Abstract:
Improved virtualized application performance is provided through disabling of unnecessary functions, such as unnecessary encryption and decryption operations. An example method performed by a hypervisor includes the steps of obtaining a request to one or more of encrypt and decrypt a communication between a first virtual machine and a second virtual machine; determining if the first and second virtual machines execute on a same host as the hypervisor (e.g., by evaluating a context of the communication); and processing the communication without encrypting or decrypting the communication if the first and second virtual machines execute on the same host. Lawful Interception is performed by forwarding an unencrypted version of the communication to an authorized agency. When the communication traverses a switch and/or a router between the first virtual machine and the second virtual machine, an unencrypted version of the communication is placed in a queue within a buffer and a random value and/or an all-zero value is returned to a caller.

Description:
FIELD 
       [0001]    The application relates generally to secure data communications, and more particularly to techniques for improving the performance of such secure data communications. 
       BACKGROUND 
       [0002]    This section introduces aspects that may be helpful to facilitating a better understanding of the inventions. Accordingly, the statements of this section are to be read in this light and are not to be understood as admissions about what is in the prior art or what is not in the prior art. 
         [0003]    Network Function Virtualization (NFV) uses Information Technology (IT) virtualization-related technologies to virtualize classes of network node functions into building blocks that may be connected to create communication services. A service provider that implements an NFV design will implement one or more Virtualized Network Functions (VNFs) (i.e., software implementations of network functions). Multiple VNFs are typically employed in a sequence to deliver a given service. 
         [0004]    Lawful Interception (LI) is the task of lawfully obtaining communications data, such as network management information or communication content, for the purpose of analysis or evidence. Lawful Interception may comprise intercepting telecommunications on behalf of law enforcement agencies (LEAs), administrative agencies, intelligence services or other authorized agencies. 
         [0005]    The virtualization of network functions deployed on general purpose standardized hardware is expected to significantly reduce the costs of deployment and maintenance, and to also reduce product development times. Nonetheless, a need remains for NFV environments that achieve improved performance by disabling unnecessary functions, such as encryption. In addition, a need exists for improved techniques for performing Lawful Interception (LI) in a virtualized environment. 
       SUMMARY 
       [0006]    Illustrative embodiments of the invention provide techniques and apparatus for improved virtualized application performance through disabling of unnecessary functions, such as unnecessary encryption and decryption operations. For example, in one embodiment, a method performed by a hypervisor includes the steps of obtaining a request to one or more of encrypt and decrypt a communication between a first virtual machine and a second virtual machine; determining if the first and second virtual machines execute on a same host as the hypervisor (e.g., by evaluating a context of the communication); and processing the communication without encrypting or decrypting the communication if the first and second virtual machines execute on the same host. Lawful Interception can be performed by forwarding an unencrypted version of the communication to an authorized agency. 
         [0007]    In one example embodiment, when the communication traverses a switch and/or a router between the first virtual machine and the second virtual machine, an unencrypted version of the communication is placed in a queue within a buffer of one or more of the hypervisor and a destination virtual machine and one or more of a random value and an all-zero value are returned to a caller. The unencrypted version of the communication is then located in the queue and returned to the destination virtual machine. 
         [0008]    In another embodiment, an article of manufacture is provided which comprises a tangible processor-readable storage medium having encoded therein executable code of one or more software programs. The one or more software programs when executed by at least one processing device implement steps of the above-described method. 
         [0009]    In yet another embodiment, an apparatus comprises a memory and at least one hardware device configured to perform steps of the above-described method. 
         [0010]    These and other features and advantages of the present invention will become more apparent from the accompanying drawings and the following detailed description. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0011]      FIG. 1  illustrates an exemplary virtualized environment in which one or more embodiments of the invention are implemented; 
           [0012]      FIG. 2  illustrates exemplary pseudo code related to the context of a given encrypted pipe of  FIG. 1 ; 
           [0013]      FIGS. 3 and 4  illustrate exemplary pseudo code for an encrypt system call and a decrypt system call, respectively, according to one embodiment of the invention; 
           [0014]      FIG. 5  illustrates an alternate exemplary virtualized environment having one or more virtual switches and/or routers in which one or more embodiments of the present invention may be implemented; 
           [0015]      FIGS. 6 and 7  illustrate exemplary pseudo code for an encrypt system call and a decrypt system call, respectively, for use in the exemplary virtualized environment of  FIG. 5 ; and 
           [0016]      FIG. 8  shows a processing platform on which one or more embodiments of the invention are implemented. 
