 18, 20 to securely transmit data packets between host computer devices 16, 18, 20 and trusted network 104.

[0065] At 612, method 600 may optionally include securely transmitting data packets between the second host computer device and the VPN server using the second VPN tunnel. VPN server 10 may generate an encrypted header with trusted IP address 35 for transmitting data packets between trusted network 104 and second host computer device 18.

[0066] In an implementation, VPN server 10 may use table 400 to determine a header for a data packet to be transmitted to one or more host computer devices 16, 18, 20. For example, VPN server 10 may access row 408 in table 400 to identify the physical IP address 25 and the corresponding trusted IP address 35 of second host computer device 18. VPN server 10 may generate an encrypted header using information from table 400. Thus, data packets may flow through physical IP address 25 using trusted IP address 35 and VPN server 10 may securely transmit data packets to and / or receive data packets from second host computer device 18 using second VPN tunnel 32b.

[0067] The method 600 may optionally include establishing one or more encrypted communication channels between one or more host computer devices on the network rack. For example, the VPN server 10 may establish one or more encrypted communication channels 32d, 32e between various NICs 22, 24, 26 of the host computer devices 16, 18, 20. The one or more secure communication channels 32d, 32e may use the table 400 ( Figure 4 ) is established between site IP addresses 23, 25, and 27, Table 400 ( Figure 4 ) indexes the trusted IP addresses 33, 35, 37 to the site IP addresses 23, 25, 27. For example, a tunnel may be established from the site IP address 23 and the site IP address 25 using the table 400 that indexes the site IP address 23 to the trusted IP address 33 and the site IP address 25 to the trusted IP address 35. Thus, data packets may be transmitted from the trusted IP address 33 to the trusted IP address 35 by encapsulating the data packets into the secure communication channel 32d by directly sending the data packets using the site IP address 23 and the site IP address 25, respectively. In another implementation,

[0068] The VPN server 10 can establish an encrypted communication channel 32d using the trusted IP address 33 of the host computer device 16 and the trusted IP address 35 of the host computer device 18. In addition, when data packets are transmitted between the host computer device 18 and the host computer device 20, the VPN server 10 can establish an encrypted communication channel 32e using the trusted IP address 35 of the host computer device 18 and the trusted IP address 37 of the host computer device 20. In an implementation, the encrypted communication channels 32d, 32e can be encrypted VPN tunnels. Therefore, the method 600 can be used to securely transmit data packets between the host computer devices 16, 18, 20.

[0069] The method 600 may also be used to generate an encrypted overlay network for communication between the trusted network 104 and one or more host computer devices 16, 18, 20 on the network chassis 102 and / or for communication between host computer devices 16, 18, 20 on the network chassis 102. Using an encrypted overlay network for communication may protect network confidentiality and may prevent unauthorized physical access to data stored on and / or in transit through the network chassis.

[0070] Figure 7 Illustrated are certain components that may be included within computer system 700. One or more computer systems 700 may be used to implement the various devices, components, and systems described herein.

[0071] Computer system 700 includes processor 701. Processor 701 may be a general purpose single-chip or multi-chip microprocessor (e.g., Advanced RISC (Reduced Instruction Set Computer) Machine (ARM)), a special purpose microprocessor (e.g., Digital Signal Processor (DSP)), a microcontroller, a programmable gate array, etc. Processor 701 may be referred to as a central processing unit (CPU). Figure 7 Only a single processor 701 is shown in the computer system 700 , but in an alternative configuration, a combination of processors (eg, an ARM and DSP) could be used.

[0072] The computer system 700 also includes a memory 703 in electronic communication with the processor 701. The memory 703 can be any electronic component capable of storing electronic information. For example, the memory 703 can be implemented as a random access memory (RAM), a read-only memory (ROM), a magnetic disk storage medium, an optical storage medium, a flash memory device in a RAM, an onboard memory included with the processor, an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM) memory, a register, etc., including combinations thereof.

[0073] Instructions 705 and data 707 may be stored in memory 703. Instructions 705 may be executed by processor 701 to implement some or all of the functionality disclosed herein. Execution of instructions 705 may involve the use of data 707 stored in memory 703. Any of the various examples of modules and components described herein may be implemented in part or in whole as instructions 705 stored in memory 703 and executed by processor 701. Any of the various examples of data described herein may be in data 707 stored in memory 703 and used during execution of instructions 705 by processor 701.

[0074] The computer system 700 may also include one or more communication interfaces 709 for communicating with other electronic devices. The communication interface 709 may be based on wired communication technology, wireless communication technology, or both. Some examples of the communication interface 709 include a universal serial bus (USB), an Ethernet adapter, a wireless adapter operating according to the Institute of Electrical and Electronics Engineers (IEEE) 802.11 wireless communication protocol, a Bluetooth wireless communication adapter, and an infrared (IR) communication port.

