Packet authentication method, system, and program in a VXLAN system

Abstract

A packet authentication method and system in a VXLAN system, in which a token is first obtained in a first agent device included in the network system, the token is for authenticating a first packet transmitted in the network system, the first packet is generated according to a first network format, a second packet is generated according to a second network format based on the first packet and the token, and the second packet is transmitted to a second agent device included in the network system, where both the first agent device and the second agent device support the first network format and the second network format. These embodiments can authenticate packets in a more effective manner.

Description

[Technical Field]

[0001] The present disclosure relates to packet authentication, and more particularly to packet authentication in a Virtual Extensible Local Area Network (VXLAN) system. [Background technology]

[0002] In recent years, Virtual Extensible Local Area Networks (VXLANs) have been widely used in network systems to meet the demands of large-scale data centers and multi-tenant environments. For example, a VXLAN tunnel can be built between two Ethernet data centers. VXLAN uses VXLAN-like encapsulation technology to encapsulate Ethernet packets generated in the Ethernet data center and then transmit the encapsulated packets through the VXLAN tunnel. Summary of the Invention

[0003] According to an embodiment of the present disclosure, a computer-implemented method implemented by one or more processors is provided. In the method, the one or more processors acquire, at a first agent device included in a network system, a token for authenticating a first packet to be transmitted in the network system, the first packet being generated according to a first network format. The one or more processors generate a second packet based on the first packet and the token according to a second network format. The one or more processors transmit the second packet to a second agent device included in the network system, where both the first agent device and the second agent device support the first network format and the second network format.

[0004] According to an embodiment of the present disclosure, a computer-implemented method implemented by one or more processors is provided. In the method, the one or more processors receive a second packet from a first agent device included in a network system, the second packet being received at a second agent device included in the network system. The one or more processors determine whether the second packet matches a second token for authenticating the first packet transmitted over the network system. In response to determining that the second packet matches the second token, the one or more processors forward the first packet included in a data field of the second packet, the first packet being generated according to a first network format and the second packet being generated according to a second network format. Here, both the first agent device and the second agent device support the first network format and the second network format.

[0005] According to another embodiment of the present disclosure, there is provided a computer-implemented system comprising a computer processor coupled to a computer-readable memory unit, the memory unit containing instructions that, when executed by the computer processor, implement the above-described method.

[0006] According to another embodiment of the present disclosure, there is provided a computer program product, the computer program product including a computer-readable storage medium having program instructions embodied therein, the program instructions being executable by an electronic device to cause the electronic device to perform the operations of the above-described method.

[0007] These and other objects, features, and advantages of the present disclosure will become more apparent from a more detailed description of several embodiments of the present disclosure in the accompanying drawings. In the embodiments of the present disclosure, like reference numerals generally refer to like elements. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 illustrates a cloud computing node according to an embodiment of the present disclosure. [Figure 2] FIG. 1 illustrates a cloud computing environment according to an embodiment of the present disclosure. [Figure 3] FIG. 1 illustrates abstraction model layers according to an embodiment of the present disclosure. [Figure 4] FIG. 1 illustrates an exemplary network system in which embodiments of the present disclosure may be implemented. [Figure 5] FIG. 1 illustrates an exemplary procedure for authenticating packets in a network system, according to an embodiment of the present disclosure. [Figure 6] FIG. 1 is an exemplary diagram including components for authenticating packets in a network system according to an embodiment of the present disclosure. [Figure 7] FIG. 1 illustrates an exemplary procedure for authenticating packets in a network system, according to an embodiment of the present disclosure. [Figure 8A] FIG. 2 illustrates an exemplary data structure in Ethernet format, according to an embodiment of the present disclosure. [Figure 8B] FIG. 2 illustrates an exemplary data structure in VXLAN format, according to an embodiment of the present disclosure. [Figure 9] FIG. 1 illustrates a detailed procedure for authenticating packets in a network system according to an embodiment of the present disclosure. [Figure 10] FIG. 1 illustrates an exemplary architecture of a network system according to an embodiment of the present disclosure. [Figure 11A] 10 is an exemplary flowchart of a method for authenticating a packet at an agent device according to an embodiment of the present disclosure. [Figure 11B] 10 is an exemplary flowchart of a method for authenticating a packet with another agent device according to an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0009] The present disclosure relates to packet authentication, and more particularly to packet authentication in a Virtual Extensible Local Area Network (VXLAN) system.

[0010] Different networks (such as Ethernet networks and VXLAN networks) can operate together in a network system. However, VXLAN encapsulation itself lacks security protection capabilities, and therefore network security faces various risks. A network attacker can generate VXLAN packets to transmit over the Internet, which are then accepted and introduced into layers behind firewalls and other security devices. For example, a network attacker can send forged VXLAN packets to scan subnet information, send broadcast packets through VTEPs, or send DNS requests to internal servers. This can cause network congestion and other serious adverse effects, examples of which are described in further detail below. The lack of packet authentication allows a network attacker to send forged packets and make them appear to be legitimate or valid packets from a first VTEP. In consideration of the above drawbacks, embodiments of the present disclosure provide a solution for authenticating packets in a VXLAN system. The embodiments of the present invention introduce a dynamic VXLAN packet authentication mechanism in both the control panel and the data panel to improve the security, reliability, and serviceability of a VXLAN system.

