Oracle International Corporation

Amazon Technologies, Inc.

Oracle International Corportion

Brijesh Singh

Eden Grail Adogla

Iliya Roitburg

Matthew Rushton

Leonard Thomas Tracy

David Dale Becker

Maxim Baturin

Abhishek Kar

Techniques are disclosed for a smart network interface card (smartNIC) performing a unified logging process. In one example, an accelerator transmits a packet to a programming data plane of the smart network interface card. The programming data plane determines whether the packet is to be forwarded. In accordance with a determination that the packet is not be forwarded, the programming data plane modifies the packet to include an instruction that instructs the accelerator to log the packet and to not forward the packet. The programming data plane transmits the modified packet to the accelerator. The accelerator logs data associated with the modified packet to a unified log based at least in part on the instruction.

Efficient flow management utilizing unified logging

Techniques are disclosed for migrating one or more services from an edge device to a cloud computing environment. In one example, a migration service receives a request to migrate a first set of services from the edge device to the cloud computing environment. The migration service identifies a hardware profile of a computing device (or devices) of the cloud computing environment that matches the edge device, and then configures the computing device to execute a second set of services that corresponds to the first set of services. The migration service establishes a communication channel between the edge device and the computing device, and then executes a set of migration operations such that the second set of services is configured to execute as the first set of services. The computing device may operate in a virtual bootstrap environment or dedicated region of the cloud computing environment.

Migrating edge device resources to a cloud computing environment

Techniques are disclosed for deploying a computing resource (e.g., a service) in response to user input. A computer-implemented method can include operations of receiving (e.g., by a gateway computer of a cloud-computing environment) a request comprising an identifier for a computing component of the cloud-computing environment. The computing device receiving the request may determine whether the identifier exists in a routing table that is accessible to the computing device. If so, the request may be forwarded to the computing component. If not, the device may transmit an error code (e.g., to the user device that initiated the request) indicating the computing component is unavailable and a bootstrap request to a deployment orchestrator that is configured to deploy the requested computing component. Once deployed, the computing component may be added to a routing table such that subsequent requests can be properly routed to and processed by the computing component.

Techniques for providing cloud services on demand

Techniques are disclosed for deploying a computing resource (e.g., a service) in response to user input. A computer-implemented method can include operations of identifying a first set of computing components already deployed within the cloud-computing environment and identifying a second set of computing components available for deployment within the cloud-computing environment. A request for deployment may be subsequently received for one of the available computing components. A bootstrap request corresponding to the particular computing component requested may be transmitted to a deployment orchestrator, the deployment orchestrator being configured to deploy the particular computing component to the cloud-computing environment based at least in part on the bootstrap request. A user interface may present status indicators for each computing component (e.g., deployed, available, requested, etc.).

Techniques are disclosed for a smart network interface card (smartNIC) performing a unified logging process. In one example, an accelerator of the smartNIC receives a packet that is a candidate for rejection, whereby the accelerator is configured to log traffic for authorized flows that are forwarded by the accelerator to another device. The accelerator transmits the packet to a programming data plane of the smartNIC for further processing. The programming data plane determines that the packet should not be forwarded by the smartNIC, and modifies the packet to include an instruction that instructs the accelerator to log the packet. The programming data plane then transmits the modified packet to the accelerator. Upon receiving the modified packet, the accelerator logs the packet to the unified log based on the instruction.

Techniques are disclosed for processing flows by a smart network interface card (smartNIC) based on modifying a packet. In one example, a smartNIC accelerator receives a packet from a first port of the smartNIC, the first port being connected to a splitter device that splits a first data path into a second data path and a third data path, and the packet arriving at the first port via the second data path. The accelerator modifies the packet to indicate that the packet arrived at the first port via the second data path. The accelerator inserts the modified packet into a queue that is associated with both the second data path and the third data path. A programming data plane of the smartNIC receives and then processes the modified packet based on determining that the packet arrived at the first port via the second data path.

Port addressing via packet header modification

Techniques are disclosed for utilizing control packets to manage flows by a smart network interface card (smartNIC). In one example, an accelerator determines that a cache entry is a candidate for removal, the cache entry being part of a cache that is managed by the accelerator, the cache entry storing flow state of a particular flow, the accelerator being responsible for forwarding packets associated with the particular flow based at least in part on the flow state, and the flow information formatted utilizing a particular header format. The accelerator generates an instruction to remove the cache entry of the particular flow from the cache based at least in part on receiving the determination that the cache entry is the candidate for removal. The accelerator removes the cache entry of the particular flow from the cache based at least in part on the instruction.

