Dynamic separation of channel encryption key distribution

Abstract

A method can include determining, by a first network device, a type of control channel to open in a transport in a software defined network (SDN). The method can also include establishing a control channel with a control device via a control plane that is separate from a data plane. The method can further include advertising, via the control channel, first security association parameters to the control device. The method can include receiving, via the control channel, second security association parameters associated with a second network device from the control device. The method can also include establishing a data plane connection with the second network device using the second security association parameters.

Description

[0001] This application is a divisional application of the invention patent application filed on July 25, 2018, with application number 201880049784.3 (PCT international application number PCT / US2018 / 043622) and entitled "Dynamically Separated Channel Encryption Key Distribution".

[0002] Cross-reference to related applications

[0003] This application claims priority to U.S. Patent Application No. 62 / 539,431, filed July 21, 2017, the entire contents of which are incorporated herein by reference. Technical Field

[0004] The embodiments discussed in this disclosure relate to dynamically separated channel encryption key distribution. Background Technology

[0005] Networks are a useful tool that allows communication between different computing devices. Despite the proliferation of networks enabling communication between computers, various limitations still exist with current network technologies.

[0006] The subject matter claimed in this disclosure is not limited to embodiments that address any shortcomings or operate only in environments such as those described above. Rather, this background art is provided merely to illustrate an example technical field in which some of the embodiments described in this disclosure can be practiced. Summary of the Invention

[0007] The aspects of the invention are set forth in the independent claims, and preferred features are set forth in the dependent claims. Features of one aspect may be applied to each aspect individually or in combination with other aspects.

[0008] One or more embodiments of this disclosure may include a method that includes: determining, by a first network device, the type of control channel to be opened on a transport in a software-defined network (SDN). The method may further include establishing the control channel using a control device via a control plane separate from the data plane. The method may further include announcing a first security association parameter to the control device via the control channel. The method may include receiving, via the control channel, a second security association parameter associated with a second network device from the control device. The method may further include establishing a data plane connection with the second network device using the second security association parameter.

[0009] One or more embodiments of this disclosure may additionally include systems and / or non-transitory computer-readable media for facilitating the execution of this method.

[0010] The objectives and advantages of the embodiments will be realized and accomplished, at least by means of the elements, features and combinations particularly pointed out in the claims.

[0011] It should be understood that the foregoing general description and the following detailed description are merely illustrative and explanatory, and do not limit the invention as claimed. Attached Figure Description

[0012] Example embodiments will be described and illustrated with additional features and details using the accompanying drawings, wherein:

[0013] Figure 1 An example system implementing network components of Software-Defined Networking (SDN) is shown;

[0014] Figure 2 Another example system implementing SDN is shown;

[0015] Figure 3 An example system implementing the control plane is shown;

[0016] Figure 4 Another example system implementing the data plane is shown;

[0017] Figure 5 A flowchart illustrating an example method for establishing a control plane and data plane within an SDN is shown;

[0018] Figure 6 A flowchart illustrating another example method for establishing a control plane and data plane within an SDN is shown;

[0019] Figure 7 A flowchart illustrating another example method for establishing the control plane and data plane within an SDN is shown; and

[0020] Figure 8 An example computing system is shown. Detailed Implementation

[0021] Encryption is a fundamental function for most data exchanges across modern communication networks. Authenticating endpoints, establishing secure controls and data paths, and exchanging encryption keys all present significant challenges. One of the many challenges in establishing secure communication channels is providing the ability to exchange authentication information and encryption keys between endpoints without being susceptible to so-called man-in-the-middle attacks. Man-in-the-middle attacks involve a third party eavesdropping and potentially modifying the exchanged information, allowing the third party to intercept the exchange. Some common techniques used to mitigate man-in-the-middle attacks include the Diffie-Hellman algorithm and Elliptic Curve Digital Signature Algorithm (ECDSA).

[0022] This disclosure addresses these and other shortcomings of conventional methods for mitigating various security vulnerabilities in conventional networks. For example, it addresses the challenge of providing secure communication across insecure media by using relatively secure and separate channels for authentication and encryption key exchange. From the perspective of data and control protocol processing, separate channels provide the same functionality as insecure channels and offer the advantages that implementers of a given network can decide to use a communication channel that provides a certain level of trust, thereby reducing the likelihood of man-in-the-middle attacks. Since most private communication networks (e.g., MPLS, leased-line TDM, or private frame ATM networks) typically offer better security and integrity than the open Internet, this disclosure significantly improves the security of any exchange of encrypted and authenticated information by using a private network as a separate channel for the Internet. Since virtually no network can be considered absolutely secure, a given set of authentication and secure exchange functions can still be used without relaxing any requirements.

[0023] This disclosure provides a protocol capable of identifying a specific path carrying information about, in particular, the local communication path information and related messages of the originator of a given protocol advertisement. This disclosure may also provide an out-of-band mechanism for collecting information about local communication paths to be advertised via channels separate from those described above. This disclosure may further provide a protocol carrying all the information required to establish an encrypted communication channel across paths not specifically operable by the protocol (i.e., separate paths). This disclosure may also provide the capability within the aforementioned protocol to uniquely identify each advertised local path and shared or unique encryption parameters associated with each local path. This disclosure may also provide local encrypted endpoints with the ability to establish encrypted communication across paths that may or may not undergo Network Address Translation (NAT, IETF RFC 2663), while managing those paths separate from the control channel paths. Another benefit of this disclosure may include using a different control protocol than that operating on separate channels or paths to discover potential NAT conditions on other local paths.

[0024] In at least some embodiments, the system may include a network that interconnects sites using a private network and the public Internet, wherein the private network and / or the Internet may be used at primary or standby capacity, as appropriate for specific applications suited to inter-site connectivity or the use of different communication path profiles. Communication across the two networks may be protected and may be encrypted. For both networks, the example deployment may use control plane protocols and data plane protocols in the same (or nearly the same) manner, wherein network-specific parameters may be exchanged on each individual network.

[0025] Embodiments of this disclosure can provide improvements to the operation of computer networks and computers themselves. For example, using one or more embodiments of this disclosure, network traffic can be more secure and less susceptible to sniffing and man-in-the-middle attacks. Embodiments of this disclosure are described below with reference to the accompanying drawings.

[0026] Figure 1 An example system 100 is illustrated, illustrating network components implementing a software-defined network (SDN) according to one or more embodiments of the present disclosure. SDN can include any type of network or network topology. For example, SDN can include a software-defined wide area network (SD-WAN), a software-defined local area network (LAN), a software-defined metropolitan area network (MAN), or any other type of network. System 100 can include an internal network domain 105 and one or more external network domains. System 100 can include one or more edge network devices 110 (e.g., edge network devices 110a-110d), a control device 120, a communication network 130, and external network devices 140 and 141 (e.g., external network devices 140a-140d and 141a-141d).