[0011] Some embodiments of the present disclosure will be described in more detail with reference to the accompanying drawings, which illustrate embodiments of the present disclosure. However, the present disclosure may be embodied in various ways and therefore should not be construed as limited to the embodiments disclosed herein.

[0012] Although this disclosure includes detailed descriptions of cloud computing, it should be understood that implementation of the teachings described herein is not limited to cloud computing environments. Rather, embodiments of the present disclosure may be implemented in conjunction with any other type of computing environment now known or later developed.

[0013] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that are rapidly provisioned and released with minimal administrative effort or interaction with the service provider. This cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0014] The features are as follows:

[0015] On-Demand Self-Service: Cloud consumers can unilaterally provision computing capacity, such as server time and network storage, automatically as needed, without the need for human interaction with the provider of the service.

[0016] Broadband Network Access: Functionality is available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., cell phones, laptops, and PDAs).

[0017] Resource Pooling: To accommodate multiple consumers using a multi-tenant model, a provider's computing resources are pooled, with different physical and virtual resources dynamically allocated and reallocated according to demand. Consumers generally have no control or knowledge of the exact location of the resources provided, but there is a sense of location independence in that they can specify a higher level of abstraction (e.g., country, state, or data center).

[0018] Rapid Elasticity: Capabilities are quickly and elastically provisioned, sometimes automatically, so they can be quickly scaled out, and quickly released so they can be quickly scaled in. To the consumer, the capabilities available for provisioning often appear unlimited, and any amount can be purchased at any time.

[0019] Metered Services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported to provide transparency to both providers and consumers of utilized services.

[0020] The service model is as follows:

[0021] Software as a Service (SaaS): The functionality offered to the consumer is the use of a provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or individual application functions, with the possible exception of limited user-specific application configuration settings.

[0022] Platform as a Service (PaaS): The capability offered to consumers is the deployment of consumer-created or consumer-acquired applications, written using programming languages ​​and tools supported by the provider, on a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, or storage, but has control over the deployed applications and, in some cases, the application hosting environment configuration.

[0023] Infrastructure as a Service (IaaS): The functionality offered to consumers is the provisioning of processing, storage, networking, and other basic computing resources, upon which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does have control over the operating system, storage, deployed applications, and possibly limited control over selected networking components (e.g., host firewalls).

[0024] The deployment models are as follows:

[0025] Private Cloud: This cloud infrastructure is operated solely for the organization. It may be managed by the organization or a third party and may reside on-premise or off-premise.

[0026] Community Cloud: This cloud infrastructure is shared by several organizations to support a specific community with common concerns (e.g., mission, security requirements, policies, and compliance issues). It may be managed by the organization or a third party and may reside on-premises or off-premises.

[0027] Public Cloud: This cloud infrastructure is available to the general public or large industry organizations and is owned by an organization that sells cloud services.

[0028] Hybrid Cloud: This cloud infrastructure is a composite of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technologies that allow for data and application portability (e.g., cloud bursting for load balancing between clouds).

[0029] Cloud computing environments are service-oriented, focusing on statelessness, loose coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0030] Referring now to Figure 1, a schematic of an example cloud computing node is shown. Cloud computing node 10 is merely one example of a suitable cloud computing node and is not intended to suggest any limitation as to the scope of use or functionality of the embodiments of the present disclosure described herein. Nevertheless, cloud computing node 10 may implement or perform any or a combination of the functions described above.

[0031] Cloud computing node 10 may include portable electronic devices, such as computer systems / servers 12 or communications devices, that are operable with numerous other general-purpose or special-purpose computing system environments or configurations. Examples of well-known computing systems, environments, or configurations, or combinations thereof, that may be suitable for use with computer systems / servers 12 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the above systems or devices.

[0032] Computer system / server 12 may be described in the general context of computer system-executable instructions, such as program modules, being executed by a computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc. that perform particular tasks or implement particular abstract data types. Computer system / server 12 may be practiced in a distributed cloud computing environment where tasks are performed by remote processing devices linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media, including memory storage devices.

[0033] 1, computer system / server 12 in cloud computing node 10 is shown in the form of a general-purpose computing device. Components of computer system / server 12 may include, but are not limited to, one or more processors or processing units 16, system memory 28, and a bus 18 coupling various system components, including system memory 28, to processor 16.

[0034] Bus 18 represents any one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures, including, by way of example and not limitation, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0035] Computer system / server 12 typically includes a variety of computer system-readable media, which may be any available media that can be accessed by computer system / server 12 and includes both volatile and nonvolatile media, removable and non-removable media.

[0036] System memory 28 may include computer system-readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Computer system / server 12 may further include other computer system storage media, removable / non-removable, volatile / non-volatile. By way of example only, a storage system 34 may be provided for reading from and writing to non-removable, non-volatile magnetic media (not shown, but commonly referred to as a "hard drive"). Not shown may be a magnetic disk drive for reading from and writing to removable, non-volatile magnetic disks (e.g., "floppy disks"), and an optical disk drive for reading from or writing to removable, non-volatile optical disks, such as CD-ROMs, DVD-ROMs, or other optical media. In such cases, each may be connected to bus 18 by one or more data media interfaces. As further illustrated and described below, memory 28 may include at least one program product having a set of program modules (e.g., at least one of which) configured to perform the functions of embodiments of the present disclosure.

