Overlay management protocol for secure routing based on an overlay network

Abstract

A method for creating a secure network is provided. The method comprises establishing an overlay domain to control routing between overlay edge routers based on an underlying transport network, wherein said establishing comprises running an overlay management protocol to exchange information within the overlay domain; in accordance with the overlay management protocol defining service routes that exist exclusively within the overlay domain wherein each overlay route includes information on at least service availability within the overlay domain; and selectively using the service routes to control routing between the overlay edge routers; wherein the said routing is through the underlying transport network in a manner in which said overlay routes is shared with the overlay edge routers but not with the underlying transport network via the overlay management protocol.

The invention claimed is: 
     
       1. A method comprising:
 at an overlay network comprising an overlay controller and a plurality of overlay edge routers that are within control of an enterprise:
 provisioning the overlay controller and the plurality of overlay edge routers with transport parameters to allow respective connections to a public transport network that is not within control of the enterprise; 
 establishing a secure overlay control plane that includes a plurality of secure control channels between the overlay controller and respective overlay edge routers of the plurality of overlay edge routers; 
 establishing a secure overlay data plane that includes a plurality of secure tunnels between at least some of the plurality of overlay edge routers, wherein the plurality of secure tunnels go through the public transport network; 
 collecting, by the overlay controller, routing information comprising at least one of authentication information, service information, encryption information, policy information, and access control information wherein the routing information is carried by an overlay management protocol; and 
 transmitting, by the overlay controller, the routing information to one or more of the plurality of overlay edge routers over the secure overlay control plane in order to mask the routing information from the public transport network. 
   
     
     
       2. The method of  claim 1 , wherein the provisioning comprises:
 provisioning the overlay controller and the plurality of overlay edge routers with respective system parameters that include one or more of a site identifier (ID), a domain ID, a system ID and an address of a mapping server.   
     
     
       3. The method of  claim 1 , wherein each of the plurality of secure control channels includes a Datagram Transport Layer Security (DTLS) tunnel. 
     
     
       4. The method of  claim 1 , wherein each of the plurality of secure tunnels includes an Internet Protocol Security (IPSec) tunnel. 
     
     
       5. The method of  claim 1 , further comprising:
 routing, based on the routing information, data traffic over the secure overlay data plane.   
     
     
       6. The method of  claim 5 , wherein the routing comprises:
 routing the data traffic over the plurality of secure tunnels going through the public transport network.   
     
     
       7. A non-transitory computer-readable medium having stored instructions which when executed by a system cause the system to:
 provision an overlay controller and a plurality of overlay edge routers that are within control of an enterprise with transport parameters to allow respective connections to a public transport network that is not within control of the enterprise;   establish a secure overlay control plane that includes a plurality of secure control channels between the overlay controller and respective overlay edge routers of the plurality of overlay edge routers;   establish a secure overlay data plane that includes a plurality of secure tunnels between at least some of the plurality of overlay edge routers, wherein the plurality of secure tunnels go through the public transport network;   collect, by the overlay controller, routing information comprising at least one of authentication information, service information, encryption information, policy information, and access control information wherein the routing information is carried by an overlay management protocol; and   transmit, by the overlay controller, the routing information to one or more of the plurality of overlay edge routers over the secure overlay control plane in order to mask the routing information from the public transport network.   
     
     
       8. The non-transitory computer-readable medium of  claim 7 , wherein the provisioning comprises:
 provisioning the overlay controller and the plurality of overlay edge routers with respective system parameters that include one or more of a site identifier (ID), a domain ID, a system ID and an address of a mapping server.   
     
     
       9. The non-transitory computer-readable medium of  claim 7 , wherein each of the plurality of secure control channels includes a Datagram Transport Layer Security (DTLS) tunnel. 
     
     
       10. The non-transitory computer-readable medium of  claim 7 , wherein each of the plurality of secure tunnels includes an Internet Protocol Security (IPSec) tunnel. 
     
     
       11. The non-transitory computer-readable medium of  claim 8 , further comprising:
 routing, based on the routing information, data traffic over the secure overlay data plane.   
     
     
       12. The non-transitory computer-readable medium of  claim 11 , wherein the routing comprises:
 routing the data traffic over the plurality of secure tunnels going through the public transport network.   
     