[0027] For ease of explanation and clarity, some examples of this disclosure are described relative to a WAN, wherein the network is controlled at least partially by software rather than hardware. Thus, SDN can support various types of connectivity or communication links, such as the Internet, Multiprotocol Label Switching (MPLS) connections, and / or cellular connections (e.g., Long Term Evolution (LTE), LTE Advanced, WiMAX, Evolved High-Speed ​​Packet Access (HSPA+), and / or others). Furthermore, SDN can support load balancing or load sharing among various connections. Additionally, due to the distributed nature of some networks, SDN may support Virtual Private Networks (VPNs), firewalls, and other security services. For example, in SD-WAN, the control plane can be functionally separated from the physical topology. In some embodiments, SDN can separate the network's control plane (which will be managed by software) from the network's data plane (which operates on the network's hardware). As used herein, the term control plane can refer to the communications and connections used in the control and management of the network itself, rather than the data transmissions that may occur over the network in the data plane. As used herein, the term data plane can refer to the communications and connections used in the transmission and reception of data over the network. For example, the control plane may include management services directed to network devices within the network, while the data plane may include services that pass through network devices within the network.

[0028] In some embodiments, control device 120 may be configured to manage the control plane of internal network domain 105 through one or more aspects that guide the operation of edge network device 110. For example, control device 120 may generate and / or assign policies to one or more edge network devices 110. Policies may include one or a set of rules relating to the processing of network traffic (e.g., routing, prioritization, media, etc.). Internal network domain 105 may operate as a secure and controlled domain with specific functionalities and / or protocols. In some embodiments, edge network device 110 may operate based on one or more policies created and / or propagated by control device 120. In these and other embodiments, edge network device 110 may route data traffic within internal network domain 105 based on policies created and / or propagated by control device 120.

[0029] In some embodiments, control device 120 may form a control plane connection with each edge network device 110. The control plane connection may facilitate data exchange between edge network devices 110 and control device 120 for managing and controlling the internal network domain 105. The control plane connection may operate via a tunnel, such as a Datagram Transport Layer Security (DTLS) tunnel, through the communication network 130. In some embodiments, data transmitted through the control plane connection may facilitate control device 120 in determining the topology of the communication network 130. For example, control device 120 may communicate with edge network devices 110 to determine which physical connections exist between and within the edge network devices 110 in the communication network 130. Additionally or alternatively, data transmitted through the control plane connection may facilitate control device 120 in determining available, optimal, or desired paths on the communication network 130 between and within the edge network devices 110. Alternatively, data sent through the control plane connection may facilitate edge network devices 110 in determining available, optimal, or desired paths on the communication network 130 between and within the edge network devices 110. Alternatively, control device 120 may transmit routing information to edge network device 110 via a control plane connection. In these and other embodiments, the control plane connection may include a permanent connection between control device 120 and edge network device 110, such that if the connection between control device 120 and a given edge network device 110 is lost, the edge network device 110 may be unable or otherwise prevented from communicating through the internal network domain 105.

[0030] In some embodiments, control device 120 may maintain a central routing table that stores routing information within internal network domain 105. For example, control device 120 may communicate with various edge network devices 110 to determine if physical and / or logical connections are available to edge network devices 110 via communication network 130. In some embodiments, edge network devices 110 may include one or more physical and / or logical connections to each other. In these and other embodiments, control device 120 may combine the central routing table to generate and / or update one or more policies to help edge network devices 110 determine data service routes through internal network domain 105. For example, control device 120 may provide edge network devices 110 with policies and other configuration preferences related to service flows, rather than participating in each individual flow through internal network domain 105.

[0031] In these and other embodiments, edge network device 110 may not yet store the topology and / or routing paths of the entire system 100. Each edge network device 110 may not need to query each other individually to determine reachability. Instead, control device 120 can provide such information to the edge network. In these and other embodiments, edge network device 110 can route traffic based on one or more other policies received from control device 120, characteristics of the traffic, characteristics of the routing paths, source edge network device 110 and destination (e.g., edge network device 110), via the most direct route, the most cost-effective route, the most reliable route, or via some other route.

[0032] In some embodiments, one or more policies may include guidance on determining the next hop and routing path. For example, a particular policy may instruct a particular edge network device 110 where to route a traffic flow for a specific category, class, or group, rather than providing a complete end-to-end route for that traffic. For instance, edge network device 110a may receive data from external network device 140a destined for an address of external network device 141c. Edge network device 110a may store a first policy that it can use to determine the routing path for data, including that the “next hop” for network traffic destined for the address of external network device 141c should be routed to edge network device 110d.

[0033] In some embodiments, control device 120 may generate policies to direct certain network traffic flows within internal network domain 105 through certain types of connections or communication links (e.g., LTE, Internet, MPLS) and / or through certain edge network devices 110. In some embodiments, link classification may indicate the type of communication link. Edge network device 110 may make routing decisions in fast paths (e.g., when packets are traveling through the network). Edge network device 110 may use policies to determine actions. For example, for a given dataset, the policy may indicate that a first routing path can be selected based on configuration preferences and based on the type or classification of the communication link. Edge network device 110 may also determine actions (e.g., determine a route) for all packets from a specific source, all packets originating from a specific computer laptop, traffic type (e.g., voice), etc. In another example, the policy has configuration preferences that may indicate that all flows with IP addresses in the range 100.1 / 16 can be classified as voice flows. This occurs when edge network device 110 is connected to three different communication links (e.g., an Internet link, an MPLS link, and a cellular link). Configuration preferences can instruct voice traffic to be routed over the Internet link. Therefore, edge network device 110 can route all flows with IP addresses in the range 100.1 / 16 over the Internet link. Other examples of configuration preferences may include cost (e.g., money, time, route, hops), transmission conditions (e.g., loss, latency, and / or jitter), bandwidth, path geolocation, source (e.g., device, geolocation, user), destination (e.g., device, geolocation, user), application (e.g., business, social), and user group (e.g., finance on a first subnet IP, HR on a second subnet IP, engineering design on a third subnet IP, etc.). Any type of data or information can be used as configuration preferences. In the example, edge network device 110 may identify metadata associated with traffic, such as headers. Headers may include DSCP values ​​to indicate predefined routing paths. Edge network device 110 may also make routing decisions based on specific applications (sometimes referred to as Layer 7 headers or HTTP headers). For example, edge network device 110 may route OFFICE365 traffic on a first path and ensure SALESFORCE traffic on a second path.

