Microsoft Technology Licensing, LLC

David Michael Brumley

Deepak Bansal

Rishabh Tewari

Parag Sharma

Nisheeth Srivastava

Abhishek Shukla

Harish Kumar Chandrappa

Avijit Gupta

Jayesh Kumaran

Abhishek Ellore Sreenath

Abhijeet Kumar

Aanand Ramachandran

Sushant Sharma

Albert Gordon Greenberg

Daniel Max Firestone

Xinyan Zan

Milan Dasgupta

Vaibhav Kumar

Neeraj Motwani

Vishal Taneja

Anitha Adusumilli

Anavi Arun Nahar

Vladimir Serov

Narayan Annamalai

Arjun Roy

The disclosed system implements techniques to secure communications for injecting a workload (e.g., a container) into a virtual network hosted by a cloud-based platform. Based on a delegation instruction received from a tenant, a virtual network of the tenant can connect to and execute a workload via a virtual machine that is part of a virtual network that belongs to a resource provider. To secure calls and authorize access to the tenant's virtual network, authentication information provided with a call from the virtual network of the resource provider may need to match authorization information made available via a publication service of the cloud-based platform. Additionally or alternatively, an identifier of a NIC used to make a call may need to correspond to a registered name of the resource provider for the call to be authorized. These checks provide increased security by preventing unauthorized calls to the tenant's virtual network.

Securing an injection of a workload into a virtual network hosted by a cloud-based platform

Virtual networks located in different regions of cloud provider are peered using unique regional identifiers for the virtual networks. The regional identifiers and other information are pushed down a network management stack to implement the peering.

Cross-regional virtual network peering

Techniques are described herein that are capable of monitoring connectivity and latency of network links in virtual networks. For instance, a ping agent injects first ping packets into network traffic on behalf of hosts in the virtual network. The ping agent monitors incoming packets to identify first ping response packets, which are in response to the first ping packets, among the incoming packets. A ping responder rule that is included in inbound packet filter rules for a port in a virtual switch intercepts second ping packets in the network traffic. The ping responder rule converts the second ping packets into second ping response packets and injects the second ping response packets into outbound packet filter rules to be transferred to sources from which the second ping packets are received.

Monitoring connectivity and latency of a virtual network

The disclosed system implements techniques to secure communications for injecting a workload (e.g., a container) into a virtual network hosted by a cloud-based platform. Based on a delegation instruction received from a tenant, a virtual network of the tenant can connect to and execute a workload via a virtual machine that is part of a virtual network that belongs to a resource provider. To secure calls and authorize access to the tenant's virtual network, authentication information provided in association with a call from the virtual network of the resource provider may need to match authorization information made available via a publication service of the cloud-based platform. Moreover, an identifier of a NIC used to make a call may need to correspond to a registered name of the resource provider for the call to be authorized. These checks provide increased security by preventing unauthorized calls from accessing the tenant's virtual network.

Growing community of inventors

Bellevue, WA, United States of America

David Michael Brumley