       
    
    
     DETAILED DESCRIPTION 
       [0017]    Illustrative embodiments of the invention will be described herein with reference to exemplary virtualized environment, computing systems, communication systems, processing platforms, networks, network nodes, network elements, and associated communication protocols. However, it should be understood that embodiments of the invention are not limited to use with the particular arrangements described, but are instead more generally applicable to any virtualized environment in which it is desirable to provide improved performance by disabling unnecessary functions, such as unnecessary encryption and decryption functions. 
         [0018]    Aspects of the present invention recognize that in a virtualized environment there are often redundant encryption and decryption operations performed for the traffic between two virtual machines that share a common host and thus are under the control of the same hypervisor. According to one embodiment of the invention, redundant encryption and decryption operations are disabled for the traffic between two virtual machines that share a common host. For example, in one exemplary embodiment, the hypervisor employs introspection techniques to examine the context of a communication at run-time in order to determine whether encryption and/or decryption operations are needed for a given communication. 
         [0019]      FIG. 1  illustrates an exemplary virtualized environment  100  in which one or more embodiments of the present invention may be implemented. As shown in  FIG. 1 , at least two exemplary virtual machines  110 - 1  and  110 - 2  are located on a same host  150 . The two exemplary virtual machines  110 - 1  and  110 - 2  are implemented using a hypervisor  120  and communicate over an encrypted pipe  135 . The hypervisor  120  runs on a physical infrastructure of the host  150 . The parameters of the encrypted pipe  135  comprise a context  140 . The encrypted pipe  135  may employ, for example, Internet Protocol Security (IPsec) to secure Internet Protocol (IP) communications over the encrypted pipe  135  by authenticating and encrypting each IP packet of a communication session. In a further variation, the encrypted pipe  135  may employ, for example, Transport Layer Security (TLS) to secure the encrypted pipe  135 . It is noted, however, that the present invention may be applied to all possible tunneling protocols between the endpoints, as would be apparent to a person of ordinary skill in the art. 
         [0020]    Example of a commercially available hypervisor platform that may be used to implement hypervisor  120  and possibly other portions of the system in one or more embodiments of the invention is a KVM (Kernel-based Virtual Machine) hypervisor or a XEN hypervisor. In addition, as discussed further below in conjunction with  FIG. 5 , the exemplary hypervisor  120  may optionally have an associated virtual infrastructure management system, such as a Cloud Orchestration and Management System (e.g., the CloudBand™ NFV platform from Alcatel-Lucent of Boulogne-Billancourt, France) or an Operations Support System (such as the Service Aware Manager™ (SAM) from Alcatel-Lucent of Boulogne-Billancourt, France). The underlying physical machines (e.g., hosts  150 ) may comprise one or more distributed processing platforms that include storage products. 
         [0021]    The exemplary virtualized environment  100  further comprises one or more applications (not shown) running on the virtual machines  110 - 1 ,  110 - 2  under the control of the hypervisor  120 . 
         [0022]    As discussed further below in conjunction with  FIG. 2 , the exemplary context  140  of the encrypted pipe  135  comprises IP addresses of the two exemplary virtual machines  110 - 1  and  110 - 2 , encryption keying material needed for the encrypted pipe  135 , port numbers (e.g., in the case of TLS), and other tunnel parameters. 
         [0023]    In the embodiment of  FIG. 1 , however, where the two virtual machines  110 - 1  and  110 - 2  share a common host  150 , no actual networking is involved on the encrypted pipe  135 , as the “messages” are segments of the memory of the hypervisor  120 . In one exemplary implementation, communications between the two exemplary virtual machines  110 - 1  and  110 - 2  are temporarily stored in a message buffer  130  for transfer. With conventional techniques, each protocol data unit (i.e., each message) received from a source virtual machine, such as virtual machine  110 - 1 , is passed to the hypervisor  120 , which encrypts the received message and stores the encrypted message in the message buffer  130 . The hypervisor  120  then copies the contents of the message buffer  130  and decrypts the encrypted message for delivery to the destination virtual machine, such as virtual machine  110 - 2 . 
         [0024]    As noted above, aspects of the present invention reduce one or more redundant encryption and decryption operations by disabling a given encryption operation and associated decryption operation for the traffic on the encrypted pipe  135  between the two virtual machines  110 - 1  and  110 - 2  having a common host. In one exemplary embodiment, the hypervisor employs introspection techniques to examine the context  140  of a communication at run-time in order to determine whether encryption and/or decryption operations are needed for a given communication. 