[0034] In some embodiments, control device 120 may facilitate authentication of edge network device 110. Control device 120 may also facilitate data plane configuration. In at least some embodiments, to establish the data plane, edge network device 110 may generate a set of security association parameters for edge network device 110. The security association parameters may include information that other edge network devices can use to authenticate with and / or connect to edge network device 110. For example, security association parameters may include one or more keys, certificates, etc. Edge network device 110 may send the security association parameters to control device 120. Control device 120 may send the security association parameters to other edge network devices that are permitted to connect to edge network device 110. Further details of control device 120 are provided to facilitate integration. Figure 3-7 The configuration of the data plane and control plane is described.

[0035] In some embodiments, traffic between edge network devices 110 and traffic between edge network devices 110 and control device 120 may be encrypted via one or more datagram transport layer security (DTLS) and / or transport layer security (TLS) connections between edge network devices 110, such as using two-way authentication with Advanced Encryption Standard (AES) with a 256-bit long key.

[0036] In some embodiments, control device 120 may store authentication information for one or more (or all) edge network devices 110 within internal network domain 105. In these and other embodiments, devices may be prevented from communicating within internal network domain 105 unless they possess authentication information that matches or corresponds to the authentication information stored by control device 120. In some embodiments, the authentication information may be used first when edge network devices 110 come online to establish a control plane connection, and any device not having a control plane connection with control device 120 may be prevented from communicating within internal network domain 105.

[0037] Edge network device 110 can operate at the boundary of internal network domain 105. Edge network device 110 may include one or more physical devices and / or logical connections that can operate within internal network domain 105. Such connections may be described as part of communication network 130. Alternatively, edge network device 110 may include one or more physical and / or logical connections that operate outside internal network domain 105. For example, edge network device 110 may be connected to external network devices 140 and / or 141.

[0038] In some embodiments, edge network device 110 may be operable to route traffic from associated external network devices 140 and 141 to internal network domain 105. Alternatively, edge network device 110 may be operable to route traffic from internal network domain 105 to associated external network devices 140 and 141. In some embodiments, edge network device 110 may communicate with associated external network devices 140 and 141 using typical communication protocols such as Open Shortest Path First (OSPF), Border Gateway Protocol (BGP), Virtual Router Redundancy Protocol (VRRP), Bidirectional Forwarding Detection (BFD), etc. Additionally or alternatively, edge network device 110 may support other network functions, such as Differentiated Service Code Point (DSCP) marking or Type of Service (TOS) marking, Quality of Service (QoS) monitoring, Service Level Agreement (SLA), Internet Protocol (IP) forwarding, Internet Protocol Security (IPsec), Access Control Lists (ACLs), etc.

[0039] For example, using DSCP or TOS tags, edge network device 110 can be configured to insert DSCP or TOS tags into packet headers. Such DSCP or TOS tags can identify one (or a preference for one) of multiple communication links on which certain types of network traffic are transmitted. Based on the DSCP or TOS tags, edge network device 110 can route network traffic via one or more types of communication links.

[0040] As an additional example, using IPsec, edge network device 110 can use IPsec to authenticate and / or encrypt network traffic. For example, a given edge network device 110 can authenticate one or more computing devices to communicate with the given edge network device 110 and / or encrypt one or more packets communicating between the computing devices and the given edge network device 110.

[0041] As another example, using ACLs, edge network device 110 may include a set of rules indicating one or more addresses, hosts, and / or networks that can be permitted to use a given port or a specific communication link. In these and other embodiments, edge network device 110 may include ACLs applicable to inbound traffic, outbound traffic, or both.

[0042] In some embodiments, edge network device 110 may locally maintain one or more routing tables. In some embodiments, edge network device 110 may adjust or modify routing tables based on one or more policies sent from control device 120. For example, one or more entries may be removed, dropped, or otherwise not added to the routing table. Edge network device 110 may remove, drop, or otherwise not add one or more entries to the routing table based on one or more policies. In some embodiments, edge network device 110 may include logic for updating, modifying, and / or generating routing tables based on policies from control device 120 and / or based on traffic processed by edge network device 110. Edge network device 110 may automatically populate one or more routing tables based on direct interface routes, static routes, and / or dynamic routes learned using one or more network protocols such as BGP and / or OSPF. In some embodiments, routing decisions for data outside the internal network domain 105 may be performed by a specific edge network device 110 without specific direction, input, or control from control device 120. For example, a specific edge network device 110 may compute routing decisions based on one or more policies received by the specific edge network device 110 from control device 120.

[0043] In some embodiments, one or more edge network devices 110 and / or control devices 120 may be implemented as one or more virtual machines running on one or more physical computing devices. Additionally or alternatively, edge network devices 110 and / or control devices 120 may each include separate, independent computing devices.

[0044] Without departing from the scope of this disclosure, the following can be made: Figure 1 Modifications, additions, or omissions can be made. For example, although shown as including four edge network devices 110 and one control device 120, system 100 can include any number of edge network devices 110 and control devices 120, such as thousands or tens of thousands of edge network devices 110 and more than five control devices 120. As another example, as shown in a single communication network 130, communication network 130 can include various types of communication connections.

[0045] Figure 2 Another example system 200 implementing SDN network components according to one or more embodiments of the present disclosure is illustrated. System 200 may include one or more edge network devices 210 (e.g., edge network devices 210a-210o), one or more control devices 220 (e.g., control devices 220a, 220b, and 220c), and one or more communication networks 230 (e.g., communication networks 230a, 230b, and 230c). Edge network devices 210 may be connected to... Figure 1The edge network device 110 is similar to or equivalent to the control device 220. Figure 1 The control device 120 is similar to or equivalent to the control device 120, and the communication network 230 can be connected to... Figure 1 The communication network 130 is similar to or equivalent to that of the system 200. Figure 1 The system is similar to or comparable to 100, but can be extended to include other network components and other external network domains.

[0046] With relative to Figure 1 In a similar or equivalent manner to that described in System 100, System 200 may include an internal network domain 205 in and between edge network devices 210. System 200 may also include multiple external network domains. For example, data center 240 may represent a first external network domain, campus 250 may represent a second external network domain, branch 260 may represent a third external network domain, and remote site 270 may represent a fourth external network domain. In these and other embodiments, each external network domain may include one or more edge network devices 210 that act as bridges between the internal network domain 205 and the given external network domain. Additionally or alternatively, one or more external network domains may be functionally operable as accessible from other external network domains, just as in a single network, by being communicatively coupled from the internal network domain 205.

