METHODS AND SYSTEMS OF A PACKET ORCHESTRATION TO PROVIDE DATA ENCRYPTION AT THE IP LAYER, UTILIZING A DATA LINK LAYER ENCRYPTION SCHEME

In one aspect, A method for packet orchestration to provide data encryption at the Internet protocol (IP) layer, includes the step of providing a quantum secure pre-shared key derivation scheme for a data link layer bulk encryption algorithm, meaning the ability to setup a separate communication channel, via the SSH protocol, and leverage ECDH over said channel to share pre-shared keys. The method includes the step of providing a set of software-based network bridges. The method includes the step of assigning a set of network ports to specific bridges, wherein the set of network ports implement segmentation and isolation based on an organizational policy.

BACKGROUND

This application relates generally to computer networking, and more specifically to a system, article of manufacture and method for implementing a packet orchestration to provide data encryption at the IP layer, utilizing a data link layer encryption scheme.

2. Related Art

Every day, a 2.5 quintillion bytes of data are created. This is equivalent to 50,000 1 GB USB memory sticks being filled every second. This tremendous amount of data represents a significant opportunity for organizations that have discovered how to monetize the data but has simultaneously also created a problem for security professionals to both transport and store the data securely. Secure transport of high volume of network data and the challenges it poses for many organizations can be critical asset. Enterprise networks are the lifeblood of modern organizations. These networks transport the communications between users, applications, as well as businesses and their customers, partners, and employees. With the growth of the Internet of Things, billions of devices are adding to the rapid increase in the production of network data and or telemetry.

In an effort to understand their business better and gain competitive advantages, organizations have begun to collect and analyze the data about the date (e.g. network telemetry, etc.) to help both protect and better understand the network environment. This is not limited to user data but, with the advent of the Internet of Things, it often represents network telemetry from a myriad of sensors and or non-human devices.

SUMMARY OF THE INVENTION

In one aspect, A method for packet orchestration to provide data encryption at the internet protocol (IP) layer, includes the step of providing a quantum secure pre-shared key derivation scheme for a data link layer bulk encryption algorithm, meaning the ability to setup a separate communication channel, via the SSH protocol, and leverage ECDH over said channel to share pre-shared keys. The method includes the step of providing a set of software-based network bridges. The method includes the step of assigning a set of network ports to specific bridges, wherein the set of network ports implement segmentation and isolation based on an organizational policy. The method includes the step of provisioning and configuring of a set of CPU cores to handle wire-speed data encryption and decryption on a per bridge segmentation standpoint, wherein each network bridge segment, has it own CPU core affinity, and recommended buffer allocation. The method includes the step of provisioning per bridge, an IP overlay encapsulation of a set of encrypted packets. The method includes the step of provisioning a Network interface card (NIC) offloading and packet steering functionality, wherein the NIC offloading and packet steering functionality provides network packet handling for network communications.

DESCRIPTION

Disclosed are a system, method, and article of manufacture of a packet orchestration to provide data encryption at the IP layer, utilizing a data link layer encryption scheme. the following description is presented to enable a person of ordinary skill in the art to make and use the various embodiments. Descriptions of specific devices, techniques, and applications are provided only as examples. Various modifications to the examples described herein can be readily apparent to those of ordinary skill in the art, and the general principles defined herein may be applied to other examples and applications without departing from the spirit and scope of the various embodiments.

Definitions

Example definitions for some embodiments are now provided.

Advanced Encryption Standard (AES) is a symmetric block-cipher with fixed 128-bit blocks and key sizes of 128, 192, or 256 bits.

Bridging can be an action taken by IT network equipment to allow two or more communication networks to create an amalgamated network.

Broadcast domain is a logical division of a computer network, in which all nodes can reach each other by broadcast at the data link layer. A broadcast domain can be within the same LAN segment or it can be bridged to other LAN segments.

Data link layer (e.g. layer 2) is the second layer of the seven-layer OSI model of computer networking. The data link layer is the protocol layer that transfers data between adjacent network nodes in a wide area network (WAN) or between nodes on the same local area network (LAN) segment.

