Overlay management protocol for secure routing based on an overlay network

Abstract

A method for creating a secure network is provided. The method comprises establishing an overlay domain to control routing between overlay edge routers based on an underlying transport network, wherein said establishing comprises running an overlay management protocol to exchange information within the overlay domain; in accordance with the overlay management protocol defining service routes that exist exclusively within the overlay domain wherein each overlay route includes information on at least service availability within the overlay domain; and selectively using the service routes to control routing between the overlay edge routers; wherein the said routing is through the underlying transport network in a manner in which said overlay routes is shared with the overlay edge routers but not with the underlying transport network via the overlay management protocol.

The invention claimed is: 
     
       1. A method comprising:
 at an overlay network comprising an overlay controller and a plurality of overlay edge routers that are within control of an enterprise:
 provisioning the overlay controller and the plurality of overlay edge routers with transport parameters to allow respective connections to a public transport network that is not within control of the enterprise; 
 establishing a secure overlay control plane that includes a plurality of secure control channels between the overlay controller and respective overlay edge routers of the plurality of overlay edge routers; 
 establishing a secure overlay data plane that includes a plurality of secure tunnels between at least some of the plurality of overlay edge routers, wherein the plurality of secure tunnels go through the public transport network; 
 collecting, by the overlay controller, routing information comprising at least one of authentication information, service information, encryption information, policy information, and access control information wherein the routing information is carried by an overlay management protocol; and 
 transmitting, by the overlay controller, the routing information to one or more of the plurality of overlay edge routers over the secure overlay control plane in order to mask the routing information from the public transport network. 
   
     
     
       2. The method of  claim 1 , wherein the provisioning comprises:
 provisioning the overlay controller and the plurality of overlay edge routers with respective system parameters that include one or more of a site identifier (ID), a domain ID, a system ID and an address of a mapping server.   
     
     
       3. The method of  claim 1 , wherein each of the plurality of secure control channels includes a Datagram Transport Layer Security (DTLS) tunnel. 
     
     
       4. The method of  claim 1 , wherein each of the plurality of secure tunnels includes an Internet Protocol Security (IPSec) tunnel. 
     
     
       5. The method of  claim 1 , further comprising:
 routing, based on the routing information, data traffic over the secure overlay data plane.   
     
     
       6. The method of  claim 5 , wherein the routing comprises:
 routing the data traffic over the plurality of secure tunnels going through the public transport network.   
     
     
       7. A non-transitory computer-readable medium having stored instructions which when executed by a system cause the system to:
 provision an overlay controller and a plurality of overlay edge routers that are within control of an enterprise with transport parameters to allow respective connections to a public transport network that is not within control of the enterprise;   establish a secure overlay control plane that includes a plurality of secure control channels between the overlay controller and respective overlay edge routers of the plurality of overlay edge routers;   establish a secure overlay data plane that includes a plurality of secure tunnels between at least some of the plurality of overlay edge routers, wherein the plurality of secure tunnels go through the public transport network;   collect, by the overlay controller, routing information comprising at least one of authentication information, service information, encryption information, policy information, and access control information wherein the routing information is carried by an overlay management protocol; and   transmit, by the overlay controller, the routing information to one or more of the plurality of overlay edge routers over the secure overlay control plane in order to mask the routing information from the public transport network.   
     
     
       8. The non-transitory computer-readable medium of  claim 7 , wherein the provisioning comprises:
 provisioning the overlay controller and the plurality of overlay edge routers with respective system parameters that include one or more of a site identifier (ID), a domain ID, a system ID and an address of a mapping server.   
     
     
       9. The non-transitory computer-readable medium of  claim 7 , wherein each of the plurality of secure control channels includes a Datagram Transport Layer Security (DTLS) tunnel. 
     
     
       10. The non-transitory computer-readable medium of  claim 7 , wherein each of the plurality of secure tunnels includes an Internet Protocol Security (IPSec) tunnel. 
     
     
       11. The non-transitory computer-readable medium of  claim 8 , further comprising:
 routing, based on the routing information, data traffic over the secure overlay data plane.   
     
     
       12. The non-transitory computer-readable medium of  claim 11 , wherein the routing comprises:
 routing the data traffic over the plurality of secure tunnels going through the public transport network.   
     