[0047] In some embodiments, system 200 may include one or more external resources 280 (such as external resources 280a-280c). External resources 280 may be operated by the same entity or organization operating the internal network domain 205, or they may be operated by different entities. In these and other embodiments, system 200 may include an edge network device 210 that can be associated with a specific external resource 280. For example, system 200 may include an edge network device 210 located in a regional colocation facility. A regional colocation facility may include a location having directional or guaranteed access to the Internet or other communication protocols at a given physical location. In some embodiments, a regional colocation facility may include a preferred or enhanced connection to one or more external resources 280. In some embodiments, a regional colocation facility may be located in a designated geographic location physically adjacent to one or more external network domains. For example, data center 240 may be located in New York, branch office 260 may be located in Dallas, Texas, and edge network device 210n may be located in a regional colocation facility in Houston, Texas.

[0048] External resource 280 may include any computing services that can be consumed by system 200. For example, external resource 280 may include cloud-based services such as software subscriptions or Software as a Service (SaaS) (such as Microsoft...). Amazon and / or other), media services (e.g. (and / or other) and / or other. In these and other embodiments, external resource 280 may include a third-party network to facilitate access to external resource 280 using one or more access points in various geographic locations. For example, SaaS may include access servers in Austin, Texas, Palo Alto, California, and New York to access third-party networks.

[0049] In some embodiments, system 200 may be geographically distributed. For example, data center 240 may be located in St. Paul, Minnesota; campus 250 may be located in Des Moines, Iowa; branch offices 260 may be located in Seattle, Washington; Los Angeles, California; Atlanta, Georgia; and Orlando, Florida; and remote sites 270 may be located in London, UK; Berlin, Germany; and Seoul, South Korea. In these and other embodiments, system 200 may use communication network 230 and internal network domain 205 to facilitate communication between all these distributed physical locations as a single network.

[0050] In some embodiments, one or more external network domains may use one or more applications that have resources in data center 240, such as Microsoft. Oracle And / or others. For example, workstations running on campus 250 can run Microsoft... Application operations may include data flows from workstations to edge network device 210e in an external network domain of campus 250. Data flows can travel from edge network device 210e to one of edge network devices 210b, 210c, and / or 210d associated with data center 240 via internal network domain 205. One of edge network devices 210b, 210c, and / or 210d can route traffic to Microsoft in the external network domain of data center 240. In addition, application operations can include communication with Microsoft servers. The data flow from the server to the workstation is the opposite of the data flow.

[0051] In some embodiments, system 200 may include a network management device 290 that can communicate with control device 220 via management network 232. Network management device 290 can provide management and control of one or more devices associated with internal network domain 205, including edge network device 210, control device 220, and / or others. For example, network management device 290 can provide a graphical user interface (GUI) that provides network administrators with access to control or observe the operation of internal network domain 205. In some embodiments, network administrators can input policies via network management device 290, which can be passed to control device 220 via edge network device 210 for implementation. In some embodiments, network management device 290 can provide a visual and / or textual description of one or more attributes of internal network domain 205 for a GUI dashboard, such as the number and / or status and / or operational status of edge network devices 210, the number and / or status of control devices 220, the number and / or last restart, transmission operational status (e.g., loss, latency, and / or jitter), the number of running or non-running sites, application consumption of network resources, application routing, and / or others.

[0052] In some embodiments, network management device 290 may be configured to verify and / or identify approved edge network devices 210 and / or control devices 220. For example, network management device 290 may maintain a list of serial numbers, MAC addresses or security association parameters, and other unique identification information for edge network devices 210 and / or control devices 220. In these and other embodiments, communication within the internal network domain 205 may be limited to edge network devices 210 and / or control devices 220, which have identification information on the list maintained by network management device 290.

[0053] In some embodiments, network management device 290 may be configured to generate and / or store configurations for one or more edge network devices 210 and / or control devices 220. For example, a network administrator may use network management device 290 to configure a specific edge network device 210 and store that configuration as a template that can be applied to future edge network devices. Alternatively or additionally, a template for edge network device 210 may be provided by a third party and applied to a new edge network device 210. In these and other embodiments, a template for control device 220 may be generated, stored, and applied to a new control device 220. Additionally or additionally, such a template may be used to automatically configure newly deployed edge network devices 210. For example, a newly deployed edge network device 210 may be online and connected to a corresponding control device 220. The corresponding control device 220 may verify the serial number of the edge network device 210 with network management device 290 and may obtain a template for the edge network device 210 from network management device 290. Control device 220 may send the template to edge network device 210 to automatically install and configure the edge network device 210 according to the template.

[0054] In some embodiments, network management device 290 may be implemented as a physical device or a virtual machine. In these and other embodiments, network management device 290 may be physically located near a central location, such as within data center 240 or campus 250.

[0055] Without departing from the scope of this disclosure, the following can be made: Figure 2 Modifications, additions, or omissions may be made. For example, although shown as including a certain number of edge network devices 210 and external network domains, system 200 may include any number of edge network devices 210 and external network domains.

[0056] Figure 3 An example system 300 is shown, implemented in a control plane 305 according to one or more embodiments of the present disclosure. Figure 3 A control device 320 is shown, which may include multiple potential communication links for communicating with edge network devices 310a, 310b, and 310c via a control plane 305. The control plane 305 may be implemented in a secure and / or private network. For example, the control device 320 may communicate on the control plane 305 using a dedicated transmitter 365. Edge network devices 310a and 310b may communicate with… Figure 1 Edge network devices 110 and / or Figure 2 The edge network devices 210a-210o are similar to or equivalent to these. The control device 420 can be with... Figure 1 Control device 120 and / or Figure 2It is similar to or equivalent to 220. Any number of control devices can be used.

[0057] Control device 320 can support control plane 305 between edge network devices 310. Control device 320 can receive and advertise routing and encryption information between edge network devices 310. Edge network devices 310 can establish data plane connections with each other without establishing control plane channels, such as in combination. Figure 4 Further description.

[0058] In at least some embodiments, system 300 may include a network management device 390 that can communicate with control device 220 via management network 232. Network management device 290 may provide management and control of one or more devices, including edge network device 310, control device 320, and / or others, via a passive portion of control plane 315. Devices may connect to and communicate with network management device 390 via the passive portion of control plane 315. Network management device 390 may... Figure 2 The network management equipment is similar to or comparable to 290.