[0037] A program / utility 40 having a set of program modules 42 (at least one of which) may be stored in memory 28, by way of example and not limitation, as well as an operating system, one or more application programs, other program modules, and program data. Each of the operating system, one or more application programs, other program modules, and program data, or any combination thereof, may include an implementation of a networking environment. The program modules 42 generally perform the functions and / or methods of the embodiments of the present disclosure described herein.

[0038] Computer system / server 12 may also communicate with one or more external devices 14, such as a keyboard, pointing device, display 24, one or more devices that allow a user to interact with computer system / server 12, or any device (e.g., network card, modem, etc.) that allows computer system / server 12 to communicate with one or more other computing devices, or combinations thereof. Such communication may occur via input / output (I / O) interface 22. Additionally, computer system / server 12 may communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), or a public network (e.g., the Internet), or combinations thereof, via network adapter 20. As shown, network adapter 20 communicates with other components of computer system / server 12 via bus 18. It should be understood that other hardware and / or software components, not shown, may be used in conjunction with computer system / server 12. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archive database systems.

[0039] Referring now to FIG. 2, an exemplary cloud computing environment 50 is shown. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 that can communicate with local computing devices used by cloud consumers, such as, for example, a personal digital assistant (PDA) or mobile phone 54A, a desktop computer 54B, a laptop computer 54C, or an automotive computer system 54N, or any combination thereof. The nodes 10 can communicate with each other. The nodes 10 can be physically or virtually grouped (not shown) in one or more networks, such as the aforementioned private cloud, community cloud, public cloud, or hybrid cloud, or any combination thereof. This enables the cloud computing environment 50 to provide infrastructure, platform, and / or software as a service for which the cloud consumer does not need to maintain resources on their local computing device. The types of computing devices 54A-54N shown in FIG. 2 are intended to be illustrative only, and it is understood that computing node 10 and cloud computing environment 50 can communicate with any type of computerized device over any type of network and / or network-addressable connection (e.g., using a web browser).

[0040] Referring now to Figure 3, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 2) is shown. It should be understood that the components, layers, and functions shown in Figure 3 are intended to be illustrative only, and embodiments of the present disclosure are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0041] Hardware and software layer 60 includes hardware and software components. Examples of hardware components include mainframes 61, reduced instruction set computer (RISC) architecture-based servers 62, servers 63, blade servers 64, storage devices 65, and networks and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0042] The virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers 71, virtual storage 72, virtual networks including virtual private networks 73, virtual applications and operating systems 74, and virtual clients 75.

[0043] In one example, the management layer 80 may provide the following functions: Resource provisioning 81 dynamically procures computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 82 tracks costs as resources are utilized within the cloud computing environment and bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security verifies the identity of cloud consumers and tasks and protects data and other resources. User portal 83 provides consumers and system administrators with access to the cloud computing environment. Service level management 84 allocates and manages cloud computing resources to ensure required service levels are met. Service level agreement (SLA) planning and fulfillment 85 pre-arranges and procures cloud computing resources where future requirements are forecasted according to SLAs.

[0044] The workload layer 90 provides examples of functions for which a cloud computing environment can be utilized. Examples of workloads and functions that can be provided from this layer include mapping and navigation 91, software development and lifecycle management 92, virtual classroom instruction delivery 93, data analytics processing 94, transaction processing 95, and packet authentication processing 96.

[0045] It should be noted that the packet authentication process 96 according to an embodiment of the present disclosure can be implemented by the computer system / server 12 of FIG. 1 . Currently, different networks (such as an Ethernet network and a VXLAN network) can operate together in a network system. However, VXLAN encapsulation itself lacks security protection capabilities, and therefore, network security faces various types of risks. Therefore, it is desirable to improve the security level of the network system. An operating environment of the present disclosure will be described below with reference to FIG. 4 . FIG. 4 illustrates an exemplary network system 400 in which an embodiment of the present disclosure is implemented. In FIG. 4 , a first data center 410 and a second data center 420 may be included in the network system 400. Here, the first data center 410 may include one or more hosts (such as a first host 412) and a first agent device (acting as a first VXLAN tunnel endpoint (VTEP) 414). The first VTEP 414 can communicate with the first host 412 according to the Ethernet protocol.

[0046] Similarly, the second data center 420 may include one or more hosts (e.g., a second host 422) and a second agent device (acting as a second VTEP 424), where the VTEP 424 can communicate with the second host 422 according to an Ethernet protocol. Here, a VXLAN tunnel 430 is established between the first VTEP 414 and the second VTEP 424, and the first VTEP 414 can encapsulate Ethernet packets from the first host 412 into VXLAN packets according to the VXLAN format. The first VTEP 414 can then transmit the VXLAN packets to the second VTEP 424 via the VXLAN tunnel 430. However, due to the lack of packet authentication, an attacker 440 can send a false packet 442 (i.e., a malicious packet) and make the false packet 442 appear to be a legitimate or valid packet from the first VTEP 414. In this regard, the network system 400 may face potential attacks and risks.