Elliptic-curve Diffie-Hellman (ECDH) is a key agreement protocol that allows two parties, each having an elliptic-curve public-private key pair, to establish a shared secret over an insecure channel.

Encapsulation is a method of designing modular communication protocols in which logically separate functions in the network are abstracted from their underlying structures by inclusion or information hiding within higher level objects.

Ethernet includes a family of computer networking technologies commonly used in local area networks (LAN), metropolitan area networks (MAN) and wide area networks (WAN).

Federal Information Processing Standard Publication 140-2, (FIPS PUB 140-2), is a U.S. government computer security standard used to approve cryptographic modules.

Galois/Counter Mode (GCM) is a mode of operation for symmetric-key cryptographic block ciphers widely adopted for its performance.

Load balancing refers to the process of distributing a set of tasks over a set of resources, with the aim of making their overall processing more efficient. Load balancing techniques can optimize the response time for each task, avoiding unevenly overloading compute nodes

Network interface card (NIC) is a computer hardware component that connects a computer to a computer network.

OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping and/or need to identify the party at the other end.

P-384 is the elliptic curve currently specified in NSA Suite B Cryptography for the Elliptic Curve Digital Signature Algorithm (ECDSA) and Elliptic-curve Diffie-Hellman (ECDH) algorithms.

Provisioning and configuring can mean the allocation of resource (e.g. CPU core affinity, IRQ interrupt, etc.).

Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network.

Secure Hash Algorithms are a family of cryptographic hash functions published by the National Institute of Standards and Technology (NIST).

Segmentation and isolation can mean that the network ports are form their own broadcast domain and are isolated from other network ports dues to the physical nature of connectivity.

Tunneling protocol is a communications protocol that allows for the movement of data from one network to another. A tunneling protocol can allow private network communications to be sent across a public network (e.g. the Internet) through such process as, encapsulation, etc.

Wire speed refers to the hypothetical peak physical layer net bitrate (e.g. useful information rate) of a cable (e.g. of fiber-optical wires or copper wires) combined with a certain digital communication device, interface, or port. For example, wire speed can be the peak bitrate, connection speed, useful bit rate, information rate, or digital bandwidth capacity.

Virtual Extensible LAN (VXLAN) is a network virtualization technology that attempts to address the scalability problems associated with large cloud computing deployments. VXLAN uses a VLAN-like encapsulation technique to encapsulate Open Systems Interconnection (OSI) layer 2 Ethernet frames within layer 4 UDP datagrams, using 4789 as the default IANA-assigned destination UDP port number.

x86 is a family of instruction set architectures initially developed by Intel based on the Intel 8086 microprocessor and its 8088 variant.

Example Methods

A system and method of software-based packet orchestration application, to provide low cost, high performance, point-to-point, or point-multipoint IP Layer data encryption, leveraging a Data Link Layer encryption method, for use in an IP networking environment. The packet orchestration application allows for the use of off-the-shelf Personal Computer components. These can include, inter alia: standard Intel Computer Processing Units (CPU) and Network Interfaces to reduce cost. These can provide for quantum safe encryption, with seamless integration into an existing network infrastructures, limiting the amount of administrative tasks needed to configure, deploy, and maintain the solution.

FIG. 1illustrates an example process100for packet orchestration to provide data encryption at the IP layer, utilizing a data link layer encryption scheme, according to some embodiments. Process100can provide packet orchestration at a low cost, high performance, point-to-point, point-multipoint IP Layer data encryption, segmentation, and privacy, with an off-the-shelf personal computer. Process100can use a low overhead quantum safe data Link layer encryption scheme.

Process100can implement a flow-pilot system. In a flow-pilot system, a software mechanism (e.g. as implemented by processes100-400) can walk the flow through the various system components (e.g. both software and hardware components) inside of a PC (e.g. an x86 system). This step-by-step approach enables process100to segregate the flows for security purposes. This step-by-step approach enables process100to encrypt the flows as well. This can be done without specialized hardware encryptors and/or external off-loading encryptors. This can decrease cost while increasing performance on flow data as it is moving through the system.