[0059] In at least some embodiments, network management device 390 may be responsible for assisting in discovering Network Address Translation (NAT) traversal information for each connected endpoint (e.g., edge network device 310, control device 320, and / or others). Network management device 390 may also provide location and session information to control device 320 and may communicate with edge network device 310 and / or other control devices (in... Figure 3 (Not shown) Shared session information. In at least some embodiments, system 300 may include a public network 370. A data plane may be established without traversing the public network 370. In these embodiments, a first network management device 390a may coordinate activities for a private network 365, while a second network management device 390b may coordinate activities for a second public network 370. For example, when the public network 370 includes the Internet, the second network management device 390b may assist with Internet-specific NAT traversal.

[0060] In at least some embodiments, edge network device 310 may receive one or more keys associated with other edge network devices 310 via control plane 305 from control device 310. For example, when transmitting data from one edge network device 310 to another edge network device 310, one or more data packets may use one or more keys for security purposes. In these and other embodiments, control device 320 may reflect the received keys to one or more other edge network devices 310 based on a central routing table and / or policies implemented by control device 320. In these and other embodiments, a given edge network device 310 may generate a symmetric key to facilitate the data plane (e.g., Figure 4 The data plane 405 is established to enable secure communication between edge network devices. In these and other embodiments, a pair of symmetric keys can be generated by a given edge network device 310, one symmetric key is retained in the given edge network device 310, and the other symmetric key is provided to the control device 320, so that the control device 320 can distribute the other symmetric key to other edge network devices communicating with the given edge network device 310 through the control plane 305 (rather than the data plane). In this way, each edge network device communicating with the given edge network device 310 based on the policy of the control device 320 can receive the symmetric key outside the data plane.

[0061] Without departing from the scope of this disclosure, the following can be made: Figure 3 Modifications, additions, or omissions can be made. For example, although shown as including a certain number of edge network devices 310, system 300 may include any number of edge network devices 310. As another example, although shown as including one control device 320, any number of control devices can be used. As another example, although shown as including two network management devices, any number of network management devices can be used. As another example, although shown as including a private network 365 and a public network 370, any number of private and public networks can be used.

[0062] Figure 4 Another example system 400 is illustrated, implementing a data plane 405 according to one or more embodiments of the present disclosure. System 400 may include Figure 3 The control plane 305, edge network device 310, control device 320 and network management device 390.

[0063] The control plane 305 can be implemented in a private network 365 and can use active signaling. The data plane 405 can be independent and separate from the control plane, and can be implemented in a public network 370. The control plane 305 can provide decoupled path functionality relative to the data plane 405. For example, system 300 includes a private network 365 and a public network 370, although the two networks can be of the same type, such as both being private or both being public.

[0064] For paths using the private network 365, each edge network device 310 can authenticate with the network management device 390 (if the network management device is part of system 400) and then with the control device 320. The edge network device 310 advertises the encryption key to the control device 320. The control device can then advertise endpoint information (e.g., security association parameters), including the encryption key, to each of all other edge network devices 310 except the target. Based on the information received from the control device 320, the edge network device 310 can proactively establish a data plane 405, including establishing encryption along the data plane 405, with all other endpoints attached to the private network 365.

[0065] For paths using public network 370, each edge network device 310 can authenticate with network management device 390, which can provide edge network device 310 with potential NAT traversal information. Edge network device 310 can advertise the encryption key for the Internet path to control device 320. Control device 320 can then advertise this additional endpoint information, containing the encryption key, to each endpoint of all other endpoints except the target edge device 310. Each edge network device 310 now establishes an encrypted data plane 405 on public (e.g., Internet) paths without sending encryption-related information on the same path.

[0066] Without departing from the scope of this disclosure, the following can be made: Figure 4 Modifications, additions, or omissions can be made. For example, although shown as including a certain number of edge network devices 310, system 400 may include any number of edge network devices 310. As another example, although shown as including one control device 320, any number of control devices can be used. As another example, although shown as including two network management devices 390, any number of network management devices can be used. As another example, although shown as including a private network 365 and a public network 370, any number of private and public networks can be used.

[0067] Figure 5A flowchart illustrating an example method 500 for establishing a control plane and a data plane within an SDN according to one or more embodiments of the present disclosure is shown. This method can be executed by processing logic, which may include hardware (circuit, dedicated logic, etc.), software (e.g., software running on a general-purpose computer system or a dedicated machine), or a combination of both. This processing logic can be included in any network device (e.g., Figure 1-4 The methods may be performed in edge network devices 110, 210, or 310, or in another computer system or device. However, other systems or combinations of systems may be used to perform these methods. For simplicity, the methods described herein are depicted and described as a series of actions. However, actions according to this disclosure may occur in various orders and / or simultaneously, and other actions not presented and described herein. Furthermore, not all actions shown can be used to implement the methods according to the disclosed subject matter. Additionally, those skilled in the art will understand and recognize that the methods may alternatively be represented as a series of interrelated states via state diagrams or events. Furthermore, the methods disclosed in this specification can be stored on an article of writing, such as a non-transitory computer-readable medium, to facilitate the transfer and assignment of such methods to a computing device. The term "article of writing" as used herein is intended to encompass a computer program accessible from any computer-readable device or storage medium. Although shown as discrete blocks, various blocks may be divided into additional blocks, combined into fewer blocks, or eliminated, depending on the desired implementation.

[0068] Method 500 may begin at block 505, where processing logic may determine the type of control channel to be opened across transports in a software-defined network (SDN). The processing logic may locally discover the type of control channel by identifying one or more transports communicatively coupled to the processing logic and / or the corresponding edge network device. The transport type may influence the type of control channel. The processing logic may also determine how many control channels to open in each transport. In at least some embodiments, the processing logic may establish one control channel across each transport. In at least some embodiments, the processing logic may establish multiple control channels across one or more transports. In at least some embodiments, the processing logic may establish a specific number of control channels based on the transport type. For example, a transport type with higher security and / or bandwidth may have more control channels compared to other transport types.

[0069] At block 510, the processing logic may establish a control channel with a control device via a control plane separate from the data plane. In at least some embodiments, the processing logic may establish the type and number of control channels as defined in block 505. The control channel may include a security control channel. The processing logic may also communicate with one or more network management devices (e.g., respectively). Figure 2 and Figure 3The network management device (290 or 390) establishes one or more control channels. In this example, the system may include MPLS transport and Internet transport. The processing logic may establish at least one control channel on MPLS transport and at least one control channel on Internet transport.

[0070] At block 515, the processing logic may determine potential Network Address Translation (NAT) for upstream paths toward the control device and / or the network management device. In at least some embodiments, the processing logic may determine NAT for public networks. The processing logic may trace one or more paths to the control device and / or the network management device, while noting any NAT that may occur along those paths. The processing device may store the NAT in a data store.