[0047] In consideration of the above drawbacks, embodiments of the present disclosure provide a solution for authenticating packets in a VXLAN system. First, reference is made to FIG. 5 for a general description of embodiments of the present disclosure. FIG. 5 illustrates an exemplary procedure 500 for authenticating packets in a network system according to an embodiment of the present disclosure. In FIG. 5, a token 510 can be provided to a first VTEP 414 to authenticate packets transmitted between a first data center 410 and a second data center 420. Here, the token 510 can be used to encapsulate an Ethernet packet from a first host 412 into a VXLAN packet. Similarly, a token 520 identical to the token 510 can be provided to a second VTEP 424 for packet authentication. If a VXLAN packet received by the second VTEP 424 matches the token 520, it can be determined that the received VXLAN packet is actually from the first VTEP 414. Otherwise, it can be determined that the received VXLAN packet is a fake or malicious packet. In these embodiments, the first VTEP 414 and the second VTEP 424 support both an Ethernet network format and a VXLAN format, with the Ethernet network format being used for local communications within each data center and the VXLAN format being used for remote communications between the two data centers.

[0048] For packet authentication, multiple components may be deployed in the network system 400. FIG. 6 is an example diagram 600 including components for authenticating packets in a network system according to an embodiment of the present disclosure. In FIG. 6, an authentication service 630 may be deployed in the network system 600 to issue tokens 510 and 520. Alternatively, or in addition, or both, the authentication service 630 may be deployed outside the network system 600, as long as the first VTEP 414 and the second VTEP 424 can obtain the tokens 510 and 520, respectively. Furthermore, a plug-in 610 may be deployed in the first VTEP 414 to generate and send VXLAN packets to the second VTEP 424. Furthermore, the plug-in 610 may validate VXLAN packets received from the second VTEP 424. Similarly, a plug-in 620 may be deployed in the second VTEP 424. Further details regarding packet authentication are described below with reference to FIG. 7.

[0049] FIG. 7 illustrates an exemplary procedure 700 for authenticating a packet in a network system according to an embodiment of the present disclosure. In the exemplary procedure 700, the first VTEP 414 converts a first packet (in Ethernet format) received from the first host 412 into a second packet (in VXLAN format) based on the token 510. Furthermore, the second VTEP 424 receives the second packet from the first VTEP 414 and validates the second packet. In the context of the present disclosure, the first packet may be an inner Ethernet frame encapsulated by the first VTEP 414. Furthermore, although FIG. 7 illustrates the procedure 700 for authenticating a packet transmitted from the first VTEP 414 to the second VTEP 424, the illustrated procedure may also be implemented to authenticate a packet transmitted in another direction. For example, the second VTEP 424 may encapsulate the packet and transmit it to the first VTEP 414. The first VTEP 414 can then validate the encapsulated packet.

[0050] In these embodiments of the present disclosure, the token 510 can be obtained from the authentication service 630 and used to authenticate packets transmitted in the network system 400. Furthermore, to prevent the potential risk of the token being stolen by an attacker 440, the token 510 can be assigned a validity period. For example, the authentication service 630 can issue a token at a predetermined interval of 30 milliseconds (or another time interval). In this regard, the token 510 of each VTEP can be updated every 30 milliseconds. In some embodiments of the present disclosure, a cache can be configured to store at least one token issued by the authentication server 630. Here, the at least one token can be stored in chronological order, and the first VTEP 414 can obtain the latest token (currently valid) from the cache. Similarly, the second VTEP 424 can obtain the token 520 directly from the authentication service 630. Additionally or additionally, or both, the second VTEP 424 can obtain the token 520 from a corresponding cache and periodically update the token 520 at predetermined intervals.

[0051] Referring to FIG. 7, a first VTEP 414 may receive 712 a first packet from a first host 412. Here, the first packet is generated according to a first network format (e.g., Ethernet format). FIG. 8A illustrates an example data structure 800A for the Ethernet format according to an embodiment of the present disclosure. In FIG. 8A, an Ethernet packet 810 may include various fields 811-817. Here, a preamble 811 may identify the Ethernet packet 810. The start delimiter 812 may indicate the start of the Ethernet packet 810, the destination address 813 may indicate the destination of the Ethernet packet 810, the source address 814 may indicate the source of the Ethernet packet 810, the length 815 may indicate the length of the Ethernet packet 810, the data 816 may store the payload of the Ethernet packet 810, and the frame check sequence (FCS) 817 may be represented by parity determined based on a cyclic redundancy check (CRC). To authenticate the first packet, the first VTEP 414 may generate a second packet based on the first packet and the token in accordance with a second network format (e.g., a VXLAN format) supported by the network system.

[0052] Referring again to FIG. 7 for further details of packet authentication, the first VTEP 414 may generate an authentication code 714 based on the first packet and the token 510. As multiple Ethernet packets may be received by the first VTEP 414, the identification of each of the Ethernet packets may be determined to obtain a unique ID for each Ethernet packet. In some embodiments of the present disclosure, the parity (e.g., FCS 817) of the first packet may be extracted from the above Ethernet packet 810 as the identification. These embodiments allow the first packet to be identified in a simple and effective manner. Furthermore, the identification may provide tamper-proof functionality to the transmission procedure. Alternatively, or in addition, or both, a signature determined by another method may be considered as the identification. Furthermore, the authentication code may be generated based on the identification and the token 510.

