International Business Machines Corporation

Eran Gampel

Gal Sagi

Renato John Recio

Ravinder Reddy Amanaganti

Dean Har'el Lorenz

Etai Lev Ran

Ryan Moats

Gal Sagie

Guy Laden

Marc Cochran

James Allan Kahle

Bernard Metzler

James C Sexton

Liran Schour

Claude Basso

Embodiments for providing enhanced endpoint multicast emulation in a computing environment. One or more multicast operations may be executed on an overlay network using endpoint multicast emulation by using an overlay layer or a virtual extensible LAN ('VXLAN') layer to maintain control over one or more multicast groups.

Enhanced endpoint multicast emulation

A secure communication tunnel between user space software and a client device can be established. A private session key can be communicated from the user space software to a network communication device in at least one User Datagram Protocol datagram. Outbound session backets can be communicated from the user space software to the network communication device. The network communication device can generate encrypted outbound session packets by encrypting the outbound session packets using the private session key; communicate, to the client device via the secured communication tunnel, the encrypted outbound session packets; receive, by the network communication device from the client device, via the secured communication tunnel, inbound session packets; generate, by the network communication device, decrypted inbound session packets by decrypting the inbound session packets using the private session key; and communicate, from the network communication device to the user space software, the decrypted inbound session packets.

Distribution of private session key to network communication device for secured communications

A computer-implemented method for distributing packets for asymmetrical traffic by a network interface card (NIC). The computer-implemented method includes obtaining information of an incoming packet incoming from a source endpoint behind a stateful service and accessing a destination endpoint using a network address translation (NAT) service, hashing the information to calculate queue identification for the packet to direct the packet to the queue associated therewith, executing a NAT on an outgoing packet associated with the incoming packet to allow for retrieval of the queue identification from a header of the outgoing packet, sending the outgoing packet to the destination endpoint, which is responsive with a return packet, stamping the queue identification to the return packet upon the return packet being transmitted back from the destination endpoint and the queue identification being retrieved and instantiating an RSS override operation to redirect the return packet to the queue on the response.

Symmetric receive-side scaling (RSS) for asymmetric flows

A system, method, and computer program product for implementing network state processing is provided. The method includes detecting operational states for ports of a server Internet protocol (IP) data plane component of an integrated switching device. Each operational state is analyzed and matching and action rules associated with the operational states are generated with respect to data packets arriving at the ports. Data describing each operational state is stored within a port cache structure of a port. An incoming data packet is detected at a first port and the matching and action rules are distributed between port engines of the ports. The matching and action rules are executed with respect to the incoming data packet and the incoming data packet is transmitted to a destination port. Operational functionality of the integrated switching device is enabled with respect to execution of the incoming data packet at the destination port.

Integrated network switch operation

A secure communication tunnel between user space software and a client device can be established. A private session key can be communicated from the user space software to a network communication device via an application programming interface. Outbound session packets can be communicated from the user space software to the network communication device. The network communication device can generate encrypted outbound session packets by encrypting the outbound session packets using the private session key; communicate to the client device, via the secured communication tunnel, the encrypted outbound session packets; receive, by the network communication device from the client device, via the secured communication tunnel, inbound session packets; generate decrypted inbound session packets by decrypting the inbound session packets using the private session key; and communicate the decrypted inbound session packets.

API based distribution of private session key to network communication device for secured communications

A secure communication tunnel between user space software and a client device can be established. A private session key can be accessed from a cryptographic service. The private session key can be communicated from the user space software to a network communication device. Outbound session packets can be communicated from the user space software to the network communication device. The network communication device can be configured to generate encrypted outbound session packets by encrypting the outbound session packets using the private session key; communicate to the client device, via the secured communication tunnel, the encrypted outbound session packets; receive from the client device, via the secured communication tunnel, inbound session packets; generate decrypted inbound session packets by decrypting the inbound session packets using the private session key; and communicate the decrypted inbound session packets.

Distribution of a cryptographic service provided private session key to network communication device for secured communications

A network interface card (NIC) and a method for stablishing a connection between virtual machines of a network. The NIC includes: a programmable switching ASIC (application-specific integrated circuit), a central processing unit (CPU), multiple Ethernet controllers, and multiple on-board transceivers functioning as external ports. The switching ASIC functions as a switch that manipulates data traffic within the NIC including by switching the data traffic between and among the CPU, the Ethernet controllers, and the on-board transceivers. The method includes: installing rules that route a Synchronize (SYN) packet from a source virtual machine (VM) through a software engine, appending a signed cookie to the SYN packet; verifying that a policy represented by the signed cookie appended to the SYN packet matches a policy of a destination VM; and returning the SYN packet to the source VM which establishes a connection between the source VM and the destination VM.

Networking hardware and software and data center topologies leveraging same

An optical port routing enclosure and programmable NIC card as well as cluster topologies leveraging same are provided.

A system for processing packets in a network is provided. The system includes a computing platform running a software framework configured for accessing packets flowing into a packet processing pipeline of a node in the network; and identifying at least one pattern in said packets. Based on this pattern, the systems routes a first portion of the packets into the packet processing pipeline and offloads a second portion of the packets to the computing platform to be processed by the software framework.

Workload distribution in a data network

A virtual address of a destination of a packet is parsed into a set of virtual address components. A subset of the set of virtual address components is tokenized into a token. The token is converted into at least a portion of a hostname. A look-up of a real network address corresponding to the hostname is performed. The packet is caused to be transmitted to the real network address, wherein the real network address corresponds to a host machine on a physical network, the receiving virtual entity operating on the host machine.

Discovery-less virtual addressing in software defined networks

A packet forwarding device and a system using same are provided. The packet forwarding device includes a datapath forwarding hardware unit for processing a first set of packets matching a first set of rules of a rules table. The packet forwarding device further includes a datapath forwarding software unit for generating or modifying the rules table and for processing a second set of packets matching a second set of rules of the rules table and applying a service to the second set of packets.

Growing community of inventors

Herzliya, Israel

Eran Gampel