Microsoft Technology Licensing, LLC

Abhishek Ellore Sreenath

Rishabh Tewari

Abhishek Shukla

Parag Sharma

Nisheeth Srivastava

Deepak Bansal

Xinyan Zan

Ashish Bhargava

Avijit Gupta

Jayesh Kumaran

Naveen Prabhat

Abhijeet Kumar

Aanand Ramachandran

Sushant Sharma

David Michael Brumley

Neha Aggarwal

Sumeet Mittal

Harish Kumar Chandrappa

Madhan Sivakumar

Pranjal Shrivastava

Anitha Adusumilli

Qiming Chen

Ajinkya Potdar

Sandesh Kerehali Shankaranarayan Shety

A virtual network interface controller (NIC) associated with a virtual machine in a cloud computing network is configured to support one or more network containers that encapsulate networking configuration data and policies that are applicable to a specific discrete computing workload to thereby enable the virtual machine to simultaneously belong to multiple virtual networks using the single NIC. The network containers supported by the NIC can be associated with a single tenant to enable additional flexibility such quickly switching between virtual networks and support pre-provisioning of additional computing resources with associated networking policies for rapid deployment. The network containers can also be respectively associated with different tenants so that the single NIC can support multi-tenant services on the same virtual machine.

Multi-tenant support on virtual machines in cloud computing networks

The disclosed system implements techniques to secure communications for injecting a workload (e.g., a container) into a virtual network hosted by a cloud-based platform. Based on a delegation instruction received from a tenant, a virtual network of the tenant can connect to and execute a workload via a virtual machine that is part of a virtual network that belongs to a resource provider. To secure calls and authorize access to the tenant's virtual network, authentication information provided with a call from the virtual network of the resource provider may need to match authorization information made available via a publication service of the cloud-based platform. Additionally or alternatively, an identifier of a NIC used to make a call may need to correspond to a registered name of the resource provider for the call to be authorized. These checks provide increased security by preventing unauthorized calls to the tenant's virtual network.

Securing an injection of a workload into a virtual network hosted by a cloud-based platform

A method for facilitating communication between resources in different virtual networks includes creating a first virtual network and a second virtual network within a cloud computing system and creating a first subnet within the first virtual network and a second subnet within the second virtual network. The method also includes mapping the first subnet to the second subnet such that the resources in the first subnet and the second subnet are able to communicate with each other using private address space. The method also includes routing data packets between the first subnet and the second subnet.

Mapping subnets in different virtual networks using private address space

A method to provide network connectivity to a virtual machine hosted on a server computer system includes detecting a change in a configuration of a software-defined network to which the server computer system provides access; issuing a network configuration update (NCU) for consumption by the virtual machine, the NCU including a data structure reflecting the change in the configuration; and providing a link-state notification (LSN) to a virtual network interface card of the virtual machine pursuant to the change in the configuration, the LSN including data indicating a state of network connectivity of the virtual machine. Receipt of the LSN triggers a dynamic host-configuration protocol (DHCP) handshake by the virtual machine; the NCU is received by the virtual machine pursuant to the DHCP handshake.

Network configuration updates for virtual machine

The disclosed system implements techniques to secure communications for injecting a workload (e.g., a container) into a virtual network hosted by a cloud-based platform. Based on a delegation instruction received from a tenant, a virtual network of the tenant can connect to and execute a workload via a virtual machine that is part of a virtual network that belongs to a resource provider. To secure calls and authorize access to the tenant's virtual network, authentication information provided in association with a call from the virtual network of the resource provider may need to match authorization information made available via a publication service of the cloud-based platform. Moreover, an identifier of a NIC used to make a call may need to correspond to a registered name of the resource provider for the call to be authorized. These checks provide increased security by preventing unauthorized calls from accessing the tenant's virtual network.

The techniques described herein enable a private connectivity solution between a virtual network of a service consumer and a virtual network of a service provider in a cloud-based platform. The techniques map a service (e.g., one or more workloads or containers) executing in the virtual network of the service provider into the virtual network of the service consumer. The mapping uses network address translation (NAT) that is performed by the cloud-based infrastructure. As a result of the techniques described herein, a public Internet Protocol (IP) address does not need to be used to establish a connection thereby alleviating privacy and/or security concerns for the virtual networks of the service provider and/or the service consumer that are hosted by the cloud-based platform.

Mapping a service into a virtual network using source network address translation

Growing community of inventors

Bengaluru, India

Abhishek Ellore Sreenath