[0071] At block 520, the processing logic may advertise a first security association parameter to the control device via a control channel. In at least some embodiments, the processing logic may generate the first security association parameter. The first security association parameter may be associated with a first edge network device. The processing logic may authenticate the control device using an authentication protocol. In at least some embodiments, the processing logic may authenticate the network management device before authenticating the control device. The first security association parameter may include a key, key pair, set of keys, certificate, token, or any other object that a device can use to identify, authenticate, and connect to the first edge network device via a channel other than the control channel. The control device may receive the first security association parameter and may receive other security association parameters from other devices. The control device may send some, any, or all of the received security association parameters to authorized devices, such as in combination. Figure 6 Further description.

[0072] At block 525, the processing logic can receive a second security association parameter associated with the second network device from the control device via a control channel. At block 530, the processing logic can use the second security association parameter to establish a data plane connection with the second network device.

[0073] Those skilled in the art will recognize that the functions and / or operations performed for these processes, operations, and methods can be implemented in different orders. Furthermore, the functions and operations outlined are provided by way of example only, and some functions and operations may be optional, may be combined into fewer functions and operations, or may be extended to additional functions and operations without departing from the spirit of the disclosed embodiments.

[0074] Figure 6A flowchart of another example method 600 for establishing a control plane and a data plane within an SDN according to one or more embodiments of the present disclosure is shown. This method can be executed by processing logic, which may include hardware (circuit, dedicated logic, etc.), software (e.g., software running on a general-purpose computer system or a dedicated machine), or a combination of both. This processing logic may be included in any control device (e.g., Figure 1-4 The methods may be implemented in a control device (120, 220, or 320) or other computer system or device. However, other systems or combinations of systems may be used to perform these methods. For simplicity, the methods described herein are depicted and described as a series of actions. However, the actions according to this disclosure may occur in various orders and / or simultaneously, and other actions are not presented or described herein. Furthermore, not all actions shown can be used to implement the methods according to the disclosed subject matter. Additionally, those skilled in the art will understand and recognize that the methods may alternatively be represented as a series of interrelated states via state diagrams or events. Furthermore, the methods disclosed in this specification can be stored on an article of writing, such as a non-transitory computer-readable medium, to facilitate the transfer and assignment of such methods to a computing device. The term "article of writing" as used herein is intended to encompass a computer program accessible from any computer-readable device or storage medium. Although shown as discrete blocks, the various blocks may be divided into additional blocks, combined into fewer blocks, or eliminated, depending on the desired implementation.

[0075] Method 600 may begin at block 605, wherein processing logic may receive a first security association parameter from a first network device via a first control channel associated with the control plane. Similarly, at block 610, processing logic may receive a second security association parameter from a second network device via a second control channel associated with the control plane. The processing logic may receive any number of security association parameters from any number of network devices.

[0076] In box 615, the processing logic may determine that the first network device and the second network device are associated with each other. For example, the processing logic may determine that the first network device and the second network device are associated with a single entity (e.g., a company) and are therefore allowed to connect to each other via the data plane.

[0077] In block 620, the processing logic can send a first security association parameter to the second network device. Similarly, in block 625, the processing logic can send a second security association parameter to the first network device. Using the exchange of security association parameters shared via the control plane (rather than the data plane), the first and second network devices can establish a data plane between each other.

[0078] Those skilled in the art will recognize that the functions and / or operations performed for these processes, operations, and methods may be implemented in different orders. Furthermore, the functions and operations outlined are provided by way of example only, and some functions and operations may be optional, may be combined into fewer functions and operations, or may be extended to additional functions and operations without departing from the spirit of the disclosed embodiments.

[0079] Figure 7 A flowchart of another example method 700 for establishing a control plane and a data plane within an SDN according to one or more embodiments of the present disclosure is shown. This method can be executed by processing logic, which may include hardware (circuit, dedicated logic, etc.), software (e.g., software running on a general-purpose computer system or a dedicated machine), or a combination of both. This processing logic may be included in any control device (e.g., Figure 1-4 Control devices 120, 220 or 320), network devices (e.g., Figure 1-4 The methods may be implemented in edge network devices 110, 210, or 310, or other computer systems or devices. However, other systems or combinations of systems may be used to perform these methods. For simplicity, the methods described herein are depicted and described as a series of actions. However, the actions according to this disclosure may occur in various orders and / or simultaneously, and other actions are not presented or described herein. Furthermore, not all actions shown can be used to implement the methods according to the disclosed subject matter. Additionally, those skilled in the art will understand and recognize that the methods may alternatively be represented as a series of interrelated states via state diagrams or events. Furthermore, the methods disclosed in this specification can be stored on an article of writing, such as a non-transitory computer-readable medium, to facilitate the transfer and assignment of such methods to computing devices. The term "article of writing" as used herein is intended to encompass a computer program accessible from any computer-readable device or storage medium. Although shown as discrete blocks, the various blocks may be divided into additional blocks, combined into fewer blocks, or eliminated, depending on the desired implementation.

[0080] For ease of interpretation, the processing logic can be associated with an edge network device having two transport connections (one to a private network and one to a public network (e.g., the Internet)). In method 700, as described below, a list of transport connections can be generated and later used to establish data plane sessions with various devices. Data plane sessions can be established serially or at least partially in parallel.

[0081] Method 700 may begin at block 705, where processing logic may determine whether a management device is configured for a specific transport. When the management device is not configured for a specific transport at block 705 (e.g., "No"), the processing logic may determine at block 710 whether there are any other transports. When there are any other transports at block 710 (e.g., "Yes"), the processing logic may configure the management device for the other transports and proceed to block 705.

[0082] When the management device is configured for a specific transport at box 705 (e.g., "Yes"), the processing logic can establish a connection with the management device at box 715 and begin collecting Network Address Translation (NAT) information. At box 720, the processing logic can determine whether a control device is present in the network. At box 720, if the control device is present with the network (e.g., "Yes"), the processing logic can establish a control plane session with the control device at box 725. The processing logic can then proceed to box 710.

[0083] At box 705, when the control device is not present with the network (e.g., "No"), the processing logic can determine at box 710 whether other transmissions are available. When there are no other transmissions at box 710 (e.g., "No"), at box 730, the processing logic can determine whether control sessions have been established for all transmissions.

[0084] When a control session is established for all transmissions at box 730 (e.g., "Yes"), the processing logic can establish data plane connections with other authorized edge network devices. When a control session has not yet been established for all transmissions at box 730 (e.g., "No"), the processing logic at box 740 can wait for other transmissions to become available.