[0053] In some embodiments of the present disclosure, all four bytes of the FCS 817 can be used as the identification. In some embodiments of the present disclosure, a portion can be selected from the FCS 817 as the identification. Specifically, the length of the identification can be predefined. According to these embodiments, the length of the identification can vary to provide greater flexibility in packet authentication. In some embodiments, a parameter X can be defined to indicate how many bytes should be removed from the FCS 817. For example, X=1 indicates that the lowest byte (i.e., 8 bits) of the FCS 817 is removed. In this regard, the following Equation 1 can be used to determine the identification: FCS ID =((FCS&((0xffffffff<<X*8)&0xffffffff))> >8)| (FCS&(0xffffffff>>(5-X)*8)) Formula 1 where FCS ID represents the identification of the first packet, FCS represents the FCS field of the first packet, and X represents the bytes to be removed from the FCS field.

[0054] Additionally, an authentication code can be generated based on the identification and the token 520. For example, the following Equation 2 can be used to determine the authentication code: AUTHCODE=FCS ID&token Expression 2 where AUTHCODE represents the authentication code of the first packet, FCS ID represents the identification of the first packet, and token represents the token 510 from the authentication service 630. These embodiments allow the authentication code to be determined based on a simple calculation. It should be understood that Equation 1 and Equation 2 above merely provide examples for determining the identification and authentication code. Other equations may be employed instead, in addition, or both.

[0055] Although not shown in FIG. 7 , in some embodiments of the present disclosure, the first VTEP 414 can query the authentication service 630 to determine whether the token 510 is currently valid. If the token 510 is valid, the token 510 can be used to generate an authentication code, which is then used to generate the second packet. If the token 510 has expired and is no longer valid, the token 510 can be refreshed from the authentication service 630. Alternatively, or in addition, or both, the most recent token can be obtained from a cache. At this point, the next token issued after the token 510 can be obtained for generating the authentication code. According to these embodiments, each token has its own validity period, so that even if the token is stolen by an attacker 440, the token will be invalid after the validity period.

[0056] Further, the first VTEP 414 may generate a second packet 716 using the authentication code and the first packet. Specifically, the first packet may be inserted into a data field of the VXLAN packet, and the authentication code may be inserted into a reserved field of the VXLAN packet. For further details on generating the second packet, refer to FIG. 8B. FIG. 8B illustrates an example data structure 800B of a VXLAN format according to an embodiment of the present disclosure. Here, the second packet is generated according to the format of a VXLAN packet 840, which may include a VXLAN header 841 for indicating the start of the VXLAN packet 840 and data 842 for storing the payload of the VXLAN packet 840. As shown in FIG. 8B, the contents of the first packet may be inserted into the data 842. Furthermore, the VXLAN header 841 may include a VXLAN flag 851, a first reserved field 852, a VNID 853, and a second reserved field 854. Thus, the authentication code 830 generated from the FCS 817 and the token 510 can be inserted into the first reserved field 852. At this point, the second packet encapsulates both the first packet and the authentication code for further authentication.

[0057] Referring again to FIG. 7 , the first VTEP 414 may send 718 a second packet to the second VTEP 424. When the second VTEP 424 receives the second packet, the second VTEP 424 may validate 720 the second packet using the token 520 by determining whether the second packet matches the token 520. Specifically, the second VTEP 424 may extract an authentication code from a reserved field included in the second packet. For example, the authentication code 830 of the first reserved field 852 may be extracted, the extracted authentication code being generated from the token 510 and the first packet. The second VTEP 424 may determine 722 that the second packet is valid. In response to determining that the second packet is valid, the second VTEP 424 may forward 724 the packet to the second host 422. The second VTEP 424 may determine 726 that the second packet is invalid. In response to determining that the second packet is invalid, the second VTEP 424 may drop 728 the second packet.

[0058] In some embodiments of the present disclosure, the second packet can be parsed to extract the first packet from the data 842 of the VXLAN packet 840, and then the identification of the extracted first packet can be determined. Here, the method for determining the identification is the same as that implemented in the first VTEP 414. For example, parity, such as an FCS field, of the first packet can be extracted. Furthermore, Equation 1 above can be used to determine the identification, and then Equation 2 above can be executed based on the identification and the token 520 to calculate a second authentication code based on the identification and the token 520.

[0059] In some embodiments of the present disclosure, before generating the second authentication code, the second VTEP 424 can query the authentication service 630 to verify whether the token 520 is valid. If the token 520 is valid, the token 520 can be used to generate the second authentication code. If the token 520 is invalid, this means that the token 520 has expired and a newer token can be obtained from the authentication service 630 or a cache to generate the second authentication code.

[0060] The second authentication code (generated from token 520) can then be compared with the authentication code (generated from token 510). If the two authentication codes match, then the second packet received by the second VTEP 424 matches token 520, and therefore the second packet is verified as a legitimate or valid packet from the first VTEP 414. At this point, the first packet extracted from the data field of the second packet can be forwarded to a second host 422 connected to the second VTEP 424. These embodiments allow only authenticated packets to be forwarded to the second host 422.

