Microsoft Technology Licensing, LLC

Abhishek Shukla

Rishabh Tewari

Nisheeth Srivastava

Xinyan Zan

Parag Sharma

Abhishek Ellore Sreenath

Ashish Bhargava

Jayesh Kumaran

Naveen Prabhat

Deepak Bansal

Avijit Gupta

Sushant Pramod Rewaskar

Md Daud Hossain Howlader

Pranjal Shrivastava

Vinayak Uppunda Padiyar

Rangaprasad Narasimhan

James Wesley Boerner

Neeraj Motwani

Vaibhav Kumar

Neha Aggarwal

Sushant Sharma

Aanand Ramachandran

Abhijeet Kumar

Vishal Taneja

David Michael Brumley

Sumeet Mittal

Kaihua Xu

Anatoliy Panasyuk

Dharshan Rangegowda

Harish Kumar Chandrappa

Madhan Sivakumar

Wing Kwong Wan

Anitha Adusumilli

Qiming Chen

Ajinkya Potdar

Sandesh Kerehali Shankaranarayan Shety

Jie Wang

Daud Hossain Howlader

Methods, systems, and computer storage media for providing a sensitive data scanning in a sensitive data leak-detection engine of a security management system. Sensitive data scanning—for example confidential information scanning or credential scanning—provides sensitive data leak-detection via a software development environment during a software development process. In operation, a request—to execute a sensitive data scanning operation on an instance of in-development code—is accessed. The sensitive data scanning operation executable via a sensitive data leak-detection engine that provides code security management services in a software development environment. A code scanning package is accessed. The code scanning package comprises software development environment code scanning parameters. Based on the software development environment code scanning parameters, the in-development code is scanned for sensitive data. A notification comprising a sensitive data scan result associated with the in-development code is generated. The notification is communicated to cause the notification to be displayed.

Sensitive data leak-detection engine in a security management system

A hybrid state for a virtual machine (VM) in a cloud computing system enables a VM to communicate with other VMs that belong to a virtual network (VNET VMs) while maintaining connectivity with other VMs that do not belong to the virtual network (non-VNET VMs). A non-VNET VM can be transitioned to a hybrid VM that operates in a hybrid state. The hybrid VM can be assigned a private virtual IP address (VNET address) for communication with other VNET VMs. The hybrid VM can continue to use a physical IP address to communicate with other non-VNET VMs. In this way, the hybrid VM is able to maintain connectivity with other non-VNET VMs during and after migration to the VNET. A network stack can be configured to process data packets that are destined for non-VNET VMs differently from data packets that are destined for VNET VMs.

Support of virtual network and non-virtual network connectivity on the same virtual machine

The disclosed technology is generally directed to virtual machines. In one example of the technology, a network change from a first virtual network to a second virtual network is reconfigured for a first virtual machine that is executing on a first virtual machine host. The reconfiguring includes the following. In the first virtual machine host, a mapping change from the first virtual network to the second virtual network is configured by reprogramming drivers in the first virtual machine host for route mapping for the second virtual network. A Dynamic Host Configuration Protocol (DHCP) retrigger is caused without rebooting the first virtual machine. A configuration file is provided to the first virtual machine. The configuration file includes user-specific networking settings. The first virtual machine is reconfigured in accordance with the user-specific networking settings.

Virtual machine client-side virtual network change

Systems and methods for enabling access to dedicated resources in a virtual network using top of rack switches are disclosed. A method includes a virtual filtering platform encapsulating at least one packet, received from a virtual machine, to generate at least one encapsulated packet comprising a virtual network identifier (VNI). The method further includes a TOR switch: (1) receiving the at least one encapsulated packet and decapsulating the at least one encapsulated packet to create at least one decapsulated packet, (2) using the VNI to identify a virtual routing and forwarding artifact to determine a virtual local area network interface associated with the dedicated hardware portion, and (3) transmitting the at least one decapsulated packet to the dedicated hardware portion based on at least one policy provided by a controller, where the at least one policy comprises information related to a customer of the service provider.