[0085] Those skilled in the art will recognize that the functions and / or operations performed for these processes, operations, and methods can be implemented in different orders. Furthermore, the functions and operations outlined are provided by way of example only, and some functions and operations may be optional, combined into fewer functions and operations, or extended to other functions and operations without departing from the spirit of the disclosed embodiments.

[0086] Figure 8 An example computing system 800 according to at least one embodiment described in this disclosure is illustrated. System 800 may include any suitable system, apparatus, or device configured to test software. Computing system 800 may include a processor 810, a memory 820, a data storage 830, and a communication unit 840, all of which may be communicatively coupled. In some embodiments, any network device (e.g., Figure 1-4 Edge network devices 110, 210, or 310), control devices (e.g., Figure 1-4The control device 120, 220 or 320 or other computing device disclosed herein may be implemented as computing system 800. Alternatively or additionally, one or more of the network device, control device, local computing device or other computing device may be implemented as a virtual machine (e.g., computing system 800) running on a physical computing system.

[0087] Typically, processor 810 may include any suitable special-purpose or general-purpose computer, computing entity, or processing device comprising various computer hardware or software modules, and may be configured to execute instructions stored on any suitable computer-readable storage medium. For example, processor 810 may include a microprocessor, microcontroller, digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or any other digital or analog circuit configured to interpret and / or execute program instructions and / or process data.

[0088] Despite Figure 8 While shown as a single processor, it should be understood that processor 810 may include any number of processors distributed across any number of networks or physical locations, configured to perform any number of operations described herein, individually or collectively. In some embodiments, processor 810 may interpret and / or execute program instructions stored in memory 820, data storage 830, or both memory 820 and data storage 830, and / or process data. In some embodiments, processor 810 may retrieve program instructions from data storage 830 and load the program instructions into memory 820.

[0089] After the program instructions are loaded into memory 820, processor 810 can execute the program instructions, such as executing them separately. Figure 5-7 The instructions in methods 500, 600, and / or 700 are applicable. For example, processor 810 can determine that a traffic flow is associated with a rerouting application and reroute the traffic flow along the path with the best performance score. As another example, processor 810 can rewrite DNS queries and / or DNS responses. As yet another example, processor 810 can route traffic so that the NAT egress point associated with the rerouted path can be used. As yet another example, processor 810 can determine which path from multiple paths is the optimal path and reroute the traffic accordingly.

[0090] Memory 820 and data storage 830 may include computer-readable storage media or one or more computer-readable storage media for carrying or having computer-executable instructions or data structures stored thereon. Such computer-readable storage media may be any available medium accessible by a general-purpose or special-purpose computer (e.g., processor 810). In some embodiments, computing system 800 may or may not include either memory 820 and data storage 830.

[0091] By way of example, and not limitation, such computer-readable storage media may include non-transitory computer-readable storage media, including random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), optical disc read-only memory (CD-ROM) or other optical disc storage devices, magnetic disk storage devices or other magnetic storage devices, flash memory devices (e.g., solid-state storage devices), or any other storage medium that can be used to carry or store required program code in the form of computer-executable instructions or data structures on a hard disk, and any other storage medium that can be accessed by a general-purpose or special-purpose computer. Combinations of the above may also be included within the scope of computer-readable storage media. Computer-executable instructions may include, for example, instructions and data configured to cause processor 810 to perform a specific operation or a set of operations.

[0092] Communication unit 840 may include any component, device, system, or combination thereof configured to send or receive information via a network such as an MPLS connection, the Internet, a cellular network (e.g., an LTE network). In some embodiments, communication unit 840 may communicate with other devices of other components located elsewhere, in the same location, or even within the same system. For example, communication unit 840 may include a modem, a network interface card (NIC) (wireless or wired), an optical communication device, an infrared communication device, a wireless communication device (e.g., an antenna), a chipset (e.g., a Bluetooth device), an 802.6 device (e.g., a metropolitan area network (MAN), a WiFi device, a WiMax device, a cellular communication facility, etc.), and / or any combination thereof. Communication unit 840 may allow the exchange of data with the networks and / or any other devices or systems described in this disclosure. For example, communication unit 840 may allow system 800 to communicate with other systems, such as network devices, control devices, and / or other networks.

[0093] Modifications, additions, or omissions may be made to system 800 without departing from the scope of this disclosure. For example, data storage 830 may be multiple different storage media located in multiple locations and accessed by processor 810 via a network.

[0094] As described above, the embodiments described in this disclosure may include the use of a dedicated or general-purpose computer that includes various computer hardware or software modules (e.g., Figure 8 The processor 810, as discussed in more detail below. Furthermore, as mentioned above, a computer-readable medium (e.g., Figure 8 The embodiments described in this disclosure are implemented using a memory 820 or a data storage 830, wherein the computer-readable medium is used to carry or have computer-executable instructions or data structures stored thereon.

[0095] As used in this disclosure, the terms "module" or "component" can refer to a specific hardware implementation configured to perform actions of a module or component and / or a software object or software routine that can be stored and / or executed by general-purpose hardware (e.g., a computer-readable medium, processing device, or certain other hardware) of a computing system. In some embodiments, the different components, modules, engines, and services described in this disclosure can be implemented as objects or processes (e.g., as separate threads) that execute on a computing system. Although some systems and methods described in this disclosure are generally described as being implemented in software (stored on and / or executed by general-purpose hardware), specific hardware implementations or combinations of software with specific hardware implementations are possible and contemplated. In this description, a "computing entity" can be any computing system as previously defined in this disclosure, or any module or combination of modules running on a computing system.

[0096] As is customary, the various features shown in the accompanying drawings may not be drawn to scale. The illustrations presented in this disclosure are not intended to be actual views of any particular device (e.g., apparatus, system, etc.) or method, but are merely idealized representations used to describe various embodiments of this disclosure. Therefore, the dimensions of various features may be arbitrarily enlarged or reduced for clarity. Additionally, some figures may be simplified for clarity. Consequently, the figures may not depict all components of a given device (e.g., apparatus) or all operations of a particular method.

[0097] The terms used in this disclosure and particularly in the appended claims (e.g., the body of the appended claims) are generally intended to be “open” terms (e.g., the term “comprising” should be interpreted as “including but not limited to”, the term “having” should be interpreted as “at least having”, and the term “including” should be interpreted as “including but not limited to”).

[0098] Furthermore, if the intent is to introduce a specific number of claims, then that intent will be explicitly stated in the claims, and without such a statement, the intent does not exist. For example, to aid understanding, the appended claims may include the use of the introductory phrases “at least one” and “one or more” to introduce the claims.

