Vmware, Inc.

Avishay Yanai

Igor Golikov

Alex Markuze

Israel Cidon

Eyal Zohar

Aran Bergman

Lior Gal

Yaniv Ben-Itzhak

Shay Vargaftik

Ittai Abraham

Guy Golan Gueta

Some embodiments of the invention provide a method for WAN (wide area network) optimization for a WAN that connects multiple sites, each of which has at least one router. At a gateway router deployed to a public cloud, the method receives from at least two routers at least two sites, multiple data streams destined for a particular centralized datacenter. The method performs a WAN optimization operation to aggregate the multiple streams into one outbound stream that is WAN optimized for forwarding to the particular centralized datacenter. The method then forwards the WAN-optimized data stream to the particular centralized datacenter.

WAN optimization in the public cloud

Some embodiments provide a method for transmitting data at a network interface controller (NIC) of a computer that operates as a server. The computer includes multiple storage devices. The method receives a request from a client device for a particular file. The method translates the particular file into a memory location corresponding to a particular one of the storage devices at the computer. The method transmits the requested file from the particular storage location to the client device.

Smart NIC responding to requests from client device

Some embodiments provide a method for performing data message processing at a smart NIC of a computer that executes a software forwarding element (SFE). The method determines whether a received data message matches an entry in a data message classification cache stored on the smart NIC based on data message classification results of the SFE. When the data message matches an entry, the method determines whether the matched entry is valid by comparing a timestamp of the entry to a set of rules stored on the smart NIC. When the matched entry is valid, the method processes the data message according to the matched entry without providing the data message to the SFE executing on the computer.

Accelerating data message classification with smart NICs

Some embodiments provide a method for sending data messages at a network interface controller (NIC) of a computer. From a network stack executing on the computer, the method receives (i) a header for a data message to send and (ii) a logical memory address of a payload for the data message. The method translates the logical memory address into a memory address for accessing a particular one of multiple devices connected to the computer. The method reads payload data from the memory address of the particular device. The method sends the data message with the header received from the network stack and the payload data read from the particular device.

Logical memory addressing by smart NIC across multiple devices

WAN optimization for encrypted data traffic using fully homomorphic encryption

Wan optimization for encrypted data traffic using fully homomorphic encryption

Some embodiments provide a method for, at a network interface controller (NIC) of a computer, accessing data in a network. From the computer, the method receives a request to access data stored at a logical memory address. The method translates the logical memory address into a memory address of a particular network device storing the requested data. The method sends a data message to the particular network device to retrieve the requested data.

Logical memory addressing for network devices

Some embodiments of the invention provide a WAN optimization method for optimizing traffic flows through a WAN connecting multiple sites each having at least one router. The method is performed in a kernel space of a first router at a first site. From a second router at a second site, the method receives, in an optimized data stream originating from a source device at the second site and destined to a destination device at the first site, a file including compressed segments not yet stored in a database of the first router. The method copies the compressed segments to a shared memory used with a decompression program operating in the first router's user space. For each compressed segment, the method receives, from the decompression program, a decompressed segment obtained by decompressing the compressed segment, and stores the decompressed segment in a kernel space memory for use in processing the file.

Advanced storage operations for wan optimization

Some embodiments of the invention provide a WAN optimization method for optimizing traffic flows through a WAN. The method is performed in a kernel space of a first router at a first site. From a second router at a second site, the method receives, in an optimized data stream from a second site source device to a first site destination device, a file including compressed segments not yet stored by the first router, and copies the compressed segments to a memory shared with a decompression program in the first router's user space. For each compressed segment, the method receives a notification that a decompressed segment obtained by decompressing the compressed segment has been written to a disk storage of the first router, the notification including a block address for the decompressed segment, and updates a cache of the first router with an entry mapping the decompressed segment to the block address.

Advanced storage operations for WAN optimization

WAN optimization using probabilistic data filters

In one set of embodiments, each server executing a secure multi-party computation (MPC) protocol can receive shares of inputs to the MPC protocol from a plurality of clients, where each input is private to each client and where each share is generated from its corresponding input using a threshold secret sharing scheme. Each server can then verify whether the shares of the plurality of inputs are valid/invalid and, for each invalid share, determine whether a client that submitted the invalid share or a server that holds the invalid share is corrupted. If the client that submitted the invalid share is corrupted, each server can ignore the input of that corrupted client during a computation phase of the MPC protocol. Alternatively, if the server that holds the invalid share is corrupted, each server can prevent that corrupted server from participating in the computation phase.

Robust input verification for secure multi-party computation (MPC) with clients

Some embodiments provide a method for performing data message processing at a smart NIC of a computer that executes a software forwarding element (SFE). The method stores (i) a set of cache entries that the smart NIC uses to process a set of received data messages without providing the data messages to the SFE and (ii) rule updates used by the smart NIC to validate the cache entries. After a period of time, the method determines that the rule updates are incorporated into a data message processing structure of the SFE. Upon incorporating the rule updates, the method deletes from the smart NIC (i) the rule updates and (ii) at least a subset of the cache entries.

Growing community of inventors

Petach-Tikva, Israel

Avishay Yanai