[0075] The computer system 700 may also include one or more input devices 711 and one or more output devices 713. Some examples of input devices 711 include keyboards, mice, microphones, remote control devices, buttons, joysticks, trackballs, touchpads, and light pens. Some examples of output devices 713 include speakers and printers. One specific type of output device that is typically included in the computer system 700 is a display device 715. The display device 715 used with the embodiments disclosed herein may utilize any suitable image projection technology, such as a liquid crystal display (LCD), a light emitting diode (LED), gas plasma, electroluminescence, and the like. A display controller 717 may also be provided for converting data 707 stored in the memory 703 into text, graphics, and / or moving images (as appropriate) displayed on the display device 715. The display controller 717 may be used for remote display.

[0076] The various components of the computer system 700 may be coupled together via one or more buses, which may include a power bus, a control signal bus, a status signal bus, a data bus, etc. For clarity, the various buses are shown in FIG. Figure 7 Shown in FIG. 7 is bus system 719 .

[0077] The techniques described herein may be implemented in hardware, software, firmware, or any combination thereof, unless specifically described as being implemented in a particular manner. Any features described as modules, components, etc. may also be implemented together in an integrated logic device, or separately as discrete but interoperable logic devices. If implemented in software, the techniques may be implemented at least in part by a non-transient processor-readable storage medium comprising instructions that, when executed by at least one processor, perform one or more of the methods described herein. Instructions may be organized into routines, programs, objects, components, data structures, etc., which may perform specific tasks and / or implement specific data types, and may be combined or distributed as desired in various embodiments.

[0078] Without departing from the scope of the claims, the steps and / or actions of the methods described herein may be interchangeable. In other words, unless a specific order of steps or actions is required for the correct operation of the described method, the order and / or use of specific steps and / or actions may be modified without departing from the scope of the claims.

[0079] The term "determining" encompasses a wide variety of actions, and thus, "determining" may include calculating, computing, processing, deriving, investigating, searching (e.g., searching in a table, database, or other data structure), ascertaining, and the like. Furthermore, "determining" may include receiving (e.g., receiving information), accessing (e.g., accessing data in a memory), and the like. Furthermore, "determining" may include resolving, selecting, choosing, establishing, and the like.

[0080] The terms "comprising," "including," and "having" are intended to be inclusive and mean that there may be additional elements other than the listed elements. Furthermore, it should be understood that reference to "one embodiment" or "an embodiment" of the present invention is not intended to be interpreted as excluding the existence of additional embodiments that also include the recited features. For example, any element or feature described with respect to an embodiment herein may be combined with any element or feature of any other embodiment described herein where compatible.

[0081] The present disclosure may be implemented in other specific forms without departing from its spirit or features. The described embodiments are to be considered illustrative rather than restrictive. Therefore, the scope of the present disclosure is indicated by the appended claims rather than the foregoing description. Changes within the meaning and scope of the equivalent forms of the claims will be included within their scope.

Claims

1. A method comprising: establishing, at a virtual private network (VPN) server on a trusted network, a first trusted Internet Protocol (IP) address for a first host computer device of a plurality of host computer devices on a network rack in communication with the trusted network, wherein the first trusted IP address is associated with a physical IP address of the first host computer device; using the first trusted IP address to directly establish a first VPN tunnel between the first host computer device and the VPN server via the physical IP address of the first host computer device; securely transmitting data packets between the first host computer device and the VPN server using the first VPN tunnel; as well as establishing a second trusted IP address for a second host computer device of the plurality of host computer devices on the network chassis in communication with the trusted network, wherein the second trusted IP address is associated with a physical IP address of the second host computer device, Wherein establishing the first trusted IP address and the second trusted IP address further comprises exchanging using a public key received in a broadcast message having a packet encrypted using the public key, the packet being sent to the physical IP address associated with the first host computer device and the physical IP address of the second host computer device.

2. The method according to claim 1, further comprising: using the second trusted IP address to directly generate a second VPN tunnel between the second host computer device and the VPN server via the physical IP address of the second host computer device; as well as The data packets are securely transmitted between the second host computer device and the VPN server using the second VPN tunnel.

3. The method according to claim 1, further comprising: using the first trusted IP address and the second trusted IP address to transmit the first VPN tunnel between the first host computer device and the second host computer device through the physical IP address of the first host computer and the physical IP address of the second host computer device; securely transmitting the data packets between the first host computer device and the VPN server using the first VPN tunnel; as well as The data packets are securely transmitted between the second host computer device and the VPN server using the first VPN tunnel.

4. The method according to claim 1, further comprising: establishing an encrypted communication channel between a first network interface card (NIC) of the first host computer device and a second network interface card (NIC) of the second host computer device using the first trusted IP address and the second trusted IP address; as well as The data packets are securely transmitted between the first host computer device and the second host computer device using the encrypted communication channel.

5. The method according to claim 1, wherein establishing the first trusted IP address and the second trusted IP address further comprises: exchanging the public key between the first host computer device, the second host computer device, and the VPN server; or sending the broadcast message having a packet encrypted using the public key to the physical IP address associated with the first host computer device and the physical IP address associated with the second host computer device; as well as Responses to the broadcast message are received from the first host computer device and the second host computer device.

