Tigera, Inc.

Metaswitch Networks Limited

Big Switch Networks, Inc.

Christopher David Liljenstolpe

Michael James Curtis

Alex Pollitt

Simon Wingrove

Jonathan Eric Hardwick

Daniel C Hersey

R Kyle Forster

Jonathan Richard Berger

Edward Peter Harrison

Tom Denham

Paul Tiplady

Saurav Das

Balaji Sivasubramanian

Matthew Gerard Horatio Dupre

One or more data packets intended for a workload running on the server are received from an endpoint at a proxy associated with a server. The proxy associated with the server determines whether the one or more data packets intended for the workload are encrypted with a certificate associated with a policy group that includes the workload. The one or more data packets are provided to the workload based on whether the one or more data packets intended for the workload are encrypted with a certificate associated with a policy group that includes the workload.

Policy controlled cryptography

Metadata associated with a workload is determined. The workload is associated with a consumer of a service. One or more policies associated with the metadata are retrieved. An agent is configured to perform policy-controlled service routing of communications comprising the data packets with respect to the workload based on the one or more policies.

Policy controlled service routing

Measures for routing data packets in a data center network are provided. A packet forwarding function in a server in a data center network is configured to forward data packets to/from virtual systems hosted on that server. The packet forwarding function is configured to make forwarding decisions for received data packets based on the destination internet protocol (IP) address of the received data packet, and forward the data packet at least on the basis of the forwarding decision.

Data center networks

A policy group associated with one or more data packets received from a workload is determined. The one or more data packets are encrypted with a certificate associated with the policy group. The encrypted one or more data packets are sent to an endpoint.

Measures, including methods, systems and computer program products, for use in processing route data in a network comprising a plurality of autonomous systems. At a network device, route data defining at least one route for network traffic which is configured on at least one border network device is received from the at least one border network device. The at least one border network device is located at a border of an autonomous system in the plurality of autonomous systems. The network device processes the received route data according to a set of policies to generate modified route data. The network device transmits at least a part of the modified route data to the at least one border network device. The at least part of the modified route data is operable to instruct the at least one border network device to modify the behavior of the at least one route.

Processing route data

Measures, including systems, methods and non-transitory computer-readable storage mediums, for use in operating a data center network, the data center network including an interconnect fabric including a plurality of spine switches, a plurality of top-of-rack switches and a plurality of compute servers. The interconnect fabric is configured to implement a plurality of independent spine switch planes. Each spine switch plane in the plurality of independent spine switch planes includes a different spine switch in the plurality of spine switches. The configuring includes configuring Layer 2 networking within each independent spine switch plane in the plurality of independent spine switch planes.

Measures for controlling communication access in a data center network are provided. A packet forwarding function in a server in a data center network is configured to access an access control data store when making forwarding decisions for received data packets which are being routed to/from virtual systems hosted on that server. In response to receipt, at the server, of a setup notification relating to setup of a virtual machine on the server, one or more entries are populated in the access control data store. The entries comprise an internet protocol (IP) address of the virtual system and at least one associated IP address of one or more other communication endpoints.

Certain examples described herein provide a system and method for validating a routing function for a network device. In one example, a network device has a run-time policy engine, wherein the run-time policy engine implements a routing configuration file and the routing configuration file defines a routing function for network traffic. A file editor is also provided that loads the routing configuration file. The file editor has an editor policy engine that duplicates a functionality of the run-time policy engine. In one example, the routing configuration file has at least one validation portion that has one or more route statements with definitions indicative of expected routing function behavior. The file editor parses the routing configuration file by implementing the routing configuration file using the editor policy engine. The editor policy engine applies the routing function defined by the routing configuration file to the one or more route statements and indicates where a result of the routing function does not conform to the definitions indicative of expected routing function behavior. These examples may help to reduce routing errors due to configuration errors in network devices.

Validating a routing function

Described herein is an inference-based approach to process network route definitions, e.g. routes received from other network devices according to a defined routing protocol. In examples, at least one proposition is defined that relates to at least one property of the route. Probabilities are also defined in association with the proposition. A first probability may be indicative of a randomly-selected network route and a second probability may be indicative of randomly-selected network route that is suitable for use in routing network traffic. In certain examples, a probability that a given route is malicious or erroneous may be computed. Probabilities may be calculated by processing historical routing data, such as network route definitions that are labelled as suitable for routing traffic. Probabilities may also be evaluated cumulatively over multiple routing policy elements. Final actions may be made by applying a configurable range or threshold to an output confidence value.

Inference-based network route control

Measures for establishing connectivity in a data center network are provided. A virtual connection is created between a virtual system hosted on a server in a data center network, and a packet forwarding function in that server. Additionally, an entry is populated in a packet forwarding data store in the server, which includes an internet protocol (IP) address of the virtual system and an associated identifier for the created virtual connection. The packet forwarding data store is accessed by the packet forwarding function when making forwarding decisions for received data packets.

A network may include a core region having routers and peripheral regions coupled to the core regions. Switches controlled by a controller may be interposed between the routers. The controller may maintain network topology information of the network. A path computation module may identify forwarding paths between the network routers based on the network topology information and other information such as network traffic history, current network traffic conditions, future network traffic forecasts, or other desired network information. The controller may control the switches to implement the identified forwarding paths. The controller may detect network topology changes and update forwarding paths based on the detected network topology changes. The controller may determine weights of path segments of the network topology. A routing module may provide the path segment weights to the routers using a network protocol.

Systems and methods for efficient network traffic forwarding

A network controlled by a controller may include end hosts that are coupled to the switches. The network may be coupled to gateways that interface between the network and an external network. The network may include subnetworks formed from respective portions of the end hosts of the network. The controller may create virtual gateways that interface between each of the subnetworks and the network by providing the end hosts of each subnetwork with virtual gateway Ethernet addresses. The controller may receive a network packet having a virtual gateway Ethernet address from an end host of a given subnetwork. The network packet may be destined for an end host of an external network or subnetwork. The controller may forward the network packet to the destination end host by redirecting the network packet through a selected gateway or by controlling the switches to perform gateway functions.

Growing community of inventors

San Francisco, CA, United States of America

Christopher David Liljenstolpe