Single Packet Authorization in Cloud Virtual Networking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current port knocking techniques are inefficient in dynamically managing firewall policies for temporary connections in cloud computing environments, especially for lightweight containers and highly-dynamic workloads that lack dedicated host-level firewalls.
Innovation Solution
The implementation of Single Packet Authorization (SPA) in a cloud computing environment, where a virtual switch forwards SPA requests to a virtual firewall and SPA service for validation, allowing temporary firewall policies to enable secure, on-demand network access using symmetric and/or asymmetric cryptographic keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If port knocking techniques are used to dynamically manage firewall policies, then temporary connections from authorized sources can be allowed, but the system becomes complex and difficult to implement in cloud environments with lightweight containers
Solution Approach 1:
The patent introduces an SPA service as an intermediary component that mediates between the virtual switch and the validation logic. This service receives SPA requests from clients, performs validation using cryptographic credentials, and communicates with the virtual firewall to implement temporary policies. By centralizing the SPA logic in a dedicated service rather than embedding it in each container or application, the system achieves reliable firewall management while reducing implementation complexity across the cloud infrastructure.
2Ease of operation
If SPA service is integrated into cloud-based virtual networking functions, then authenticated network access is simplified, but the virtual networking system becomes more complex
Solution Approach 1:
The patent merges the SPA service with the cloud-based virtual networking functions, specifically integrating it into the virtual switch architecture. The virtual switch is enhanced to include SPA service capabilities, allowing it to directly receive, validate, and process SPA requests without requiring separate external validation systems. This consolidation simplifies the user experience and adoption process while the added complexity is contained within the virtual networking layer, which is already a complex subsystem.
3Speed
If temporary firewall policies are implemented to allow on-demand network access, then connection speed is improved, but security control is weakened
Solution Approach 1:
The patent implements preliminary validation of cryptographic credentials (symmetric or asymmetric keys) before establishing temporary firewall policies. The SPA service validates the client's credential in advance, and only after successful validation does it instruct the virtual firewall to create a temporary allow rule. This preliminary authentication ensures that security control is maintained while enabling rapid connection establishment, as the security check is performed once before the temporary policy is activated rather than continuously during the connection.
Data Source
AI summary
Concepts and technologies disclosed herein are directed to single packet authorization (“SPA”) in a cloud computing environment. A compute node can include a virtual switch operating on at least a portion of a plurality of hardware resources of a cloud computing environment, a virtual firewall, a cloud workload executing a cloud service, and a SPA service. The virtual switch can receive a SPA request from a SPA client executing on a computing device. The virtual switch can forward the SPA request to the virtual firewall and to the SPA service. The virtual firewall can deny the SPA request in accordance with a firewall policy. The SPA service can utilize a SPA validation scheme to validate the SPA request. The virtual firewall can implement a temporary firewall policy to allow incoming packets from the SPA client and directed to the cloud service.