[0099] Furthermore, even when a specific number is explicitly stated in the claims, those skilled in the art will recognize that such a statement should be interpreted as meaning at least the number stated (e.g., a bare statement of "two statements" (without other modifiers) means at least two statements, or two or more statements). Additionally, in these instances where conventions such as "at least one of A, B, and C" or "one or more of A, B, and C" are used, such a construction is generally intended to include A alone, B alone, C alone, A and B together, A and C together, B and C together, or A, B, and C together, etc.

[0100] Furthermore, any ambiguous words or phrases presenting two or more alternative terms in the specification, claims, or drawings should be understood to include the possibility of including one term, either one of the two terms, or both terms. For example, the phrase "A or B" should be understood to include the possibility of including "A" or "B" or "A and B".

[0101] However, the use of such phrases should not be construed as implying that a claim statement introduced by the indefinite article “a(a)” or “an(an)” limits any particular claim containing such an introduced claim statement to an implementation containing only one such statement, even if the same claim includes the introductory phrases “one or more” or “at least one” and indefinite articles such as “a(a)” or “an(an)” (e.g., “a(a)” and / or “an(an)” should also be construed as referring to “at least one” or “one or more”); the same applies to the use of definite articles for introducing claim statements.

[0102] Furthermore, the use of terms such as "first," "second," and "third" in this document does not necessarily indicate a specific order or quantity of elements. Generally, the terms "first," "second," and "third" are used to distinguish different elements as general identifiers. Unless explicitly stated otherwise, these terms should not be construed as indicating a specific order. Similarly, unless explicitly stated as indicating a specific number of elements, these terms should not be construed as indicating a specific number of elements. For example, a first component may be described as having a first side, while a second component may be described as having a second side. Using the term "second side" relative to the second component may distinguish this side of the second component from the "first side" of the first component, rather than implying that the second component has two sides.

[0103] All examples and conditional language cited in this disclosure are intended for educational purposes to aid the reader in understanding the invention and the concepts made by the inventors for further development of the art, and should be construed as not being limited to the examples and conditions listed. Although embodiments of this disclosure have been described in detail, it should be understood that various changes, substitutions, and modifications can be made thereto without departing from the spirit and scope of this disclosure.

Claims

1. A method for computer communication, comprising: At the controller of the first network, a first security association parameter is received from the first network device via the control plane for establishing a data plane with the first network device; At the controller, a second security association parameter is received from the second network device via the control plane for establishing the data plane with the second network device; At the controller, based on the fact that the first network device and the second network device are associated with the same entity, it is determined that the first network device and the second network device are allowed to connect to each other via the data plane, which is at least partially extended through the second network, wherein the control plane provides separate path functionality for the data plane that is at least partially extended through the second network; as well as The first security association parameter is sent from the controller to the second network device through the control plane to establish the data plane with the first network device through the second network.

2. The method according to claim 1, further comprising suppressing the transmission of the first security association parameter to the second network device via the controller.

3. The method according to claim 1, wherein, The second network is a public network.

4. The method according to claim 1, wherein, The first network is a private network.

5. The method of claim 1, further comprising sending the second security association parameter from the controller to the first network device through the control plane for establishing the data plane with the second network device through the second network.

6. The method according to claim 1, wherein, The first network device and the second network device are configured to suppress the establishment of one or more control plane channels in the control plane between them.

7. The method according to claim 1, further comprising: At the controller, a symmetric key from a symmetric key pair generated by the second network device is received from the second network device via the control plane as part of the first security association parameter, wherein the symmetric key pair is generated for establishing the data plane with the second network device; and Based on the symmetric key pair, the symmetric key is sent from the controller to the first network device through the control plane to establish the data plane with the second network device through the second network.

8. A system for computer communication, comprising: One or more processors of the controller of the first network; and A non-transitory computer-readable medium, including instructions stored therein, which, when executed by the one or more processors, cause the controller to perform the following operations: The first security association parameter is received from the first network device through the control plane for use in establishing a data plane with the first network device; The control plane receives a second security association parameter from the second network device for use in establishing the data plane with the second network device. Based on the fact that the first network device and the second network device are associated with the same entity, it is determined that the first network device and the second network device are allowed to connect to each other via the data plane, which is at least partially extended through the second network, wherein the control plane provides separate path functionality for the data plane that is at least partially extended through the second network; as well as The first security association parameter is sent to the second network device through the control plane to establish the data plane with the first network device through the second network.

9. The system according to claim 8, wherein, When executed by the one or more processors, the instruction also causes the controller to suppress the transmission of the first security association parameter to the second network device via the second network.

10. The system according to claim 8, wherein, The second network is a public network.

11. The system according to claim 8, wherein, The first network is a private network.

12. The system according to claim 8, wherein, When the instruction is executed by the one or more processors, it also causes the controller to send the second security association parameter to the first network device through the control plane, for establishing the data plane with the second network device through the second network.

13. The system according to claim 8, wherein, The first network device and the second network device are configured to suppress the establishment of one or more control plane channels in the control plane between them.

14. The system according to claim 8, wherein, When the instructions are executed by the one or more processors, the controller also causes the controller to: The control plane receives a symmetric key from the symmetric key pair generated by the second network device as part of the first security association parameter, wherein the symmetric key pair is generated for establishing the data plane with the second network device; and Based on the symmetric key pair, the symmetric key is sent to the first network device through the control plane for establishing the data plane with the second network device through the second network.

15. A non-transitory computer-readable storage medium comprising instructions stored therein, the instructions, when executed by one or more processors, causing the one or more processors to perform the following operations: At the controller of the first network, a first security association parameter is received from the first network device via the control plane for establishing a data plane with the first network device; At the controller, a second security association parameter is received from the second network device via the control plane for establishing the data plane with the second network device; At the controller, based on the fact that the first network device and the second network device are associated with the same entity, it is determined that the first network device and the second network device are permitted to connect to each other via the data plane, which extends at least partially through the second network, wherein... The control plane provides separate path functionality for the data plane, which extends at least partially through the second network; as well as The first security association parameter is sent from the controller to the second network device through the control plane to establish the data plane with the first network device through the second network.

16. The non-transitory computer-readable storage medium according to claim 15, wherein, The second network is a public network, and the first network is a private network.

17. The non-transitory computer-readable storage medium according to claim 15, wherein, When the instruction is executed by the one or more processors, it further causes the controller to suppress the transmission of the first security association parameter to the second network device via the second network.

18. The non-transitory computer-readable storage medium according to claim 15, wherein, When the instruction is executed by the one or more processors, it further causes the controller to send the second security association parameter to the first network device through the control plane, so as to establish the data plane with the second network device through the second network.

Images