     
       13. A controller, comprising: a processor; and
 a memory coupled to the processor, the memory storing instructions which when executed by the processor causes the controller to:
 provision an overlay controller and a plurality of overlay edge routers that are within control of an enterprise with transport parameters to allow respective connections to a public transport network that is not within control of the enterprise; 
 establish a secure overlay control plane that includes a plurality of secure control channels between the overlay controller and respective overlay edge routers of the plurality of overlay edge routers; 
 establish a secure overlay data plane that includes a plurality of secure tunnels between at least some of the plurality of overlay edge routers, wherein the plurality of secure tunnels go through the public transport network; 
 collect, by the overlay controller, routing information comprising at least one of authentication information, service information, encryption information, policy information, and access control information; wherein the routing information is carried by an overlay management protocol; and 
 transmit, by the overlay controller, the routing information to one or more of the plurality of overlay edge routers over the secure overlay control plane in order to mask the routing information from the public transport network. 
   
     
     
       14. The controller of  claim 13 , wherein the provisioning comprises:
 provisioning the overlay controller and the plurality of overlay edge routers with respective system parameters that include one or more of a site identifier (ID), a domain ID, a system ID and an address of a mapping server.   
     
     
       15. The controller of  claim 13 , wherein each of the plurality of secure control channels includes a Datagram Transport Layer Security (DTLS) tunnel. 
     
     
       16. The controller of  claim 13 , wherein each of the plurality of secure tunnels includes an Internet Protocol Security (IPSec) tunnel. 
     
     
       17. The controller of  claim 13 , wherein the instructions further cause the controller to:
 route, based on the routing information, data traffic over the secure overlay data plane.   
     
     
       18. An overlay network system, comprising:
 a controller and a plurality of overlay network devices configured to use transport parameters to connect to an underlying transport network that is not within control of an enterprise network, the controller comprising:
 a processor; 
 a memory coupled to the processor, the memory storing instructions which when executed by the processor causes the controller to:
 create a secure overlay control plane by establishing, over the underlying transport network, secure control connections with the plurality of overlay network devices, and 
 transmit, over corresponding ones of the secure control connections, messages including overlay routing information to the overlay network devices thereby preventing exposure of the overlay routing information to the underlying transport network, wherein the transmitted overlay routing information includes policy data that affects how each overlay network device of the plurality of overlay network devices forwards network traffic to the other overlay network devices; 
 
   each of the plurality of overlay network devices operative to:
 establish, over the underlying transport network, secure network layer tunnels with one or more of the other overlay network devices, wherein the secure network layer tunnels form a secure overlay data plane, 
 collect route information including network reachability information for endpoints available at a physical site associated with the corresponding overlay network device, 
 distribute the collected route information to the controller over a corresponding secure control connection, 
 maintain the overlay routing information received from the controller, and 
 forward, based on the overlay routing information, network traffic to selected ones of the overlay network devices using corresponding ones of the secure network layer tunnels.  
   
     
     
       19. The overlay network system of claim 18, wherein the overlay routing information comprises one or more overlay routes, wherein each overlay route comprises information identifying a service or collection of endpoints and a next-hop identifier, the next-hop identifier corresponding to an overlay network device in the overlay network having reachability to the service or the collection of endpoints.  
     
     
       20. The overlay network system of claim 18, wherein the policy data comprises a preference value associated with an overlay route.  
     
     
       21. The overlay network system of claim 18, wherein the overlay network devices are each operative to transmit the collected route information to the controller.  
     
     
       22. The overlay network system of claim 18, wherein each of the overlay network devices are operative to collect the route information by interacting with one or more routers at the physical site associated with the corresponding overlay network device.  
     
     
       23. The overlay network system of claim 22, wherein each of the overlay network devices are operative to implement a routing protocol to interact with the one or more routers.  
     
     
       24. The overlay network system of claim 23, wherein the routing protocol is any one of the Open Shortest Path First (OSPF) or the border gateway protocol (BGP).  
     
     
       25. The overlay network system of claim 18, wherein the collected route information further includes network reachability information for services available at a physical site associated with a given overlay network device.  
     
     
       26. The overlay network system of claim 18, wherein the secure network layer tunnels are IPSec tunnels.  
     
     
       27. An overlay network device, comprising
 a processor;   a memory coupled to the processor, the memory storing instructions which when executed by the processor causes the overlay network device to:
 create a secure overlay control plane by establishing, over an underlying transport network, a secure control connection with a controller; and 
 receive, over the secure control connection thereby preventing exposure of overlay routing information to the underlying transport network, messages from the controller, the messages including the overlay routing information, wherein the overlay routing information includes policy data for one or more overlay routes; 
 establish, over the underlying transport network, secure network layer tunnels with one or more other overlay network devices of an overlay network, wherein the secure network layer tunnels form a secure overlay data plane, 
 collect route information including network reachability information for endpoints available at a physical site associated with the overlay network device; 
 distribute the collected route information to the controller over a corresponding secure control connection; and 
 maintain in the memory the overlay routing information received from the controller, and 
   a forwarding component operative to:
 forward, based on the overlay routing information and policy data, network traffic to selected ones of the overlay network devices using corresponding ones of the secure network layer tunnels, 
   
       wherein the overlay network device and the controller are configured to use transport parameters to connect to the underlying transport network that is not within control of an enterprise network.  
     
