Group Key Encryption for Multi-Tenant Virtual Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data security within cloud computing's shared infrastructure is inadequate, as secure web services and VPNs only protect data up to the cloud entry point, and existing solutions like VLANs and point-to-point encryption techniques are either vulnerable to attacks or do not scale well.
Innovation Solution
Implementing group key-based encryption in a multi-tenant virtualized infrastructure by intercepting Layer 2 frames, determining secure wire membership, and encrypting payload data using a group encryption key associated with the secure wire, while being transparent to virtual machines and application layers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If point-to-point encryption techniques (SSL/IPSec) are used to secure data traversing the provider's internal network, then data security is improved, but device complexity and scalability worsen due to the need for n*(n-1) key negotiations among n virtual machines
Solution Approach 1:
The patent segments the encryption key management into a centralized key management system separate from the virtual machines. Instead of each VM managing its own encryption keys, the system divides responsibilities: the key management system handles key generation, distribution, and storage, while VMs only need to receive and use the assigned keys. This segmentation reduces the complexity of key management from O(n²) to O(n).
Solution Approach 2:
The patent introduces a key management system as an intermediary between virtual machines and the encryption infrastructure. This intermediary component handles the complex key negotiation and distribution process, allowing VMs to communicate securely without needing to perform complex key handshakes with each other. The key management system acts as the mediator that simplifies the overall system architecture.
2Adaptability or versatility
If VLANs are used to provide segregated logical networks, then network isolation is improved, but security against malicious entities worsens due to vulnerabilities to wiretapping, masquerading attacks, and man-in-the-middle attacks
Solution Approach 1:
The patent combines multiple security mechanisms into a composite security system. Instead of relying solely on VLANs for isolation, the system layers encryption (SSL/IPSec) on top of the network infrastructure. This composite approach uses both the structural isolation provided by VLANs and the cryptographic protection provided by encryption, creating a more robust security system that mitigates the weaknesses of individual components.
Solution Approach 2:
The patent applies encryption to data before it traverses the internal network, preventing malicious entities from reading or modifying the data in advance. By encrypting data at the source before it enters the shared infrastructure, the system proactively counteracts potential wiretapping, masquerading, and man-in-the-middle attacks rather than reacting to them after they occur.
3Productivity
If group key-based encryption is implemented at the infrastructure level, then scalability is improved, but device complexity increases due to the need for infrastructure-level encryption management
Solution Approach 1:
The patent implements self-service mechanisms where the key management system automatically handles key generation, distribution, and renewal without requiring manual intervention. The system autonomously manages the encryption infrastructure, allowing virtual machines to be added or removed without affecting the overall security architecture. This self-service capability maintains scalability while minimizing the operational complexity of infrastructure management.
Data Source
AI summary
Techniques are disclosed for securing traffic flowing across multi-tenant virtualized infrastructures using group key-based encryption. In one embodiment, an encryption module of a virtual machine (VM) host intercepts layer 2 (L2) frames sent via a virtual NIC (vNIC). The encryption module determines whether the vNIC is connected to a “secure wire,” and invokes an API exposed by a key management module to encrypt the frames using a group key associated with the secure wire, if any. Encryption may be performed for all frames from the vNIC, or according to a policy. In one embodiment, the encryption module may be located at a layer farthest from the vNIC, and encryption may be transparent to both the VM and a virtual switch. Unauthorized network entities which lack the group key cannot decipher the data of encrypted frames, even if they gain access to such frames.