More specifically, in step102, a mechanism for creating a quantum secure pre-shared key derivation scheme for the data link layer bulk encryption algorithm is created. As per NIST, the recommended bulk encryption scheme is AES-GCM-128 or AES-GCM-256-bit encryption.

In step104, process100can provide a mechanism for creation of software-based network bridges and the assignment of network ports to specific bridges, for segmentation and isolation. This can be based on organizational policy. Ports can be assigned to bridges based on the communication and or isolation requirements of the connected hosts. It is noted that communication and isolation requirements can mean that a particular IP and or MAC level requirements can be set as the criteria used to isolate the traffic (e.g. MAC Header information, MAC TOS, IP DSCP Bit, subnet, etc.) of a set of connected hosts.

In step106, process100can provide a mechanism for provisioning/configuration of sufficient CPU cores to handle wire speed data encryption/decryption, on a per bridge segmentation standpoint.

FIG. 2illustrates an example process for provisioning/configuration of sufficient CPU cores to handle wire speed data encryption/decryption, on a per bridge segmentation standpoint, according to some embodiments. In step202, as per the specifications of the CPU manufacturer, process200can enable the function of and configure the CPU cores to maximize its use as an encryption/decryption engine. This can include an efficient queuing mechanism.

In step206, process200can provision the CPU cores in a manner sufficient to allow for services other than encryption/decryption, such as is necessary for the functioning of the x86 operating system and other applications.

Returning to process100, in step108, process100can provide a mechanism for provisioning per bridge (e.g. using segment isolation) and IP overlay encapsulation (e.g. with tunneling) of encrypted packets. Segment isolation can mean that said segment leverage a criteria of MAC and IP Level of then traffic to establish isolation parameter (e.g. MAC TOS, IP DSCP Bit, subnet, etc.). This can be implemented in an efficient manner leveraging a specified encapsulation/decapsulation functionality of the operating system software and network vendors ethernet controller.

FIG. 3illustrates an example process300for providing a mechanism for provisioning per bridge and IP overlay encapsulation of encrypted packets, according to some embodiments. In store302, as per the specifications of the Ethernet Controller manufacturer, process300can enable and configure the Ethernet Controller encapsulation/decapsulation offloading functionality to maximize the efficient use of said features.

In step304, process300can provision the system such that specific packets from and to specific bridges are transported on the proper tunnel, based on the policy of the organization.

Returning to process100, in step110, process100can provide a mechanism for provisioning NIC offloading and packet steering functionality, to provide high performance and efficient network packet handling (e.g. encapsulation, checksums, buffer allocation, etc.). In this way, process100can provide for high speed network communications. It is noted that provisioning and configuring a set of CPU cores to handle wire-speed data encryption and decryption on a per bridge segmentation standpoint can mean each network bridge segment has it own CPU core affinity.

FIG. 4illustrates an example process400for providing a mechanism for provisioning NIC offloading and packet steering functionality, according to some embodiments. In step402, process400can provide high performance and efficient network packet handling as per the specifications of the Ethernet Controller manufacturer. Step402can enable and configure the Ethernet Controller to offload the requirement for the CPU to handling specific network functions (e.g. TCP segmentation and reassembly, tunnel encapsulation, TCP/UDP check summing, etc.).

In step404, as per the NIC vendor specifications, process400can orchestrate a hashing method that controls IRQ Queue affinity to allow for maximum distribution of network data across CPU cores.

