Microsoft Technology Licensing, LLC

Other

Abhishek Tiwari

Raunak Pandya

Rama Krishna Amaravadi

Gerardo Diaz-Cuellar

Harish Kumar Chandrappa

Ganesh Srinivasan

Ashok Kumar Nandoori

Karthik Ananthakrishnan

Qiming Chen

Nikhil K Ravi

Chakshu Sardana

Neelesh Kumar

Viswanath Chennuru

Dhiraj K Gupta

Michelle Austine Liu

Ashish Saxena

Swati Tiwari

Varun Prakash Shrivastava

Abhishek Gupta

Benjamin M Schultz

Mohit Kumar Garg

Alok Jain

Shivakumar Thangapandi

Aman Arneja

Dhiraj Gupta

A method for providing a managed networking service for a cloud computing system enables users to consume managed virtualized network functions (VNFs) at edge locations. The method includes registering a plurality of third-party vendors for the managed networking service. The plurality of third-party vendors provide a plurality of VNFs for the managed networking service. The method also includes receiving user input from a user of the cloud computing system. The user input includes a request to deploy the plurality of VNFs at an edge location. The plurality of VNFs can be provided by different third-party vendors through the managed networking service. The method also includes causing the plurality of VNFs to be deployed on an edge device that is located at the edge location. The plurality of VNFs can be represented as logical entities in a database that is utilized by the managed networking service.

Cloud-based managed networking service that enables users to consume managed virtualized network functions at edge locations

Techniques for dynamically scaling instances of virtual private network (VPN) gateway in a cloud computing system are disclosed herein. In one embodiment, a method includes determining whether a number of packets processed by a first instance of the VPN gateway exceeds a preset threshold. In response to determining that the number of packets exceeds the preset threshold, a new security association (SA) corresponding to a portion of the VPN network traffic is created. Upon completion of creating the SA, a load balancing policy at a load balancer is modified to forward a portion of the network traffic to a second instance of the VPN gateway when an incoming packet contains a security parameter index (SPI) corresponding to the created SA in its EPS header.

Dynamic scaling of virtual private network connections

To reduce network connectivity downtime while connections are established or re-established after maintenance, a connection request that would be rejected is instead accepted, even though a corresponding outgoing request is still pending. In some cases, the connection request is a secure connection request, such as an INIT phase request or an AUTH phase request during an Internet Key Exchange protocol exchange. Single-ended and double-ended configurations are both presented. When colliding INIT attempts succeed, two results are produced, after which one may be selected and the other discarded. Alternately, both INIT results may be used in producing two security associations during a subsequent AUTH phase. Incoming traffic and outgoing traffic may then use respective security associations.

Collision prevention in secure connection establishment

A control and monitoring system orders a service chain&#x2014;an order of data flow through a plurality of network nodes&#x2014;based on network node identifiers. The control and monitoring system provide a policy to networking nodes in order to enforce the order of the service chain. In some embodiments, features are implemented to improve the availability of service chains. Such features include load-balancing, fail-over, traffic engineering, and automated deployment of virtualized network functions at various stages of a service chain, among others.

Highly available service chains for network services

In a computing device a domain name system (DNS) query is generated and sent, and a check is made as to whether a verified DNS response to the DNS query is received. The computing device is determined to be inside a particular network if a verified DNS response is received, and is determined to be outside that particular network if a verified DNS response is not received. A DNS response can be determined to be verified if both the DNS response has an expected value and the DNS response is digitally signed by a trusted authority, and otherwise can be determined to be not verified.

DNS-based determining whether a device is inside a network

Techniques to provide an improved representation of remote network access for a network administrator managing and controlling access to resources on an enterprise network. The representation indicates resources accessed by a remote computer or by a user of that computer and provides associated information useful for managing remote network access. To create the representation, multiple security associations formed between a remote client computer and resources on the enterprise network are associated with entity sessions, based on identical session identifiers generated for each security association within an entity session. The entity sessions may be aggregated into a DirectAccess 'connection' between the remote client computer and the enterprise network, based on an identity of the remote client computer. Resources accessed over the connection may be identified using a session identifier of each entity session so that security associations in that entity session may be matched with the resources.

Monitoring remote access to an enterprise network

A network address of a computing device is obtained, and an unencrypted request is sent to a resource access manager of a particular network. If both a response is received from the resource access manager and the computing device has a network address within a desired range of network addresses, then a determination is made that the computing device is inside the particular network. Otherwise, a determination is made that the computing device is outside the particular network.

Determining whether a device is inside a network

Techniques to provide an improved representation of remote network access for a network administrator managing and controlling access to resources on an enterprise network. The representation indicates resources accessed by a remote computer or by a user of that computer and provides associated information useful for managing remote network access. To create the representation, multiple security associations formed between a remote client computer and resources on the enterprise network are associated with entity sessions, based on identical session identifiers generated for each security association within an entity session. The entity sessions may be aggregated into a to DirectAccess 'connection' between the remote client computer and the enterprise network, based on an identity of the remote client computer. Resources accessed over the connection may be identified using a session identifier of each entity session so that security associations in that entity session may be matched with the resources.

Growing community of inventors

Hyderabad Telangana, India

Abhishek Tiwari