Managed Forwarding Element Invalid Packet Address Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Public datacenters lack robust and transparent security capabilities, making tenant machines vulnerable to attacks like IP spoofing, which can evade security measures implemented by tenants.
Innovation Solution
A novel spoofed-packet detection method is implemented using a managed forwarding element (MFE) on a data compute node (DCN) within a public multi-tenant datacenter, which creates a logical network connecting multiple DCNs and uses a mapping table to validate source addresses, dropping packets if they are invalid to prevent malicious traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If public datacenters provide multi-tenant virtualization services, then resource utilization and scalability are improved, but security capabilities deteriorate due to lack of tenant control over virtualization software
Solution Approach 1:
The patent introduces a security verification mechanism that acts as an intermediary between the underlay network and the logical network. The MFE verifies the consistency between underlay source addresses and logical source addresses using a mapping table, preventing IP spoofing attacks without requiring tenants to control the virtualization software directly. This intermediary verification layer resolves the security capability deterioration while maintaining multi-tenant virtualization services.
2Adaptability or versatility
If tenant machines are allowed to implement their own security measures, then security customization is improved, but vulnerability to IP spoofing attacks worsens due to inability to control virtualization software
Solution Approach 1:
The patent introduces a security verification mechanism that acts as an intermediary between the underlay network and the logical network. The MFE verifies the consistency between underlay source addresses and logical source addresses using a mapping table, preventing IP spoofing attacks without requiring tenants to control the virtualization software directly. This intermediary verification layer resolves the security capability deterioration while maintaining multi-tenant virtualization services.
3Reliability
If source address validation is implemented using mapping tables, then IP spoofing prevention is improved, but packet processing complexity worsens
Solution Approach 1:
The patent pre-establishes mapping tables that contain the correspondence relationships between underlay source addresses and logical source addresses before packet transmission occurs. The MFE simply performs lookup operations in the pre-configured mapping table during packet forwarding, rather than performing complex real-time analysis. This preliminary preparation of address mappings significantly reduces the computational complexity of packet processing while maintaining effective IP spoofing prevention.
Data Source
AI summary
Some embodiments provide a method for a managed forwarding element (MFE) executing on a data compute node (DCN) that operates on a host computer in a public datacenter. The MFE implements a logical network that connects multiple DCNs within the public datacenter. The method receives a packet, directed to the DCN, that (i) has a first logical network source address and (ii) is encapsulated with a second source address associated with an underlying public datacenter network. The method determines whether the first logical network source address is a valid source address for the packet based on a mapping table that maps logical network addresses to underlying public datacenter network addresses. When the first source address is not a valid source address for the packet, the method drops the packet.