6. The method according to claim 5, further comprising: The data packets transmitted via the first and second VPN tunnels are encrypted using the public key.

7. The method according to claim 5, further comprising: The responses are used to construct a table having associations between the physical IP addresses of the plurality of host computer devices and a trusted IP address for each of the plurality of host computer devices.

8. The method according to claim 1, further comprising: receiving a request from a client to access a host computer device of the plurality of host computer devices; as well as Communications are performed between a host computer device among the plurality of host computer devices and the client using an unencrypted communications channel.

9. The method according to claim 1, further comprising: receiving a request from a client to access a host computer device of the plurality of host computer devices; as well as An encrypted communication channel is used to communicate between a host computer device among the plurality of host computer devices and the client.

10. A computer device comprising: at least one memory for storing data and instructions; as well as at least one processor in communication with the at least one memory, wherein the at least one processor is operable to: establishing a first trusted Internet Protocol (IP) address for a first host computer device among a plurality of host computer devices in communication with a trusted network, wherein the first trusted IP address is associated with a physical IP address of the first host computer device; using the first trusted IP address to directly establish a first VPN tunnel between the first host computer device and a VPN server via the physical IP address of the first host computer device; securely transmitting data packets between the first host computer device and the VPN server using the first VPN tunnel; as well as establishing a second trusted IP address for a second host computer device of the plurality of host computer devices in communication with the trusted network, wherein the second trusted IP address is associated with a physical IP address of the second host computer device, Wherein establishing the first trusted IP address and the second trusted IP address includes: using a public key received in a broadcast message, sending a packet encrypted using the public key to a physical IP address associated with the first host computer device and the physical IP address of the second host computer device.

11. The computer device of claim 10, wherein the at least one processor is further operable to: generating a second VPN tunnel directly between the second host computer device and the VPN server via the physical IP address of the second host computer device using the second trusted IP address; and The data packets are securely transmitted between the second host computer device and the VPN server using the second VPN tunnel.

12. The computer device of claim 10, wherein the at least one processor is further operable to: communicating the first VPN tunnel between the first host computer device and the second host computer device through the physical IP address of the first host computer and the physical IP address of the second host computer device using the first trusted IP address and the second trusted IP address; securely transmitting the data packets between the first host computer device and the VPN server using the first VPN tunnel; as well as The data packets are securely transmitted between the second host computer device and the VPN server using the first VPN tunnel.

13. The computer device of claim 10, wherein the at least one processor is further operable to: establishing an encrypted communication channel between a first network interface card (NIC) of the first host computer device and a second network interface card (NIC) of the second host computer device using the first trusted IP address and the second trusted IP address; and The data packets are securely transmitted between the first host computer device and the second host computer device using the encrypted communication channel.

14. The computer device of claim 10, wherein the at least one processor is further operable to establish the first trusted IP address and the second trusted IP address by: exchanging the public key between the first host computer device, the second host computer device and the VPN server; or sending the broadcast message having a packet encrypted with the public key to the physical IP address associated with the first host computer device and the physical IP address associated with the second host computer device; and Responses to the broadcast message are received from the first host computer device and the second host computer device.

15. The computer device of claim 14, wherein the at least one processor is further operable to: The data packets transmitted via the first and second VPN tunnels are encrypted using the public key.

16. The computer device of claim 14, wherein the at least one processor is further operable to: The responses are used to construct a table having associations between the physical IP addresses of the plurality of host computer devices and a trusted IP address for each of the plurality of host computer devices.

17. The computer device of claim 10, wherein the at least one processor is further operable to: receiving a request from a client to access a host computer device of the plurality of host computer devices; and Communication is performed between a host computer device among the plurality of host computer devices and the client using a non-encrypted communication channel or an encrypted communication channel.

18. A non-transitory computer-readable medium storing instructions executable by a computer device, the computer-readable medium comprising: at least one instruction for causing the computer device to establish a first trusted Internet Protocol (IP) address for a first host computer device among a plurality of host computer devices on a network chassis in communication with a trusted network, wherein the first trusted IP address is associated with a physical IP address of the first host computer device; at least one instruction for causing the computer device to use the first trusted IP address to directly establish a first VPN tunnel between the first host computer device and a VPN server through the physical IP address of the first host computer device; at least one instruction for causing the computer device to securely transmit data packets between the first host computer device and the VPN server using the first VPN tunnel; as well as at least one instruction for causing the computer device to establish a second trusted IP address for a second host computer device of the plurality of host computer devices on the network chassis in communication with the trusted network, wherein the second trusted IP address is associated with a physical IP address of the second host computer device, Wherein establishing the first trusted IP address and the second trusted IP address comprises exchanging using a public key received in a broadcast message having a packet encrypted using the public key, the packet being sent to the physical IP address associated with the first host computer device and the physical IP address of the second host computer device.

Images