Enabling access to dedicated resources in a virtual network using top of rack switches

A virtual network interface controller (NIC) associated with a virtual machine in a cloud computing network is configured to support one or more network containers that encapsulate networking configuration data and policies that are applicable to a specific discrete computing workload to thereby enable the virtual machine to simultaneously belong to multiple virtual networks using the single NIC. The network containers supported by the NIC can be associated with a single tenant to enable additional flexibility such quickly switching between virtual networks and support pre-provisioning of additional computing resources with associated networking policies for rapid deployment. The network containers can also be respectively associated with different tenants so that the single NIC can support multi-tenant services on the same virtual machine.

Multi-tenant support on virtual machines in cloud computing networks

The disclosed system implements techniques to secure communications for injecting a workload (e.g., a container) into a virtual network hosted by a cloud-based platform. Based on a delegation instruction received from a tenant, a virtual network of the tenant can connect to and execute a workload via a virtual machine that is part of a virtual network that belongs to a resource provider. To secure calls and authorize access to the tenant's virtual network, authentication information provided with a call from the virtual network of the resource provider may need to match authorization information made available via a publication service of the cloud-based platform. Additionally or alternatively, an identifier of a NIC used to make a call may need to correspond to a registered name of the resource provider for the call to be authorized. These checks provide increased security by preventing unauthorized calls to the tenant's virtual network.

Securing an injection of a workload into a virtual network hosted by a cloud-based platform

A method for facilitating communication between resources in different virtual networks includes creating a first virtual network and a second virtual network within a cloud computing system and creating a first subnet within the first virtual network and a second subnet within the second virtual network. The method also includes mapping the first subnet to the second subnet such that the resources in the first subnet and the second subnet are able to communicate with each other using private address space. The method also includes routing data packets between the first subnet and the second subnet.

Mapping subnets in different virtual networks using private address space

A method to provide network connectivity to a virtual machine hosted on a server computer system includes detecting a change in a configuration of a software-defined network to which the server computer system provides access; issuing a network configuration update (NCU) for consumption by the virtual machine, the NCU including a data structure reflecting the change in the configuration; and providing a link-state notification (LSN) to a virtual network interface card of the virtual machine pursuant to the change in the configuration, the LSN including data indicating a state of network connectivity of the virtual machine. Receipt of the LSN triggers a dynamic host-configuration protocol (DHCP) handshake by the virtual machine; the NCU is received by the virtual machine pursuant to the DHCP handshake.

Network configuration updates for virtual machine

The disclosed system implements techniques to secure communications for injecting a workload (e.g., a container) into a virtual network hosted by a cloud-based platform. Based on a delegation instruction received from a tenant, a virtual network of the tenant can connect to and execute a workload via a virtual machine that is part of a virtual network that belongs to a resource provider. To secure calls and authorize access to the tenant's virtual network, authentication information provided in association with a call from the virtual network of the resource provider may need to match authorization information made available via a publication service of the cloud-based platform. Moreover, an identifier of a NIC used to make a call may need to correspond to a registered name of the resource provider for the call to be authorized. These checks provide increased security by preventing unauthorized calls from accessing the tenant's virtual network.

The techniques described herein enable a private connectivity solution between a virtual network of a service consumer and a virtual network of a service provider in a cloud-based platform. The techniques map a service (e.g., one or more workloads or containers) executing in the virtual network of the service provider into the virtual network of the service consumer. The mapping uses network address translation (NAT) that is performed by the cloud-based infrastructure. As a result of the techniques described herein, a public Internet Protocol (IP) address does not need to be used to establish a connection thereby alleviating privacy and/or security concerns for the virtual networks of the service provider and/or the service consumer that are hosted by the cloud-based platform.

Mapping a service into a virtual network using source network address translation

The disclosed technology is generally directed to virtual machines. In one example of the technology, a network change from a first virtual network having a first customer Internet Protocol (IP) address to a second virtual network having a second customer IP address is configured for a first virtual machine. The configuring includes controlling the following actions. The second virtual network is provided. At least one networking artifact is associated with a first user that is associated with the first virtual machine. The at least one networking artifact includes the second virtual network. A directory service is updated to map the second customer IP address to a first physical IP address. The first physical IP address is a physical IP address of the first virtual network.

Virtual machine server-side network adaptation

Growing community of inventors

Redmond, WA, United States of America

Abhishek Shukla