Microsoft Technology Licensing, LLC

Avijit Gupta

Rishabh Tewari

Deepak Bansal

Nisheeth Srivastava

Pranjal Shrivastava

Abhishek Shukla

James Wesley Boerner

Sushant Sharma

Sumit Sharad Dhoble

Parag Sharma

Jayesh Kumaran

Abhishek Ellore Sreenath

Vinayak Uppunda Padiyar

Rangaprasad Narasimhan

Vaibhav Kumar

Neeraj Motwani

Abhijeet Kumar

Aanand Ramachandran

David Michael Brumley

Manasi Deval

Zexuan Zhao

Weixi Chen

Arun Jeedigunta Venkata Satya

Geoffrey Hugh Outhred

Lihua Yuan

Xinyan Zan

Harish Kumar Chandrappa

Michal Czeslaw Zygmunt

Jun Tse Chen

Madhan Sivakumar

Naveen Prabhat

Gabriel Silva

Deven Jagasia

Guohan Lu

Ganesh Srinivasan

Fengfen Liu

Hang Kwong Lee

Karthik Ananthakrishnan

Neha Aggarwal

Anish Sagar Narsian

Gerald Roy De Grace

Kaixiang Miao

Maitrey Kumar

Wei Xia

Sonia Sharma

Sirshak Das

Sahil Aggarwal

Venkata Satish Katta

Alfonso De La Morena

Bhushan Vinayak Bhise

Devan Harikumar

Chandrasekar Srinivasan

Bidirectional flows of a communication session in a software defined network (SDN) are efficiently managed. A smart switch comprises a digital processing unit (DPU) complex comprising one or more DPUs, and a switching complex comprising one or more network processing units (NPUs). The DPU complex is configured to disaggregate enforcement of policies of the SDN from hosts of the SDN. The switching complex is configured to perform network routing of packets in the SDN. The hosts are implemented on servers communicatively coupled to network interfaces of the SDN. The switching complex is configured to perform policy enforcement of data flows for communication sessions that are offloaded from the DPU complex to the switching complex.

Smart switch for offloading high bandwidth flows in a software defined network

High availability network services are provided in a in a virtual computing environment comprising a plurality of network devices running in a software defined network (SDN) of the virtual computing environment, the network devices comprising a plurality of SDN appliances configured to disaggregate enforcement of policies of the SDN from hosts of the virtual computing environment, the hosts implemented on servers communicatively coupled to network interfaces of the SDN appliances, the servers hosting a plurality of virtual machines, the SDN appliance comprising a plurality of smart network interface cards (fNICs) configured to implement functionality of the SDN appliances.

Zero downtime servicing of datapath services in software defined networks

Systems and methods for enabling access to dedicated resources in a virtual network using top of rack switches are disclosed. A method includes a virtual filtering platform encapsulating at least one packet, received from a virtual machine, to generate at least one encapsulated packet comprising a virtual network identifier (VNI). The method further includes a TOR switch: (1) receiving the at least one encapsulated packet and decapsulating the at least one encapsulated packet to create at least one decapsulated packet, (2) using the VNI to identify a virtual routing and forwarding artifact to determine a virtual local area network interface associated with the dedicated hardware portion, and (3) transmitting the at least one decapsulated packet to the dedicated hardware portion based on at least one policy provided by a controller, where the at least one policy comprises information related to a customer of the service provider.

Enabling access to dedicated resources in a virtual network using top of rack switches

The disclosed system implements techniques to secure communications for injecting a workload (e.g., a container) into a virtual network hosted by a cloud-based platform. Based on a delegation instruction received from a tenant, a virtual network of the tenant can connect to and execute a workload via a virtual machine that is part of a virtual network that belongs to a resource provider. To secure calls and authorize access to the tenant's virtual network, authentication information provided with a call from the virtual network of the resource provider may need to match authorization information made available via a publication service of the cloud-based platform. Additionally or alternatively, an identifier of a NIC used to make a call may need to correspond to a registered name of the resource provider for the call to be authorized. These checks provide increased security by preventing unauthorized calls to the tenant's virtual network.

Securing an injection of a workload into a virtual network hosted by a cloud-based platform

The disclosed system implements techniques to enable a tenant of a cloud-based platform to effectively and efficiently apply a policy that copies data packets communicated to or from a virtual machine in the tenant's own virtual network. When applied, the policy mirrors data traffic associated with a workload executing on a virtual machine in the tenant's virtual network. To mirror the data traffic, a copy of a data packet is streamed to another virtual machine so that network analytics can be performed (e.g., performance analytics, security analytics, etc.). In various examples, the policy can be a role-based mirroring policy that defines a plurality of roles in association with a role-based access model that scales operations and that provides improved security for a tenant's virtual network.

Mirroring virtual network traffic

A virtual network comprising virtual machines executing at a computing environment is implemented. A flexibly extensible NIC (eNIC) is executed at a software defined networking (SDN) appliance. A data packet is received that is addressed to a host that is connected to the virtual network. Based on a layer 2 address and a network identifier, the virtual switch identifies the host represented by the eNIC that is associated with the data packet. A policy associated with the host is determined and applied to the data packet. The policy is dynamically adjustable based on the host.

Injecting network endpoints into a SDN

A virtual network comprising virtual machines executing at a computing environment is implemented. A software defined networking (SDN) appliance is configured to provide a connection to computing resources via a virtual network of a virtual computing environment. The SDN appliance is configured to apply policies of the virtual computing environment to data traffic on the virtual network. The SDN appliance is operable to interact with multiple network devices that are configured to act as a hardware acceleration device for processing data traffic. Virtual addresses are assigned to the network devices. The SDN appliance executes a virtual switch configured to identify data traffic sent to or received from a host and act as a proxy for the network devices and respond on their behalf.

Software defined networking operations for programmable connected devices

The disclosed system implements techniques to secure communications for injecting a workload (e.g., a container) into a virtual network hosted by a cloud-based platform. Based on a delegation instruction received from a tenant, a virtual network of the tenant can connect to and execute a workload via a virtual machine that is part of a virtual network that belongs to a resource provider. To secure calls and authorize access to the tenant's virtual network, authentication information provided in association with a call from the virtual network of the resource provider may need to match authorization information made available via a publication service of the cloud-based platform. Moreover, an identifier of a NIC used to make a call may need to correspond to a registered name of the resource provider for the call to be authorized. These checks provide increased security by preventing unauthorized calls from accessing the tenant's virtual network.

Growing community of inventors

Redmond, WA, United States of America

Avijit Gupta