         [0025]    In one exemplary implementation, the hypervisor  120  detects that one virtual machine, such as virtual machine  110 - 1 , is trying to establish a cryptographically protected tunnel with another virtual machine, such as virtual machine  110 - 2 , on the same host  150  by means of breakpointing the invocations of a cryptographic tunneling protocol, such as TLS or IPsec, to establish the encrypted pipe  135  (e.g., a tunnel). Once an encrypted pipe  135  is established, the hypervisor  120  learns the context  140  and stores the context  140  in a data structure, discussed further below in conjunction with  FIG. 2 , which associates both virtual machines  110 . 
         [0026]    As discussed further below in conjunction with  FIGS. 3 and 4 , the hypervisor  120  evaluates the context  140  on each subsequent system call (from either virtual machine  110 - 1  or  110 - 2 ) that involves the encryption invocation. The hypervisor  120 , however, does not perform the encryption/decryption operation(s) when the virtual machines  110  are on the same host  120 . Rather, on an encrypt call, the exemplary hypervisor  120  returns system calls (e.g., an acknowledgement) as though the encryption took place and passes the message buffer  130  unencrypted to the destination virtual machine. Similarly, the hypervisor  120  ignores a later call to decrypt the contents of the message buffer  130 . 
         [0027]    In addition, as shown in  FIG. 1 , the exemplary hypervisor  120  employs one or more system call traps  160  to virtualize the execution of certain instructions. In this manner, instructions are discovered and replaced with traps  160  into the virtual machine environment to be emulated in software, in a known manner. 
         [0028]      FIGS. 2-4  illustrate exemplary pseudo code for an exemplary IPSsec implementation of the present invention. The appropriate pseudo code for alternate implementations of the present invention, such as a TLS implementation, would be apparent to a person of ordinary skill in the art, based on the present disclosure. For example, for a TLS implementation, the context  140  comprises source-destination ports, as would be apparent to a person of ordinary skill in the art. 
         [0029]      FIG. 2  illustrates exemplary pseudo code  200  related to the context  140  of a given encrypted pipe  135 . As shown in  FIG. 2 , the exemplary pseudo code  200  comprises code  210  for creating a data structure that stores the context  140 . The exemplary context  140  comprises a pointer to the Internet Key Exchange (IKE) context of the exemplary IPsec protocol suite where the encryption keying material needed for the encrypted pipe  135  is stored. In addition, the exemplary data structure for the context  140  comprises the IP addresses of the two exemplary virtual machines  110 - 1  and  110 - 2  associated with the encrypted pipe  135 . 
         [0030]    In addition, the exemplary code  210  that creates the context data structure includes a portion for enabling Lawful Interception (LI) in the virtualized environment  100 . 
         [0031]    The exemplary pseudo code  200  further includes a handler routine  220  for handling an IPsec Key Exchange system call invocation. As shown in  FIG. 2  on an IPsec Key Exchange system call, the IKE context is established if the destination address belongs to a local virtual machine  100 . 
         [0032]      FIG. 3  illustrates exemplary pseudo code for an encrypt system call  300  according to one embodiment of the invention. As shown in  FIG. 3 , on an encrypt system call  300 , the handler deals with an incoming message by initially determining if there is context (IKE_context, created by the pseudo code  200  of  FIG. 2 ) for the communication on the current host  150 . If there is context (i.e., the two virtual machines involved in the communication are on the same host), then the exemplary encrypt system call  300  does not encrypt the communication. If there is not context (i.e., the two virtual machines involved in the communication are not on the same host), then the exemplary encrypt system call  300  continues with the IPsec encryption in a conventional manner. 
         [0033]      FIG. 4  illustrates exemplary pseudo code for a decrypt system call  400  according to one embodiment of the invention. As shown in  FIG. 4 , on a decrypt system call  400 , the handler deals with an incoming message by initially determining if there is context (IKE_context, created by the pseudo code  200  of  FIG. 2 ) for the communication on the current host  150 . If there is context (i.e., the two virtual machines involved in the communication are on the same host), then the exemplary decrypt system call  400  does not decrypt the communication. If there is not context (i.e., the two virtual machines involved in the communication are not on the same host), then the exemplary decrypt system call  400  continues with the IPsec decryption in a conventional manner. 