     
       13. A controller, comprising: a processor; and
 a memory coupled to the processor, the memory storing instructions which when executed by the processor causes the controller to:
 provision an overlay controller and a plurality of overlay edge routers that are within control of an enterprise with transport parameters to allow respective connections to a public transport network that is not within control of the enterprise; 
 establish a secure overlay control plane that includes a plurality of secure control channels between the overlay controller and respective overlay edge routers of the plurality of overlay edge routers; 
 establish a secure overlay data plane that includes a plurality of secure tunnels between at least some of the plurality of overlay edge routers, wherein the plurality of secure tunnels go through the public transport network; 
 collect, by the overlay controller, routing information comprising at least one of authentication information, service information, encryption information, policy information, and access control information; wherein the routing information is carried by an overlay management protocol; and 
 transmit, by the overlay controller, the routing information to one or more of the plurality of overlay edge routers over the secure overlay control plane in order to mask the routing information from the public transport network. 
   
     
     
       14. The controller of  claim 13 , wherein the provisioning comprises:
 provisioning the overlay controller and the plurality of overlay edge routers with respective system parameters that include one or more of a site identifier (ID), a domain ID, a system ID and an address of a mapping server.   
     
     
       15. The controller of  claim 13 , wherein each of the plurality of secure control channels includes a Datagram Transport Layer Security (DTLS) tunnel. 
     
     
       16. The controller of  claim 13 , wherein each of the plurality of secure tunnels includes an Internet Protocol Security (IPSec) tunnel. 
     
     
       17. The controller of  claim 13 , wherein the instructions further cause the controller to:
 route, based on the routing information, data traffic over the secure overlay data plane.   
     
     
       18. An overlay network system, comprising:
 a controller and a plurality of overlay network devices of an overlay network configured to use transport parameters to connect to an underlying transport network that is not within control of an enterprise network, the controller comprising:
 a processor; and 
 a memory coupled to the processor, the memory storing instructions which when executed by the processor causes the controller to:
 create a secure overlay control plane by establishing secure control connections with the plurality of overlay network devices of the overlay network; 
 transmit, over corresponding ones of the secure control connections, messages including overlay routing information to the plurality of overlay network devices thereby preventing exposure of the overlay routing information to the underlying transport network, wherein the transmitted overlay routing information includes one or more overlay routes that affects how each overlay network device of the plurality of overlay network devices forwards network traffic to other overlay network devices within the overlay network; and 
 receive, over corresponding ones of the control connections, route information from one or more of the plurality of overlay network devices, the route information including network reachability information for endpoints available at a physical site associated with a corresponding overlay network device; 
 wherein each of the plurality of overlay network devices is operative to: 
 establish, over an underlying transport network, secure tunnels with one or more of the other overlay network devices, wherein the secure tunnels form a secure overlay data plane; 
 collect route information including network reachability information for endpoints available at the physical site associated with the corresponding overlay network device; 
 provide, using a corresponding one of the secure control connections to the controller, the collected route information; 
 receive the overlay routing information transmitted by the controller over a corresponding one of the secure control connections; 
 maintain in a memory the overlay routing information received from the controller, and 
 forward, based on the overlay routing information maintained in the memory, network traffic to selected ones of the plurality of overlay network devices using corresponding ones of the secure tunnels. 
 
   
     
     
       19. The overlay network system of  claim 18 , wherein at least one of the one or more overlay routes comprises information identifying a service or collection of endpoints and a nexthop identifier, the nexthop identifier corresponding to an overlay network device in the overlay network having reachability to the service or the collection of endpoints. 
     
     
       20. The overlay network system of  claim 18 , wherein the overlay routing information further comprises policy data including a preference value associated with one or more of the overlay routes. 
     
     
       21. The overlay network system of  claim 18 , wherein each of the plurality of overlay network devices is operative to collect the route information by interacting with one or more routers at the physical site associated with the corresponding overlay network device. 
     
     
       22. The overlay network system of  claim 21 , wherein each of the plurality of overlay network devices is operative to implement a routing protocol to interact with the one or more routers. 
     
     
       23. The overlay network system of  claim 22 , wherein the routing protocol is any one of Open Shortest Path First (OSPF) or border gateway protocol (BGP). 
     
     
       24. The overlay network system of  claim 18 . wherein the collected route information further includes network reachability information for services available at the physical site associated with the corresponding overlay network device. 
     
     
       25. The overlay network system of  claim 18 , wherein the secure tunnels are IPSec tunnels. 
     
     
       26. An overlay network device, comprising:
 a processor;   a memory coupled to the processor, the memory storing instructions which when executed by the processor cause the overlay network device to:
 create a secure overlay control plane by establishing a secure control connection with a controller; 
 receive, over the secure control connection thereby preventing exposure of overlay routing information to an underlying transport network, messages from the controller, the messages including the overlay routing information, wherein the overlay routing information includes one or more overlay routes that affects how the overlay network device forwards network traffic to other overlay network devices within an overlay network; 
 establish, over an underlying transport network, secure tunnels with one or more other overlay network devices of the overlay network, wherein the secure tunnels form a secure overlay data plane; 
 collect route information including network reachability information for endpoints available at a physical site associated with the overlay network device; 
 distribute the collected route information to the controller over a corresponding secure control connection; and 
 maintain in the memory the overlay routing information received from the controller; and 
 a forwarding component operative to forward, based on the overlay routing information, network traffic to selected ones of the other overlay network devices using corresponding ones of the secure tunnels, 
 wherein the overlay network device and the controller are configured to use transport parameters to connect to the underlying transport network that is not within control of an enterprise network. 
   