[0061] In some embodiments of the present disclosure, a mismatch between the two authentication codes may relate to different situations. In one situation, the second packet received by the second VETP 424 may be a fake or malicious packet from the attacker 440, and therefore the second packet should be dropped. In another situation, the second packet was authenticated using a previous token issued by the authentication service 630 at a previous time. Therefore, to distinguish between the above two situations, one or more previous tokens should be obtained.

[0062] In some embodiments of the present disclosure, in response to a mismatch between the two authentication codes, a previous token issued before the token can be retrieved from an authentication service or cache. Then, a further authentication code can be generated based on the previous token and FCS of the first packet extracted from the second packet. If the further authentication code does not match the authentication code extracted from the second packet, this indicates that the second packet is a fake or malicious packet and should therefore be dropped. If the further authentication code matches the authentication code, this indicates that the second packet is a legitimate or valid packet from the first VTEP 414. Furthermore, the second packet can be forwarded to the second host 422. These embodiments drop the fake or malicious packet, which ensures that only legitimate or valid packets are forwarded to the target host in the second data center. On the one hand, dropping the fake or malicious packet improves the security level of the network system 400. On the other hand, the bandwidth cost incurred by packet forwarding can be reduced.

[0063] Further details of the authentication procedure are described below with reference to FIG. 9 . FIG. 9 illustrates a detailed procedure 900 for authenticating packets in a network system according to an embodiment of the present disclosure. Here, the hosts illustrated in the previous figures may be implemented by virtual machines (VMs), and thus the first data center 410 may include one or more VMs 912. Furthermore, the first VTEP 414 may include a cache 910 for storing tokens distributed by the authentication service 630. Similarly, the second data center 420 may include one or more VMs 922, and the second VTEP 424 may include a cache 920 for storing tokens distributed by the authentication service 630.

[0064] Furthermore, a table 914 may be stored in the first data center 410 to record parameters of each VM 912 in the first data center 410. As shown in table 914, the first column represents the media access control (MAC) address of the VM, the second column represents the VXLAN network identifier (VNID), and the third column represents the VTEP IP of the VM. Similarly, a table 924 may be provided in the second data center 420. To perform the above authentication procedure, the authentication service 630 first distributes tokens to each of the caches 910 and 920. Thereafter, the first VETP 414 receives a first packet from the VM recorded in table 914, generates a second packet based on the first packet and the token stored in cache 910, and then sends the second packet to the second VTEP 424. Furthermore, the second VTEP 424 validates the received second packet based on the token stored in cache 920. If the received second packet is verified, the second packet is forwarded to the corresponding VM based on the table 924 .

[0065] FIG. 10 illustrates an exemplary architecture 1000 of a network system according to an embodiment of the present disclosure. In FIG. 10, the network system includes an application layer 1010, implemented in transaction processing 95 of FIG. 3, for implementing normal data communication between VMs in the network system; a control layer 1020, implemented in packet authentication processing 96 of FIG. 3, for managing tokens 1044; and an infrastructure layer 1030, implemented by network and networking component 66 of FIG. 3, for providing physical resources such as VTEP 1040 and other VTEPs (not shown in FIG. 10) and VMs 1050...1052. During operation of the network system, authentication service 630 of control layer 1020 can distribute tokens to VTEP 1040 and other VTEPs. These VTEPs can then implement the authentication procedures described in the preceding paragraphs to transmit and receive packets between VMs 1050...1052 in a secure manner. In an embodiment, cache 1042 is used to store at least one token 1044 issued by an authentication server.

[0066] Although the embodiments of the present disclosure have been described by using Ethernet® and VXLAN as examples of a first and second network type, the embodiments of the present disclosure may be applied to other network systems including two or more data centers that support different network types. Specifically, the two or more data centers may support two different network types, with one network type being used for local communication within each data center and another network type being used for remote communication between the data centers. The above embodiments may enable the detection of fake or malicious packets, thereby improving the security level of the network system.

[0067] For further details regarding embodiments of the present disclosure, please refer to FIGS. 11A and 11B. FIG. 11A is an exemplary flowchart of a method 1100A for authenticating a first packet at an agent device according to an embodiment of the present disclosure. In block 1110A, a token is obtained at a first agent device included in a network system, and the token is used to authenticate a packet transmitted in the network system, where the first packet is generated according to a first network type. In block 1120A, a second packet is generated based on the first packet and the token according to a second network type supported by the network system. In block 1130A, the second packet is transmitted to a second agent device included in the network system, where both the first agent device and the second agent device support the first network type and the second network type.

[0068] In some embodiments of the present disclosure, an identification of a first packet is obtained, and then a second packet is generated based on the identification, the token, and the first packet. In some embodiments of the present disclosure, to obtain the identification of the first packet, a parity of the first packet is obtained, and then the identification of the first packet is determined based on a predetermined length of the parity and the identification. In some embodiments of the present disclosure, to obtain the parity of the first packet, a frame check sequence is extracted from the first packet conforming to the first network format. In some embodiments of the present disclosure, an authentication code is generated based on the identification and the token. The authentication code is then added to a spare field included in the second packet, and the first packet is added to a data field included in the second packet.