     
       28. The overlay network device of claim 27, wherein the overlay routing information comprises one or more overlay routes, wherein each overlay route comprises information identifying a service or collection of endpoints and a next-hop identifier, the next-hop identifier corresponding to an overlay network device in the overlay network having reachability to the service or the collection of endpoints.  
     
     
       29. The overlay network device of claim 27, wherein the policy data comprises a preference value associated with an overlay route.  
     
     
       30. The overlay network device of claim 27, wherein the instructions are further operative cause the overlay network device to transmit the collected route information to the controller.  
     
     
       31. The overlay network device of claim 27, wherein the instructions are further operative cause the overlay network device to collect the route information by interacting with one or more routers at the physical site associated with the corresponding overlay network device.  
     
     
       32. The overlay network device of claim 31, wherein the instructions are further operative cause the overlay network device to implement a routing protocol to interact with the one or more routers.  
     
     
       33. The overlay network device of claim 32, wherein the routing protocol is any one of the Open Shortest Path First (OSPF) or the border gateway protocol (BGP).  
     
     
       34. The overlay network device of claim 29, wherein the collected route information further includes network reachability information for services available at a physical site associated with a given overlay network device.  
     
     
       35. The overlay network device of claim 27, wherein the secure network layer tunnels are IPSec tunnels.  
     
     
       36. The overlay network device of claim 27, wherein the forwarding component is a forwarding chip.  
     
     
       37. The overlay network device of claim 36, wherein the forwarding component is a forwarding chip coupled to one or more line interfaces.  
     
     
       38. An overlay network controller, comprising
 a processor;   a memory coupled to the processor, the memory storing instructions which when executed by the processor causes the controller to:
 creating a secure overlay control plane by establishing, over an underlying transport network, secure control connections with a plurality of overlay network devices of an overlay network, and 
 transmit, over corresponding ones of the secure control connections, messages including overlay routing information to the overlay network devices thereby preventing exposure of the overlay routing information to the underlying transport network, wherein the transmitted overlay routing information includes policy data that affects how each overlay network device of the plurality of overlay network devices forwards network traffic to the other overlay network devices within the overlay network; 
   wherein the plurality of overlay network devices are each operative to:
 establish, over the underlying transport network, secure network layer tunnels with one or more of the other overlay network devices, wherein the secure network layer tunnels form a secure overlay data plane, 
 collect route information including network reachability information for endpoints available at a physical site associated with the corresponding overlay network device; 
 distribute the collected route information to the controller over a corresponding secure control connection, 
 maintain the overlay routing information received from the controller, and 
 forward, based on the overlay routing information, network traffic to selected ones of the overlay network devices using corresponding ones of the secure network layer tunnels, 
   wherein the controller and the plurality of overlay network devices are configured to use transport parameters to connect to the underlying transport network that is not within control of an enterprise network.    
     
     
       39. The overlay network controller of claim 38, wherein the overlay routing information comprises one or more overlay routes, wherein each overlay route comprises information identifying a service or collection of endpoints and a next-hop identifier, the next-hop identifier corresponding to an overlay network device in the overlay network having reachability to the service or the collection of endpoints.  
     
     
       40. The overlay network controller of claim 38, wherein the policy data comprises a preference value associated with an overlay route.  
     
     
       41. The overlay network controller of claim 38, wherein the instructions are further operative cause the controller to receive the collected route information from the overlay network devices over corresponding ones of the control connections.  
     
     
       42. The overlay network controller of claim 38, wherein the route information is collected by the overlay network devices by interacting with one or more routers at the physical site associated with the corresponding overlay network device.  
     
     
       43. The overlay network controller of claim 38, wherein the overlay network devices collect the route information by implementing a routing protocol to interact with the one or more routers.  
     
     
       44. The overlay network controller of claim 43, wherein the routing protocol is any one of the Open Shortest Path First (OSPF) or the border gateway protocol (BGP).  
     
     
       45. The overlay network controller of claim 38, wherein the collected route information further includes network reachability information for services available at a physical site associated with a given overlay network device.  
     
     
       46. The overlay network controller of claim 38, wherein the secure network layer tunnels are IPSec tunnels.