VTEP Authentication via Cryptographic Hash Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based data centers using Virtual Local Area Networks (VLANs) face challenges in detecting and authenticating rogue VTEPs, which can lead to deleterious effects on the VLAN network and endpoint systems, as existing VTEPs lack the capability to differentiate between legitimate and rogue peers.
Innovation Solution
Implementing dynamic peer VTEP discovery and authentication methods, including active and passive modes in both control and data planes, using authentication packets with cryptographic hashes or encryption to verify peer VTEPs and prevent rogue VTEP installation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VTEPs use static configuration or runtime discovery methods to establish peer VTEPs, then peer VTEP establishment is simple and fast, but rogue VTEPs cannot be detected and network security is compromised
Solution Approach 1:
The patent implements preliminary authentication actions before establishing VTEP peer relationships. Authentication packets are exchanged and verified using cryptographic methods (MD5, SHA1, SHA256 hashes) before the VTEP peer relationship is finalized. This preliminary verification prevents rogue VTEPs from establishing connections, addressing the security concern while maintaining automated operation.
Solution Approach 2:
The patent introduces an authentication packet as an intermediary mechanism between VTEP discovery and peer establishment. This authentication packet contains cryptographic verification data that acts as a mediator to validate the legitimacy of discovered VTEPs. The intermediary authentication step bridges the gap between simple discovery and secure peer establishment without requiring complex manual configuration.
2Reliability
If VTEPs authenticate all discovered peers, then network security is improved, but authentication overhead and processing time increase
Solution Approach 1:
The patent implements partial authentication by selectively authenticating only those VTEP peers that are discovered through runtime discovery mechanisms, while allowing statically configured peers to establish connections immediately. This partial application of authentication reduces overall processing time while still providing security for dynamically discovered peers. The authentication is applied excessively to all discovered peers to ensure security, with the understanding that the cryptographic verification is computationally efficient.
Solution Approach 2:
The patent changes the authentication parameter from manual verification to automated cryptographic verification. By using hash functions (MD5, SHA1, SHA256) with predetermined values, the authentication process becomes automated and computationally efficient. This parameter change from manual to automated verification reduces processing time while maintaining high reliability in peer authentication.
3Adaptability or versatility
If runtime VTEP discovery is enabled, then network adaptability is improved, but vulnerability to rogue VTEPs increases
Solution Approach 1:
The patent applies preliminary anti-action by implementing authentication verification before allowing runtime-discovered VTEPs to establish peer relationships. The authentication packet contains cryptographic hashes that preemptively counteract rogue VTEP attempts. This preliminary defensive action maintains the adaptability of runtime discovery while neutralizing the vulnerability to rogue VTEPs before they can cause harm to the network.
Data Source
AI summary
A first network device configured as a first Virtual Local Area Network (VLAN) Tunnel Endpoint (VTEP) may receive a packet from a second network device. The first VTEP may determine that the second network device is a second VTEP and has not been established as a peer VTEP to the first VTEP. The first VTEP may maintain a status for the second network device as authentication pending, receive an authentication packet from the second network device and authenticating the second network device as a peer VTEP using the authentication packet.