[0069] In some embodiments of the present disclosure, if the token is determined to be valid, a second packet is generated according to a second network type based on the first packet and the token. In some embodiments of the present disclosure, if the token is determined to be invalid, a second packet is generated according to a second network type based on the first packet and a next token issued after the first packet and the token. In some embodiments of the present disclosure, the token is obtained from one or more of an authentication service for authenticating packets transmitted in a network system or a cache for storing at least one token issued by an authentication server. In some embodiments of the present disclosure, the first network type includes an Ethernet type and a Virtual Extensible Local Area Network (VXLAN), the second network type includes a VXLAN type, the first agent device and the second agent device each include a VXLAN tunnel endpoint, and the method is performed by a plug-in deployed on the first agent device.

[0070] 11B is an exemplary flowchart of a method 1100B for authenticating a packet at another agent device according to an embodiment of the present disclosure. In block 1110B, a second packet is received from a first agent device included in a network system, and the second packet is received at a second agent device included in the network system. In block 1120B, it is determined whether the second packet matches a second token for authenticating the first packet transmitted from the first agent device in the network system. In block 1130B, if it is determined that the second packet matches the second token, the first packet included in the data field of the second packet is forwarded. Here, the first packet is generated according to a first network format, and the second packet is generated according to a second network format supported by the network system.

[0071] In some embodiments of the present disclosure, an authentication code is extracted from a reserved field included in the second packet to determine whether the second packet matches the second token. A second authentication code is then generated based on the second token and the first packet. If the authentication code is determined to match the second authentication code, the second packet is determined to match the second token. In some embodiments of the present disclosure, if the second token is valid, a second authentication code is generated based on the second token and the first packet. In some embodiments of the present disclosure, to generate the second authentication code, an identification of the first packet is determined, and then the second authentication code is generated based on the second token and the identification.

[0072] In some embodiments of the present disclosure, parity of the first packet is obtained, and then an identification of the first packet is determined based on the parity and a predetermined length of the identification. In some embodiments of the present disclosure, if the second packet does not match the second token, a previous token issued before the second token is obtained to authenticate the packet transmitted in the network system. A second authentication code is then generated based on the previous token and the first packet. In some embodiments of the present disclosure, if the second packet does not match the previous token, the second packet is dropped. In some embodiments of the present disclosure, the network system includes an Ethernet network and a Virtual Extensible Local Area Network (VXLAN), the first network type includes an Ethernet type and the second network type includes a VXLAN type, the first agent device and the second agent device each include a VXLAN tunnel endpoint, and the method is performed by a plug-in deployed in the second agent device.

[0073] The present disclosure may be a system, method, or computer program product, or a combination thereof, at any possible level of technical detail. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions for causing a processor to perform aspects of the present disclosure.

[0074] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions for use by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge structures in grooves on which instructions are recorded, and any suitable combination thereof. As used herein, computer-readable storage media should not be construed as being ephemeral signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through fiber optic cable), or electrical signals transmitted over electrical wires.

[0075] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or can be downloaded to an external computer or external storage device over a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage on a computer-readable storage medium within the respective computing / processing device.

[0076] Computer-readable program instructions for carrying out the operations of the present disclosure may be source or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, integrated circuit configuration data, or procedural programming languages, such as object-oriented programming languages ​​like Smalltalk®, C++, and the "C" programming language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, to carry out aspects of the present disclosure, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), can execute computer-readable program instructions by utilizing state information of the computer-readable program instructions to personalize the electronic circuitry.

[0077] Aspects of the present disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0078] These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to create a machine, such that the instructions, when executed by the processor of the computer or other programmable data processing apparatus, create means for performing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may be stored on a computer-readable storage medium, capable of directing a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner, such that the computer-readable storage medium on which the instructions are stored comprises an article of manufacture containing instructions implementing aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0079] The computer-readable program instructions may be loaded into a computer, other programmable data processing apparatus, or other device to cause the computer, other programmable apparatus, or other device to perform a series of operational steps to create a computer-implemented process, such that the instructions, which execute on the computer, other programmable apparatus, or other device, perform the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams.

[0080] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing specified logical functions. In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may actually be implemented as a single step, executed concurrently, executed substantially concurrently, executed in a partially or fully overlapping manner, or the blocks may sometimes be executed in reverse order, depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented by a dedicated hardware-based system that performs the specified functions or operations or executes a combination of dedicated hardware and computer instructions.

[0081] The description of various embodiments of the present disclosure is presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the described embodiments. The terms used herein are selected to best explain the principles of the embodiments, their practical applications or technical improvements over commercially available technologies, or to enable those skilled in the art to understand the embodiments disclosed herein.

