Mapping Server Dynamic Security Association Provisioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Extending a software defined network to the cloud introduces scalability issues due to increased VTEPs and the need for fine-grained encryption mechanisms that enforce different policies for various virtual networks and security groups, while existing methods like the 'bolt-on' approach limit the number of connected VTEPs and lack scalability and dynamic control.
Innovation Solution
The dynamic provisioning system combines cryptographic SA negotiation with endpoint identity/location mappings, allowing for on-demand cryptographic state distribution and finer-grained encryption policies, such as per-VNI or per-security-group, to optimize the use of cryptographic resources and match the intent of high-level cryptographic policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If per-VTEP-pair security associations are provisioned for encryption, then end-to-end security is provided, but the number of security associations increases quadratically with the number of VTEPs, limiting scalability
Solution Approach 1:
The patent segments the cryptographic state distribution by introducing a control plane separation. The mapping server handles security association negotiation and distributes cryptographic state dynamically, while data plane VTEPs only maintain minimal state for active tunnels. This segmentation reduces per-VTEP complexity from O(N^2) to O(N) by separating control functions from forwarding functions.
Solution Approach 2:
The mapping server acts as an intermediary between VTEPs for security association establishment. Instead of direct peer-to-peer SA negotiation between all VTEP pairs, the mapping server mediates the process, maintaining the global view of SAs and distributing cryptographic state on-demand. This intermediary approach reduces the complexity burden on individual VTEPs.
2Manufacturing precision
If fine-grained encryption policies are implemented per virtual network and security group, then security precision is improved, but the cryptographic resource requirements and system complexity increase
Solution Approach 1:
The patent implements local quality by allowing different cryptographic policies and security association parameters for different virtual networks and security groups. Each VNI and SGT can have customized encryption algorithms, key lengths, and security requirements. The mapping server enforces these local quality requirements by distributing appropriate cryptographic state to VTEPs based on the specific traffic flow's security requirements.
Solution Approach 2:
The system dynamically changes cryptographic parameters (algorithm type, key length, security association identifiers) based on the virtual network and security group requirements. The mapping server negotiates and distributes different parameter sets for different traffic flows, enabling fine-grained policy enforcement without requiring uniform cryptographic configuration across all VTEPs.
3Reliability
If cryptographic state is distributed to all VTEPs in advance, then security coverage is maximized, but memory usage and initialization time increase significantly
Solution Approach 1:
The mapping server performs preliminary action by pre-negotiating and caching security associations in the control plane before they are needed in the data plane. When a tunnel is established, the cryptographic state is already prepared and can be quickly distributed to VTEPs on-demand, eliminating the need for VTEPs to maintain all possible SAs in advance.
Solution Approach 2:
The patent extracts the cryptographic state management function from the data plane VTEPs and places it in the control plane mapping server. The mapping server maintains the comprehensive cryptographic state repository, while VTEPs only hold the subset of state needed for active tunnels. This extraction reduces memory requirements at VTEPs while maintaining security coverage through centralized state management.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A mapping server provisions network elements to optimize the cryptographic resources of a computer network. The mapping server obtains from a source network element, a request for a source endpoint to communicate with a destination endpoint across the computer network. The mapping server determines a cryptographic policy based on the source endpoint, the destination endpoint, and an availability of cryptographic resources on the network elements. The mapping server identifies a destination network element based on the cryptographic policy. The destination network element is associated with the destination endpoint. The mapping server selects a security association based on the cryptographic policy to secure a communication from the source endpoint to the destination endpoint. The security association secures the communication between the source network element and the destination network element. The mapping server provides the security association to the source network element along with a network address of the destination network element.