Logical Overlay Network Traffic Authentication via Encapsulated Packet Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Software-Defined Networking (SDN) environments, logical overlay network traffic is susceptible to malicious activities due to open interfaces accessible by various processes, which can bypass distributed firewall rules, compromising the security and performance of hosts and virtual machines.
Innovation Solution
Authentication information is included in encapsulated packets transmitted between Virtual Tunnel Endpoints (VTEPs) to indicate whether they originate from a trusted zone, using algorithms like HMAC to verify the authenticity of the traffic, ensuring only trusted packets are forwarded and malicious ones are dropped.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If open interfaces are provided for logical overlay network traffic, then ease of operation and adaptability are improved, but security and reliability deteriorate due to susceptibility to malicious activities
Solution Approach 1:
An authentication mechanism is introduced as an intermediary between the open network interface and the trusted zone. The mechanism includes generating authentication information (such as cryptographic hashes or digital signatures) for packets originating from the trusted zone, and verifying this authentication information at the network interface. This intermediary layer allows the interface to remain open and accessible while preventing malicious packets from bypassing security controls.
2Reliability
If authentication mechanisms are implemented for all packets, then security and reliability are improved, but device complexity and processing overhead increase
Solution Approach 1:
The authentication mechanism is applied locally and selectively rather than universally. Authentication information is generated only for packets originating from the trusted zone, and verification is performed only for packets claiming to be from the trusted zone. This localized approach reduces complexity compared to authenticating all packets, while still providing security where needed. The system adapts the level of authentication based on the packet's origin and destination.
3Reliability
If authentication verification is performed on every packet, then security is improved, but productivity and processing speed deteriorate
Solution Approach 1:
Authentication information is prepared in advance and attached to packets at their point of origin within the trusted zone, before the packets reach the network interface. This preliminary action allows the authentication data to be ready when the packet arrives at the interface, eliminating the need for time-consuming authentication calculations during packet processing. The verification process becomes a simple comparison rather than a complex computation, maintaining high throughput.
Data Source
AI summary
Example methods and systems for authentication for logical overlay network traffic are described. In one example, a first computer system may detect an inner packet and generate authentication information associated with the inner packet based on control information from a management entity. The authentication information may indicate that the inner packet originates from a trusted zone. The first computer system may further generate an encapsulated packet by encapsulating the inner packet with an outer header that specifies the authentication information, and send the encapsulated packet towards the second virtualized computing instance to cause a second computer system to verify that the inner packet originates from the trusted zone based on the authentication information.