Subject: [vpn4dc] Question on the problem

From: Fred Baker <[email-masked]>
Date: Mon, 31 Oct 2011 20:58:07 +0800

I have started reading the vpn4dc drafts, and especially the problem statements, and find myself scratching my head. Starting with the title "VPN for Data Center", I really wonder if the topic is starting from a proposed solution before settling on a problem.

Let me ramble a bit, and then tell me I'm wrong.

It seems to me that your primary issue is that you have a set of hosts that want to communicate with each other securely. These hosts might be physical or virtual, and might be in the same data center or in different data centers. The important thing is that they be able to authenticate communications with each other, and then do things that they are authorized to do based on those communications. The things that they do might differ. Within one community, the hosts might all be peers accomplishing the job of the cloud, whatever that is - order processing, content delivery, take your pick. Within another community, the issue might be the management of virtual machines, and you might have a relatively small number of control systems that talk with a large number of client machines.

The term "VPN" implies to me that you have chosen a solution. It might be an MPLS VPN, which is to say that you have transport but depend on higher layer services for encryption, authentication, and authorization. In IPsec, "VPN" the term "VPN" generally refers to the tunnel mode, and is a way of overlaying one network on another. In the case, that doesn't make a lot of sense to me in this context - You don't appear to be overlaying networks per se, merely making sure that messages you receive and process are from trusted peers.

If the primary issue is one of trust, we could discuss TLS, https (if the only application protocol is a web protocol), or IPsec's transport mode. In any of those, the issue is largely one of key distribution, and the use of those keys for encryption and authentication to manage communications among a set of communicating entities. 

What am I missing? What makes this specifically a Virtual Private Network? Why is this not a key distribution problem based on existing technologies?