         [0034]      FIG. 5  illustrates an alternate exemplary virtualized environment  500  having one or more virtual switches and routers in which one or more embodiments of the present invention may be implemented. As shown in  FIG. 5 , at least two exemplary virtual machines  510 - 1  and  510 - 2  are located on a same host  550 . The two exemplary virtual machines  510 - 1  and  510 - 2  are implemented using a hypervisor  520  and communicate over an encrypted pipe  535 . The hypervisor  520  runs on a physical infrastructure of the host  550 , in a similar manner as the embodiment of  FIG. 1 . The encrypted pipe  535  and related context  540  can be implemented in a similar manner as the embodiment of  FIG. 1 . The exemplary virtualized environment  500  further comprises one or more applications (not shown) running on the virtual machines  510 - 1 ,  510 - 2  under the control of the hypervisor  520 . 
         [0035]    As shown in  FIG. 5 , the exemplary virtualized environment  500  comprises one or more virtual switches  537  and/or one or more routers  539 . In the presence of virtual switches  537  and/or routers  539 , care must be taken that the messages may not be intercepted by other virtual machines. In the case of Lawful Interception, these mechanisms will aid interception. 
         [0036]    In the embodiment of  FIG. 5 , the two virtual machines  510 - 1  and  510 - 2  share a common host  550 , in a similar manner as the embodiment of  FIG. 1 . In one exemplary implementation, communications between the two exemplary virtual machines  510 - 1  and  510 - 2  are temporarily stored in a message buffer  530  for transfer. As noted above, aspects of the present invention reduce one or more redundant encryption and decryption operations by disabling a given encryption operation and associated decryption operation for the traffic on the encrypted pipe  535  between the two virtual machines  510 - 1  and  510 - 2  having a common host. In one exemplary embodiment, the hypervisor  520  employs introspection techniques to examine the context  540  of a communication at run-time in order to determine whether encryption and/or decryption operations are needed for a given communication. 
         [0037]    In one exemplary implementation, the hypervisor  520  detects that one virtual machine, such as virtual machine  510 - 1 , is trying to establish a cryptographically protected tunnel with another virtual machine, such as virtual machine  510 - 2 , on the same host  550  and becomes aware of the context  540 . Thereafter, the hypervisor  520  carries the actual messages directly between virtual machine  510 - 1  and virtual machine  510 - 2  by means of copying the message buffer  530 . The switches  537  and routers  539  are fed dummy messages (e.g., with a random or all-zero payload), that are ignored upon receipt. 
         [0038]    An operations support system (OSS)  560  enables end-to-end network and service management across all domains of the converged IP network. The exemplary operations support system  560  delivers unified operations, whether network services are running in a virtualized environment or on specialized hardware platforms. The exemplary operations support system  560  may be embodied, for example, using the Service Aware Manager (SAM) of Alcatel-Lucent. 
         [0039]    A cloud management system  570  optionally orchestrates, automates, and improves virtual network functions across a distributed network and data centers of a service provider. The cloud management system  570  may be embodied, for example, using the CloudBand Management System of Alcatel-Lucent. Generally, the cloud management system  570  optionally aggregates distributed cloud nodes and provides a view of the entire NFV infrastructure as a single, carrier-grade pool. 
         [0040]    The exemplary operations support system  560  and/or the exemplary cloud management system  570  can issue direct instructions for creation and/or deletion of a given context. 
         [0041]      FIG. 6  illustrates exemplary pseudo code for an encrypt system call  600  for use in the exemplary virtualized environment  500  of  FIG. 5 . As shown in  FIG. 6 , on an encrypt system call  600 , the handler deals with an incoming message by initially determining if there is context (IKE_context, created by the pseudo code  200  of  FIG. 2 ) for the communication on the current host  550 . If there is context (i.e., the two virtual machines involved in the communication are on the same host), then the exemplary encrypt system call  600  places the unencrypted message in a queue within the buffer  530  or the destination virtual machine  510  and returns an all-zero (or random) entry to the caller. If there is not context (i.e., the two virtual machines involved in the communication are not on the same host), then the exemplary encrypt system call  600  continues with the IPsec encryption in a conventional manner. 
         [0042]      FIG. 7  illustrates exemplary pseudo code for a decrypt system call  700  for use in the exemplary virtualized environment  500  of  FIG. 5 . As shown in  FIG. 7 , on a decrypt system call  700 , the handler deals with an incoming message by initially determining if there is context (IKE_context, created by the pseudo code  200  of  FIG. 2 ) for the communication on the current host  550 . If there is context (i.e., the two virtual machines involved in the communication are on the same host), then the exemplary decrypt system call  700  locates the original (unencrypted) message in the appropriate queue within the message buffer  530  and returns the original message (and discards the contents of the input). If there is not context (i.e., the two virtual machines involved in the communication are not on the same host), then the exemplary decrypt system call  700  continues with the IPsec decryption in a conventional manner. 
