Microsoft Technology Licensing, LLC

Aanand Ramachandran

Rishabh Tewari

Abhijeet Kumar

Deepak Bansal

Abhishek Shukla

Parag Sharma

Nisheeth Srivastava

Avijit Gupta

Jayesh Kumaran

Abhishek Ellore Sreenath

Sushant Sharma

David Michael Brumley

Neha Aggarwal

Uma Mahesh Mudigonda

Deepak Narula

Chandan Aggarwal

Sudhir Goel

Evan Alexander Baker

Matthew Francis Long

Trilok Nuwal

Alok Upadhyay

Shiva Kumar Thangapandi

A virtual network provider system supports a virtual network including virtual machines that are each assigned to an underlay address of an underlay addressing scheme. The virtual network provider system further includes multiple routing domains each defined to include a different subset of the virtual machines. Each of the routing domains is assigned to a range of overlay addresses of an overlay addressing scheme. For each routing domain, the assigned range of overlay addresses is allocated among the subset of the virtual machines in the routing domain. The system further includes a virtual network host configured to use addresses of the overlay addressing scheme to selectively route messages between endpoints on select pairs of the virtual machines assigned to a same routing domain of the plurality of routing domains.

Overlay scheme for container addressing in virtual networks

The disclosed system implements techniques to secure communications for injecting a workload (e.g., a container) into a virtual network hosted by a cloud-based platform. Based on a delegation instruction received from a tenant, a virtual network of the tenant can connect to and execute a workload via a virtual machine that is part of a virtual network that belongs to a resource provider. To secure calls and authorize access to the tenant's virtual network, authentication information provided with a call from the virtual network of the resource provider may need to match authorization information made available via a publication service of the cloud-based platform. Additionally or alternatively, an identifier of a NIC used to make a call may need to correspond to a registered name of the resource provider for the call to be authorized. These checks provide increased security by preventing unauthorized calls to the tenant's virtual network.

Securing an injection of a workload into a virtual network hosted by a cloud-based platform

The disclosed system implements techniques to secure communications for injecting a workload (e.g., a container) into a virtual network hosted by a cloud-based platform. Based on a delegation instruction received from a tenant, a virtual network of the tenant can connect to and execute a workload via a virtual machine that is part of a virtual network that belongs to a resource provider. To secure calls and authorize access to the tenant's virtual network, authentication information provided in association with a call from the virtual network of the resource provider may need to match authorization information made available via a publication service of the cloud-based platform. Moreover, an identifier of a NIC used to make a call may need to correspond to a registered name of the resource provider for the call to be authorized. These checks provide increased security by preventing unauthorized calls from accessing the tenant's virtual network.

A service is provided that supports a plurality of tenants. Server(s) of the service are communicatively coupled with a plurality of gateways of the service. Each gateway is configured to support at least one tenant. The server(s) of the service include a network interface, a tenant mapper, and a gateway interface. The network interface is configured to receive connection strings from client devices. Each received connection string includes a service portion that maps to the same public IP address of the service, and also includes a corresponding tenant portion that identifies a tenant. The tenant mapper maps the tenant portions of the connection strings to corresponding gateways. The gateway interface is configured to enable the gateways to establish tunnels between the corresponding client devices and identified tenants. Accordingly, clients are enabled to access multiple tenants of the service via a same public IP address.

Techniques for providing services to multiple tenants via a shared end-point

Growing community of inventors

Redmond, WA, United States of America

Aanand Ramachandran