Claims

1. 1. A computer-implemented method comprising: obtaining, by one or more processors, at a first agent device included in a network system, a token for authenticating a first packet transmitted in the network system, the first packet being generated according to a first network format; generating, by one or more processors, a second packet according to a second network type based on the first packet and the token; transmitting, by one or more processors, the second packet to a second agent device included in the network system, wherein both the first agent device and the second agent device support the first network type and the second network type; A method comprising:

2. generating the second packet; obtaining, by one or more processors, an identification of the first packet; generating, by one or more processors, the second packet based on the identification, the token, and the first packet; The computer-implemented method of claim 1 , comprising:

3. obtaining the identification of the first packet; obtaining, by one or more processors, parity of the first packet; determining, by one or more processors, the identification of the first packet based on the parity and a predetermined length of the identification; The computer-implemented method of claim 2 , comprising:

4. 4. The computer-implemented method of claim 3, wherein obtaining the parity of the first packet includes extracting, by one or more processors, a frame check sequence from the first packet that conforms to the first network format.

5. generating the second packet based on the identification, the token, and the first packet; generating, by one or more processors, an authentication code based on the identification and the token; adding, by one or more processors, the authentication code to a reserved field included in the second packet; adding, by one or more processors, the first packet to a data field included in the second packet; The computer-implemented method of claim 2 , comprising:

6. generating the second packet based on the first packet and the token; In response to determining that the token is valid, generating, by one or more processors, the second packet based on the first packet and the token in accordance with the second network type; generating, by one or more processors, the second packet in accordance with the second network type based on the first packet and a next token issued after the token in response to determining that the token is invalid; The computer-implemented method of claim 1 , comprising one or more of:

7. Obtaining the token converts the token into an authentication service for authenticating packets transmitted in said network system; a cache for storing at least one token issued by the authentication server; The computer-implemented method of claim 1 , comprising obtaining the information from one or more of:

8. 2. The computer-implemented method of claim 1, wherein the network system includes an Ethernet network and a virtual extensible local area network (VXLAN), the first network type includes an Ethernet type, the second network type includes a VXLAN type, the first agent device and the second agent device each include a VXLAN tunnel endpoint, and the method is performed by a plug-in deployed on the first agent device.

9. receiving, by one or more processors, a second packet from a first agent device included in a network system, the second packet being received at a second agent device included in the network system; determining, by one or more processors, whether the second packet matches a second token for authenticating a first packet sent from the first agent device of the network system; and forwarding, by one or more processors, the first packet included in a data field of the second packet in response to determining that the second packet matches the second token, wherein the first packet is generated according to a first network type, the second packet is generated according to a second network type, and both the first agent device and the second agent device support the first network type and the second network type. The computer-implemented method of claim 1 , further comprising:

10. determining whether the second packet matches the second token; extracting, by one or more processors, an authentication code from a reserved field included in the second packet; generating, by one or more processors, a second authentication code based on the second token and the first packet; determining, by one or more processors, that the second packet matches the second token in response to determining that the authentication code matches the second authentication code; 10. The computer-implemented method of claim 9, comprising:

11. generating the second authentication code based on the second token and the first packet; 11. The computer-implemented method of claim 10, comprising generating, by one or more processors, the second authentication code based on the second token and the first packet in response to determining that the second token is valid.

12. generating the second authentication code based on the second token and the first packet; determining, by one or more processors, an identification of the first packet; generating, by one or more processors, the second authentication code based on the second token and the identification; The computer-implemented method of claim 10, comprising:

13. determining the identification of the first packet; obtaining, by one or more processors, parity of the first packet; determining, by one or more processors, the identification of the first packet based on the parity and a predetermined length of the identification; The computer-implemented method of claim 12, comprising:

14. In response to determining that the second packet does not match the second token, obtaining, by one or more processors, a previous token issued before the second token for authenticating packets transmitted on the network system; and generating, by one or more processors, the second authentication code based on the previous token and the first packet; The computer-implemented method of claim 10 further comprising:

15. 15. The computer-implemented method of claim 14, further comprising, in response to determining that the second packet does not match the previous token, dropping, by one or more processors, the second packet.

16. 10. The computer-implemented method of claim 9, wherein the network system includes an Ethernet network and a virtual extensible local area network (VXLAN), the first network type includes an Ethernet type, the second network type includes a VXLAN type, the first agent device and the second agent device each include a VXLAN tunnel endpoint, and the method is performed by a plug-in deployed on the second agent device.

17. 1. A computer-implemented system comprising a computer processor coupled to a computer-readable memory unit, said memory unit containing instructions that, when executed by said computer processor, perform a method, said method comprising: Obtaining, at a first agent device included in a network system, a token for authenticating a first packet transmitted in the network system, the first packet being generated according to a first network format; generating a second packet according to a second network type based on the first packet and the token; transmitting the second packet to a second agent device included in the network system, wherein both the first agent device and the second agent device support the first network type and the second network type; 1. A computer-implemented system comprising:

18. generating the second packet; obtaining, by one or more processors, an identification of the first packet; generating, by one or more processors, the second packet based on the identification, the token, and the first packet; 20. The computer implemented system of claim 17, comprising:

19. obtaining the identification of the first packet; obtaining, by one or more processors, parity of the first packet; determining, by one or more processors, the identification of the first packet based on the parity and a predetermined length of the identification; 20. The computer implemented system of claim 18, comprising:

20. 20. The computer-implemented system of claim 19, wherein obtaining the parity of the first packet includes extracting, by one or more processors, a frame check sequence from the first packet that conforms to the first network format.

21. 17. A computer program comprising program code adapted to perform the method steps of any one of claims 1 to 16 when said program is run on a computer.

Images