Efficient flow management utilizing control packets

Techniques are disclosed for utilizing control packets to manage flows by a smart network interface card (smartNIC). In one example, an accelerator of the smartNIC determines that a cache entry of a cache that is managed by the accelerator is a candidate for removal. The cache entry stores flow state of a particular flow. The accelerator generates a control packet that includes flow information of the particular flow that is formatted utilizing a particular header format, the flow information operable for generating a hash that indexes to the cache entry. The accelerator includes an instruction within the control packet that requests a programming data plane of the smartNIC to provide instructions for removing the cache entry from the cache. Upon receiving the control packet, the programming data plane generates and transmits a second instruction to the accelerator for removing the cache entry from the cache.

Systems, methods, and other embodiments associated with performing intrusion detection on load balanced network traffic are described. In one embodiment, a method includes receiving, at a load balancer host, an encrypted data packet from a remote computer. A certificate established between the remote computer and a destination service being accessed by the remote computer is used by the load balancer host to decrypt the encrypted data packet to create an unencrypted data packet. The unencrypted data packet is routed to an intrusion detection system at the load balancer host. The intrusion detection system is controlled to execute intrusion detection upon the unencrypted data packet. A secure connection is established with the destination computing node. The unencrypted data packet is re-encrypted and transmitted over the network using the secure connection to the destination computing node.

Intrusion detection on load balanced network traffic

Technologies are described herein for reducing network traffic when replicating memory data across hosts. The memory data stored in a main memory of the host computer is replicated to a main memory of a second host computer. Memory data from the local data storage of the second host computer and other hosts computers that is a duplicate of memory data from the main memory is identified. Instead of sending the memory data from the main memory that is duplicated, the duplicated memory is copied from the local storage of the second computer or from one or more of the other computers to the main memory of the second host computer.

Reducing network traffic when replicating memory data across hosts

Systems, methods, and other embodiments that interrupt multiple processors to process packets of a single flow are described. In one embodiment, a method includes maintaining a plurality of queues to hold interrupt requests created for packets received by a network device. Each queue is associated with a processor that will be interrupted by interrupt requests to process packets. The network device is configured to control how to queue interrupt requests created for a flow of packets. The network device is configured such that when a threshold number of interrupt requests created for the flow of packets have been inserted within a queue, subsequent interrupt requests created for subsequently received packets of the flow are inserted in a different queue. In this way, the network device is controlled to interrupt multiple processors for the flow of packets by queuing interrupt requests for the flow into different queues.

Interrupt distribution of a single flow across multiple processors

Technologies are described herein for reducing network traffic when replicating memory data across hosts. The memory data stored in a main memory of the host computer is replicated to a main memory of a second host computer. Memory data from the local data storage of the second host computer that is a duplicate of memory data from the main memory is identified. Instead of sending the memory data from the main memory that is duplicated, the duplicated memory is copied from the local storage to the main memory of the second host computer.

Technologies are described herein for examining memory data of execution environments to identify potential anomalies. An execution environment is identified as having a potential anomaly. The memory data associated with the execution environment is identified as having a potential anomaly. Checksums may be generated for the identified memory and for memory associated with other execution environments. Execution environments may be identified as having potential anomalies based, at least in part, on a commonality of the memory data of the execution environment that is identified as a having a potential anomaly with the memory data of another execution environment. Different actions may be performed on the execution environments that are identified as having a potential anomaly.

Examining memory of execution environments to identify potential anomalies

A technology is described for identifying a destination physical host used to host a computing instance modeled on a source computing instance. An example method may include obtaining specifications for a source computing instance in preparation to migrate the source computing instance to a destination physical host. A destination physical host may then be identified for hosting a destination computing instance modeled on the source computing instance, where the destination physical host may have specifications determined to support the destination computing instance. A model of the source computing instance as hosted on the source physical host may be compared with a model of the source computing instance as hosted on the destination physical host to identify any conflicts that may prevent the destination physical host from hosting the destination computing instance.

Growing community of inventors

Mercer Island, WA, United States of America

Brijesh Singh