Marvell International Limited

Cisco Technology, Inc.

Plumgrid, Inc.

Vmware, Inc.

Awais Bin Nemat

Guy Hutchison

Pere Monclus

Sushil Kumar Singh

Michael R Smith

Ming Zhang

Michael Fine

Alexei Starovoitov

Nafea Bishara

Rina Panigrahy

David Edward Bliss

Ben Chen

Sachin Ramesh Gandhi

Brenden Blanco

Marco Leogrande

A method for monitoring network conditions by receiving a first condition definition describing a first network condition to be monitored in a network and an activation definition, determining a network topology of the network, and compiling the first condition definition to generate a first data plane component, a first control plane component, and an activation component. The method also includes deploying the first data plane component into a data plane of the network, where the data plane component captures and synthesizes a first stream of network events to generate a first modified stream of network events. The method also includes deploying the control plane component into a network operating system for the network. The control plane component receives and correlates the first modified stream of network events. The method also includes deploying an activation component that, upon receiving the correlated stream of events, initiates the activation definition.

Method and system for monitoring conditions in a dynamic network environment

A method for network storage by receiving, by a storage compiler, a first storage definition from a storage application developer, where the first storage definition describes a customized storage implementation for storing data in an abstraction of at least one physical storage device, compiling the first storage definition to generate a first customized storage implementation module, and loading the first customized storage implementation module into an IO engine. The first customized storage implementation module causes data to be stored in the at least one physical storage device differently than prior to loading the first customized storage implementation module in the IO engine.

Method and system for data plane abstraction to enable a network storage platform ecosystem

The method includes receiving, by a data plane definition language compiler, a first data plane definition describing customized functionality of a data plane of a first network application, and compiling the data plane definition to generate a first set of customized data processing modules and a program interface that allows a control plane of the network application to access the first set of customized data processing modules. The method also includes loading the first set of customized data processing modules into a data plane container, wherein the network application is executed via a network operating system, and wherein, upon execution of the network application the customized data processing module causes the data plane container of the network application to process packets differently than prior to loading the customized data processing module in the data plane container.

Method and system for data plane abstraction to enable a dynamic creation of network applications

A media access control (MAC) security apparatus for a local area network interface includes a parser, an encryption engine, an authentication engine, and a first buffer. The parser is configured to output packets. The encryption engine is configured to receive the packets from the parser and generate encrypted data based on the packets received from the parser and cryptographic primitives. The encryption engine includes an advanced encryption standard engine configured to form the cryptographic primitives. The authentication engine is configured to perform authentication operations of the local area network interface based on the encrypted data from the encryption engine. The first buffer is configured to interface the encryption engine to the parser. The parser and the encryption engine process data at different rates. The first buffer is configured to compensate for the different rates.

MACSec implementation

A method and system for the assignment of security group information using a proxy is disclosed. The method includes receiving an address of a network device at a first network device, receiving a security group of the network device at the first network device and associating the address information and the security group information with one another at the first network device. The first network device is coupled to a second network device. The address is represented by address information, which is received from the second network device. The security group is identified using the security group information, which indicates the network device is a member of the security group. The address information and the security group information are associated with one another by storing the address information and the security group information at the first network device.

Method and system for the assignment of security group information using a proxy

A media access control (MAC) security apparatus for a local area network interface includes multiple independently controlled power domains, each of which enters and exits a reduced power state independent of others of the power domains. An encryption/decryption engine, located within a first of the power domains, generates encrypted data in response to received packets and cryptographic primitives. An authentication engine, located within a second of the power domains, performs authentication operations in response to the encrypted data. The encryption/decryption engine comprises an advanced encryption standard engine that forms the cryptographic primitives and is located within a third of the power domains. The third power domain enters the reduced power state for part of a period during which (i) the first power domain does not enter the reduced power state and (ii) the encryption/decryption engine is generating the encrypted data.

A media access control (MAC) security apparatus including an encryption/decryption engine and an authentication engine. The encryption/decryption engine is configured to generate encrypted data based on received packets. The authentication engine is configured to perform authentication in response to the encrypted data. The encryption/decryption engine includes an advanced encryption standard (AES) engine configured to form cryptographic primitives. The AES engine is configured to enter a reduced power consumption state for part of a period during which the encryption/decryption engine is generating encrypted data based on the received packets.

A method allowing for flexible modification of a data packet in a data network is presented. A data packet is parsed based on one or more attributes and sent to a buffer memory and a user modifiable lookup table. Using extracted packet data, information required to modify the data packet as desired is located in the lookup table and forwarded to a packet modification engine. Within the packet modification engine, a novel rewrite constructor module generates unique packet rewrite information based on the information forwarded from the lookup table and one or more additional inputs. This unique packet rewrite information is forwarded to a packet rewrite engine, wherein the packet rewrite engine modifies the data packet accordingly.

Method for flexible modifications to a packet

A method and apparatus for performing MAC security (MACSec) operations. In one embodiment, the apparatus comprises a plurality of discrete elements coupled together to perform MAC security processing, the plurality of discrete elements able to operate on distinct packets related to MAC security simultaneously, and wherein each of the plurality of discrete elements is in an independently controlled power domain that enters a reduced power consumption state independently of other discrete elements in the plurality of discrete elements when not in use.

The present disclosure includes systems and techniques relating to virtual Ethernet switches. In some implementations, a system includes two or more Ethernet switches. Two or more components are included in the system to open at least one tunnel, over a network, between the two or more Ethernet switches to connect the two or more Ethernet switches together. In addition, two or more components are included in the system to operate a protocol over the opened at least one tunnel to manage the two or more Ethernet switches as a single unit that shares at least one network feature among all of the two or more Ethernet switches.

Virtual ethernet stack

Methods and systems for implementing a switch box (S-box) in a cryptographic application are described. An input to the S-box is converted from a Galois field representation GF(N) to a Galois subfield representation GF(N). The input is converted using a generating polynomial of the form x+Ax+B, where A and B are elements in GF(N) and where A has a value other than unity. The multiplicative inverse of the Galois subfield representation GF(N)is determined. The multiplicative inverse is converted back to the Galois field representation GF(N). An affine transformation of the multiplicative inverse is then performed.

Implementation of a switch-box using a subfield method

A present invention Galois field multiplier system and method utilize lookup tables to generate one partial product term and one feedback term in one clock cycle. In one embodiment, a Galois field multiplier system includes a plurality of shift registers, a plurality of exclusive OR components, a partial product lookup table, and a feedback table lookup table. The plurality of shift registers perform shift multiplication operation and are coupled to the plurality of shift registers that perform addition operations. The partial product lookup table and feedback lookup tables are selectively coupled to the exclusive OR components and values from the partial product lookup table and feedback lookup tables are fed into the selectively coupled exclusive OR components. Coefficients of the partial product term and feedback term are utilized as indexes to the partial product lookup table and feedback lookup table respectively.

Galois field multiplication system and method

A quaternary content-addressable memory includes multiple entries configured to match a lookup word, with each of these entries including multiple cells and with the lookup word including multiple lookup bits for matching corresponding cells of each of the entries. Each of the cells is individually configurable to be in one of multiple states identified by two bits, with these states including a first matching state for matching a value of a corresponding bit of the lookup word with the value having a first matching value, a second matching state for matching the value of the corresponding bit having a second matching value, a wildcard state for matching the value of the corresponding bit having either the first or the second matching value, and an ignore state for indicating to ignore the cell in determining whether or not the entry to which the cell belongs matches the lookup word.

Growing community of inventors

Santa Clara, CA, United States of America

Awais Bin Nemat