     
     
       27. The overlay network device of  claim 26 , wherein at least one of the one or more overlay routes comprises information identifying a service or collection of endpoints and a nexthop identifier, the nexthop identifier corresponding to a particular overlay network device in the overlay network having reachability to the service or the collection of endpoints. 
     
     
       28. The overlay network device of  claim 26 , wherein the overlay routing information further comprises policy data including a preference value associated with one or more of the overlay routes. 
     
     
       29. The overlay network device of  claim 26 , wherein the instructions are further operative to cause the overlay network device to collect the route information by interacting with one or more routers at the physical site associated with the overlay network device. 
     
     
       30. The overlay network device of  claim 29 , wherein the instructions are further operative to cause the overlay network device to implement a routing protocol to interact with the one or more routers. 
     
     
       31. The overlay network device of  claim 30 , wherein the routing protocol is any one of Open Shortest Path First (OSPF) or border gateway protocol (BGP). 
     
     
       32. The overlay network device of  claim 26 , wherein the collected route information further includes network reachability information for services available at the physical site associated with the overlay network device. 
     
     
       33. The overlay network device of  claim 26 , wherein the secure tunnels are IPSec tunnels. 
     
     
       34. The overlay network device of  claim 26 , wherein the forwarding component is a forwarding chip. 
     
     
       35. The overlay network device of  claim 26 , wherein the forwarding component comprises a forwarding chip coupled to one or more of line interfaces. 
     
     
       36. An overlay network controller, comprising:
 a processor; and   a memory coupled to the processor, the memory storing instructions which when executed by the processor causes the controller to:
 create a secure overlay control plane by establishing secure control connections with a plurality of overlay network devices of an overlay network, and 
 transmit, over corresponding ones of the secure control connections, messages including overlay routing information to the plurality of overlay network devices thereby preventing exposure of the overlay routing information to the underlying transport network, wherein the transmitted overlay routing information includes one or more overlay routes that affects how each overlay network device of the plurality of overlay network devices forwards network traffic to other overlay network devices within the overlay network; 
 wherein each of the plurality of overlay network devices is operative to: 
 establish, over an underlying transport network, secure tunnels with one or more of the other overlay network devices, wherein the secure tunnels form a secure overlay data plane; 
 collect route information including network reachability information for endpoints available at a physical site associated with a corresponding overlay network device; 
 distribute the collected route information to the controller over a corresponding secure control connection; 
 maintain the overlay routing information received from the controller; and 
 forward, based on the overlay routing information, network traffic to selected ones of the plurality of overlay network devices using corresponding ones of the secure tunnels, wherein the controller and the plurality of overlay network devices are configured to use transport parameters to connect to the underlying transport network that is not within control of an enterprise network. 
   
     
     
       37. The overlay network controller of  claim 36 , wherein at least one of the one or more overlay routes comprises information identifying a service or collection of endpoints and a nexthop identifier, the nexthop identifier corresponding to an overlay network device in the overlay network having reachability to the service or the collection of endpoints. 
     
     
       38. The overlay network controller of  claim 36 , wherein the overlay routing information further comprises policy data including a preference value associated with one or more of the overlay routes. 
     
     
       39. The overlay network controller of  claim 36 , wherein the instructions are further operative to cause the overlay network controller to receive the collected route information from the plurality of overlay network devices over corresponding ones of the secure control connections. 
     
     
       40. The overlay network controller of  claim 36 , wherein the route information is collected by the plurality of overlay network devices by interacting with one or more routers at the physical site associated with the corresponding overlay network device. 
     
     
       41. The overlay network controller of  claim 40 , wherein the plurality of overlay network devices collect the route information by implementing a routing protocol to interact with the one or more routers. 
     
     
       42. The overlay network controller of  claim 41 , wherein the routing protocol is any one of Open Shortest Path First (OSPF) or border gateway protocol (BGP). 
     
     
       43. The overlay network controller of  claim 36 , wherein the collected route information further includes network reachability information for services available at the physical site associated with the corresponding overlay network device. 
     
     
       44. The overlay network controller of  claim 36 , wherein the secure tunnels are IPSec tunnels.