Public Cloud Network Control via VPC Gateway Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Public datacenters lack robust security capabilities, hindering companies from fully utilizing their network expansion potential due to the inability to exercise direct security control over virtualization software, which is owned by the datacenter owner.
Innovation Solution
A hierarchical network control system is implemented, with a gateway controller in each virtual private cloud (VPC) managing forwarding elements within virtual machines, enabling network security and forwarding rules across private and public datacenters, and utilizing local control agents and a central control plane to distribute configuration rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If companies move their networks into public datacenters to reduce costs and physical server burdens, then cost reduction and network expansion are achieved, but direct security control capability is lost
Solution Approach 1:
The patent introduces a virtual gateway as an intermediary component deployed within the public datacenter VPC. This gateway acts as a mediator between the company's network control system and the public datacenter's infrastructure, enabling indirect security control. The gateway forwards traffic and allows the application of security policies without requiring direct access to the public datacenter's virtualization software, thus resolving the contradiction between network expansion and security control.
2Ease of operation
If public datacenter owners control the virtualization software, then infrastructure management is simplified, but robust security capabilities are reduced
Solution Approach 1:
The patent segments the network control functionality into multiple components: a control plane in the private datacenter, a virtual gateway in the public datacenter VPC, and integration with the public datacenter's networking services. This segmentation allows the company to maintain security control through the control plane while utilizing the public datacenter's simplified infrastructure management, resolving the contradiction between ease of operation and security capability.
3Reliability
If network control system accesses forwarding elements in private datacenter, then security policy implementation is direct and effective, but system complexity increases when extending to public datacenter
Solution Approach 1:
The virtual gateway serves as an intermediary that the control plane can access to enforce security policies in the public datacenter. Instead of directly accessing forwarding elements in the public datacenter (which would require complex integration), the control plane communicates with the gateway, which then applies policies to traffic flowing through the VPC. This maintains effective security policy enforcement while managing system complexity through a standardized intermediary interface.
Data Source
AI summary
Some embodiments provide a method for a first data compute node (DCN) operating in a public datacenter. The method receives an encryption rule from a centralized network controller. The method determines that the network encryption rule requires encryption of packets between second and third DCNs operating in the public datacenter. The method requests a first key from a secure key storage. Upon receipt of the first key, the method uses the first key and additional parameters to generate second and third keys. The method distributes the second key to the second DCN and the third key to the third DCN in the public datacenter.