         [0043]    In the event that one of the virtual machines  110 ,  510  described herein is moved to another host  150 ,  550 , it is important to revert to the encryption of communications between the two virtual machines that are no longer on the same host. In this case, the hypervisor  120 ,  520  that disabled the encryption will restore the encryption upon detecting that a virtual machine has moved. This detection can be triggered by the change in the context  140 ,  540  signaled by several means (e.g., the termination of a virtual machine, such as virtual machine  510 - 2 , or an action from the operations support system  560  or the cloud orchestration management system  570 ). 
         [0044]    In the case of Lawful Interception, with the above mechanism, the communication stream in question can be forwarded unencrypted for the interception. The granularity in the communication stream selection can optionally be narrowed to a specific (IP address, Port) pair. This arrangement will work independent of the need for performance optimization. In this manner, intercepted communications data can be provided to an authorized agency. 
         [0045]      FIG. 8  shows a processing platform  800  on which one or more embodiments of the invention are implemented. The processing platform  800  in this embodiment comprises at least a portion of the given system and includes a plurality of processing devices, denoted  802 - 1 ,  802 - 2 ,  802 - 3 , . . .  802 -D, which communicate with one another over a network  804 . The network  804  may comprise any type of network, such as a wireless area network (WAN), a local area network (LAN), a satellite network, a telephone or cable network, a cellular network, a wireless network such as WiFi or WiMAX, or various portions or combinations of these and other types of networks. 
         [0046]    The processing device  802 - 1  in the processing platform  800  comprises a processor  810  coupled to a memory  812 . The processor  810  may comprise a microprocessor, a microcontroller, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other type of processing circuitry, as well as portions or combinations of such circuitry elements, and the memory  812 , which may be viewed as an example of a “computer program product” having executable computer program code embodied therein, may comprise random access memory (RAM), read only memory (ROM) or other types of memory, in any combination. 
         [0047]    Also included in the processing device  802 - 1  is network interface circuitry  814 , which is used to interface the processing device with the network  804  and other system components, and may comprise conventional transceivers. 
         [0048]    The other processing devices  802  of the processing platform  800  are assumed to be configured in a manner similar to that shown for processing device  802 - 1  in the figure. 
         [0049]    Again, the particular processing platform  800  shown in the figure is presented by way of example only, and the given system may include additional or alternative processing platforms, as well as numerous distinct processing platforms in any combination, with each such platform comprising one or more computers, storage devices or other processing devices. 
         [0050]    Multiple elements of the system may be collectively implemented on a common processing platform of the type shown in  FIG. 1, 5 or 8 , or each such element may be implemented on a separate processing platform. 
         [0051]    As is known in the art, the methods and apparatus discussed herein may be distributed as an article of manufacture that itself comprises a computer readable medium having computer readable code means embodied thereon. The computer readable program code means is operable, in conjunction with a computer system, to carry out all or some of the steps to perform the methods or create the apparatuses discussed herein. The computer readable medium may be a tangible recordable medium (e.g., floppy disks, hard drives, compact disks, memory cards, semiconductor devices, chips, application specific integrated circuits (ASICs)) or may be a transmission medium (e.g., a network comprising fiber-optics, the world-wide web, cables, or a wireless channel using time-division multiple access, code-division multiple access, or other radio-frequency channel). Any medium known or developed that can store information suitable for use with a computer system may be used. The computer-readable code means is any mechanism for allowing a computer to read instructions and data, such as magnetic variations on a magnetic media or height variations on the surface of a compact disk. 
         [0052]    Although certain illustrative embodiments are described herein in the context of communication networks and systems utilizing particular communication protocols, other types of networks and systems can be used in other embodiments. As noted above, the term “network” or “system” as used herein is therefore intended to be broadly construed. Further, it should be emphasized that the embodiments described above are for purposes of illustration only, and should not be interpreted as limiting in any way. Other embodiments may use different types of network, system, device and module configurations, and alternative communication protocols, process steps and operations for implementing security functionality. The particular manner in which the user devices and network nodes communicate can be varied in other embodiments. Also, it should be understood that the particular assumptions made in the context of describing the illustrative embodiments should not be construed as requirements of the invention. The invention can be implemented in other embodiments in which these particular assumptions do not apply. These and numerous other alternative embodiments within the scope of the appended claims will be readily apparent to those skilled in the art.