Example Systems

More specifically, flow-pilot system500can include bridges504-512. Bridges504-512can be implemented with a PC system502. Bridges504-512can each represent a segmented group of network traffic. The network traffic can be segmented so that it does not co-mingle with other network traffic. Bridges504-512can be implemented in the broadcast domain. The segmented network traffic can be communicated to X86 multicore CPU514. X86 multicore CPU514includes an encryption capability. Accordingly, encryption engine516can be implemented X86 multicore CPU514. encryption engine516can implement AES-GCM-128 or AES-GCM-256-bit encryption. This can be managed by orchestration engine524. Orchestration engine524can implement load balancing across cores of X86 multicore CPU(s)514. In this way, any one core of X86 multicore CPU(s)514is not overwhelmed with all of the task of encryption. X86 multicore CPU(s)514is connected with the PCIE bus518. From PCIE bus518, the encrypted network traffic is handed over to ethernet controller520and/or a network interface (e.g. NIC). Ethernet controller520can implement encapsulation engine522. On the network interface, the NIC can distribute the network traffic in an efficient manner and/or offload X86 multicore CPU(s)514from managing the queues. Orchestration engine524can instruct the NIC how to distribute the network traffic. The network traffic can be encapsulated in an IP packet by encapsulation engine522. It can then be provided to a tunnel to be communicated across an applicable network.

Flow-pilot system500can implement a TCP proxy. Flow-pilot system500can tell each end of a TCP communication to continue sending, while flow-pilot system500handles the management of the network flow.

FIG. 6depicts an exemplary computing system600that can be configured to perform any one of the processes provided herein. In this context, computing system600may include, for example, a processor, memory, storage, and I/O devices (e.g., monitor, keyboard, disk drive, Internet connection, etc.). However, computing system600may include circuitry or other specialized hardware for carrying out some or all aspects of the processes. In some operational settings, computing system600may be configured as a system that includes one or more units, each of which is configured to carry out some aspects of the processes either in software, hardware, or some combination thereof.

FIG. 6depicts computing system600with a number of components that may be used to perform any of the processes described herein. The main system602includes a motherboard604having an I/O section606, one or more central processing units (CPU)608, and a memory section610, which may have a flash memory card612related to it. The I/O section606can be connected to a display614, a keyboard and/or other user input (not shown), a disk storage unit616, and a media drive unit618. The media drive unit618can read/write a computer-readable medium620, which can contain programs622and/or data. Computing system600can include a web browser. Moreover, it is noted that computing system600can be configured to include additional systems in order to fulfill various functionalities. Computing system600can communicate with other computing devices based on various computer communication protocols such a Wi-Fi, Bluetooth® (and/or other standards for exchanging data over short distances includes those using short-wavelength radio transmissions), USB, Ethernet, cellular, an ultrasonic local area communication protocol, etc.

Example Link Encryption Processes

FIG. 7illustrates an example process700for securing an encrypted link, according to some embodiments. In step702, process700requires the host system have a FIPS-140-2 Compliant build of OpenSSL (e.g. (OpenSSL-1.1.1), OpenSSH Client (7.9p1), and OpenSSH Server (7.9p1), etc.), configured to use Elliptic Curve Diffie Hellman with NIST-p384 key exchange between the VTEP servers.

In step704, a user then configures the initial VxLAN Tunnel End Points using a GCM-AES-384 cypher, secured by a SHA-384 keypair exchanged over the secured SSH connection.

Once this secure tunnel is established, the VxLAN Tunnel End Point is re-configured (first on the remote server, then on the local server). The process is initiated from the local end point by logon onto the remote server using SSH via the encrypted VxLAN Tunnel.

A new VTEP is configured over the secured SSH session on the initial VxLAN Tunnel configured with GCM-AES-256 cypher utilizing unique sha-384 or 512 rx and tx keys. Upon completion of the re-configuration, the user completes the same process on the local server and restarts the link. Once the link is active new SSH session is established over the new link, and the initial single key VxLan Tunnel configuration is deleted.

In step706, upon successful deletion of the initial tunnel, the switch is enabled allowing traffic onto the tunnel from the LAN. It is noted that specified types of cyphers, network protocols, hash functions and the like have been disclosed by way of example and not of limitation. These can be substituted/integrated with other types of cyphers, network protocols, hash functions and the like in some embodiments.

CONCLUSION