Microsoft Technology Licensing, LLC

Avnish Kumar Chhabra

Abhishek Kumar Singh

Huaming Huang

Muhammad Usman Sharif

James T Pinkerton

Sanjay N Kaniyar

Yue Zhao

Brian D Swander

Paul G Mayfield

Aditya Dube

Mark Eugene Russinovich

Marcus Felipe Fontoura

Yunus Mohammed

Michael Charles Stephenson

Pritesh Patwa

Li Xiong

Cristina Del Amo Casado

Binit Ranjan Mishra

Ziv Rafalovich

Li-Fen Wu

Siddharth Verma

Bhuvan Malladihalli Shashidhara

Pallavi Baral

Hanyi Xu

Mayank Meghwanshi

Juan-Arturo Herrera Ortiz

Sisi Xiong

Harsh Gupta

Abhishek Kumar

Prateek Punj

Yilan Zhang

Arbab Amjad

Ash Beitz

Hariharan Jayaraman

Yevgeniy Olegovich Razuvayev

Reza Sherafat Kazemzadeh

Abhishek Singh

The present concepts may automate and optimize deployment to a cloud computing fleet. Artificial intelligence and/or optimization algorithms may be used to find optimal deployment parameters (e.g., deployment order of computers in the fleet) that minimize deployment time and minimize deployment risk. For example, machine-learning prediction models may be used to generate a shortest path graph problem models a deployment planning problem. Then, optimization algorithms may be used to efficiently find approximations of Pareto-optimal solutions to the shortest path graph problem. Depending on the preferred level of time and risk, one of the solutions may be used to run the deployment.

Smart deployment using graph optimization

Systems, methods and computer program products are described herein that can be used to help achieve a safe rollout of software in a production datacenter environment. In accordance with certain embodiments, cloud services requests from certain users of a cloud services system (e.g., users that are authorized to receive cloud services via computing devices running test versions of infrastructure software) are dynamically matched to clusters (groups of commonly-managed computing devices called nodes) that are capable of providing the requested services on nodes running test versions of infrastructure software. Within such clusters, the requested services are provided to the users on a subset of cluster nodes that run a test version of an infrastructure software component, while the remaining cluster nodes are not running the particular test version.

Partitioning and orchestrating infrastructure software deployments for safety and agility across diverse configurations and hardware types

Methods, systems, apparatuses, and computer program products are provided that enable the automated deployment of microservices to a network-accessible server set. The automated deployment may be based on constraint(s) that are specified by a declarative deployment model that is associated with the microservice to be deployed. For example, a centralized deployment orchestrator may receive microservice(s) and their associated declarative deployment model(s). The deployment orchestrator analyzes the declarative deployment model(s) and determines which microservice(s) are to be deployed based on the constraint(s) specified by the declarative deployment model(s). The foregoing techniques advantageously determine when to deploy microservice(s), while also minimizing human intervention typically required to deploy microservice(s). Moreover, by controlling when certain microservice(s) are deployed and/or which microservice(s) are deployed, deployed microservice(s) that function incorrectly and/or cause at least a portion of the network-accessible computing environment to malfunction can be easily identified.

Automated constraint-based deployment of microservices to cloud-based server sets

Software updates within one or more regions of a multi-tenant cloud are coordinated. Tenant vs. tenant conflicts, tenant vs. infrastructure provider conflicts, and conflicts between security and another priority are identified and resolved using a shared update coordinator, update priority specifications, and availability specifications. An infrastructure update request may be presented to tenants for approval. Postponed infrastructure updates may be prioritized higher. Preventing exploits of zero-day vulnerabilities may be prioritized over meeting availability targets. Updates may be merged to reduce downtime, even when the updates originate from independently controlled entities. Maximum downtime, minimum fault domains, minimum virtual machines, permitted update start times, and other availability criteria may be specified. Updates may be preempted, or allowed to complete, based on their relative priorities. Tenants and infrastructure providers may still use their own deployment engines after updates are coordinated. Rogue behaviors involving adverse update approvals or disapprovals may be detected.

Update coordination in a multi-tenant cloud computing environment

Methods, systems, and apparatuses manage rolling out of updates in a network-accessible server infrastructure which operates a plurality of instances of a supporting service. The supporting service is comprised by a plurality of service portions. The instances of the supporting service each include of the service portions. The instances of the supporting service are partitioned into a plurality of slices. Each instance is partitioned to include one or more of the slices, and each slice of an instance includes one or more of the service portions. A software update is deployed to the instances by applying the software update to the slices in a sequence such that the software update is applied to a same slice in parallel across the instances containing that same slice before being applied to a next slice, and waiting a wait time before applying the software domain to a next slice in the sequencing.

Safe and agile rollouts in a network-accessible server infrastructure using slices

In one embodiment, to determine what tasks may be offloaded to a peripheral hardware device (e.g., to be performed in hardware on the peripheral device, rather than on the CPU(s) of the host computer), an indication from the at least one peripheral hardware device may be provided, without the peripheral hardware device first being queried to determine the task offload capabilities provided by the peripheral hardware device. In one embodiment, a large packet that includes a plurality of extension headers may be offloaded to the peripheral hardware device for segmentation. An indication of the offset where the extension headers end may be provided in connection with the large packet. In another embodiment, a packet with extension headers that come before an encryption header in the packet are not offloaded to peripheral hardware device for encryption, while packets with no extension headers before the encryption header may be offloaded.

Task offload to a peripheral device

A method and system are provided for adding, removing, and managing a plurality of network policy filters in a network device. Filters are installed in a framework and designated as active or disabled. Each filter has a priority. When a new filter is to be installed into the framework, it is compared to installed filters to determine if a conflict exists. If no conflict exists, the new filter is added as an active filter. If a conflict exists, a higher priority conflicting filter is added as active and a lower priority filter is added as inactive.

Method for managing network filter based policies

The invention provides mechanisms for transferring processor control of secure Internet Protocol (IPSec) security association (SA) functions between a host and a target processing devices of a computerized system, such as processors in a host CPU and a NIC. In one aspect of the invention, the computation associated with authentication and/or encryption is offloaded while the host maintains control of when SA functions are offloaded, uploaded, invalidated, and re-keyed. The devices coordinate to maintain metrics for the SA, including support for both soft and hard limits on SA expiration. Timer requirements are minimized for the target. The offloaded SA function may be embedded in other offloaded state objects of intermediate software layers of a network stack.

Method and apparatus for secure internet protocol (IPSEC) offloading with integrated host protocol stack management

Growing community of inventors

Redmond, WA, United States of America

Avnish Kumar Chhabra