Microsoft Technology Licensing, LLC

Hasan Alkhatib

Deepak Bansal

Geoffrey Hugh Outhred

Geoff Outhred

Parveen Kumar Patel

Anatoliy Panasyuk

Dharshan Rangegowda

Anthony S Chavez

Albert Gordon Greenberg

Bruce Christopher Wootton

Changhoon Kim

Morgan Asher Brown

Ram Viswanathan

Jiazhen Chen

Dave Maltz

Fouad Tobagi

Computerized methods, systems, and computer-readable media are provided for distributing virtualized gateway functionality to multiple nodes within a physical network. Initially, drivers that carry out the gateway functionality are provisioned to cooperate with endpoints instantiated on the network nodes, while a directory service is implemented to maintain a mapping between virtual internet protocol (IP) addresses and location-dependent addresses, as well as a table enumerating transformation actions according to known pathways connecting the endpoints within a network. In operation, the directory service replies to requests from the driver (carrying source and destination IP addresses of data packets) with the appropriate location-dependent addresses (utilizing the mapping) and the appropriate transformation action(s) (utilizing the table). The transformation action(s) include rewriting headers of the data packets to include the location-dependent addresses, encapsulating the data packets as inner data packets within respective outer data packets, or configuring the data packets with a tunneling protocol.

Distributed virtual network gateways

Computerized methods, systems, and computer-readable media for promoting cooperation between a first and second virtual network overlay ('overlay') are provided. The first overlay is governed by a first authority domain and includes members assigned virtual IP addresses from a first address range. The second overlay is governed by a second authority domain, which is associated with a second federation mechanism, for negotiating on behalf of the second overlay. The second federation mechanism is capable of negotiating with, or soliciting delegation of authority from, a first federation mechanism that is associated with the first authority domain. When negotiations are successful or authority is delegated, the second federation mechanism establishes a communication link between the second overlay and the first overlay or joins a member of the second overlay to the first overlay. Joining involves allocating a guest IP address from the first address range to the member.

Federation among services for supporting virtual-network overlays

Architecture that facilitates the virtual specification of a connection between physical endpoints. A network can be defined as an abstract connectivity model expressed in terms of the connectivity intent, rather than any specific technology. The connectivity model is translated into configuration settings, policies, firewall rules, etc., to implement the connectivity intent based on available physical networks and devices capabilities. The connectivity model defines the connectivity semantics of the network and controls the communication between the physical nodes in the physical network. The resultant virtual network may be a virtual overlay that is independent of the physical layer. Alternatively, the virtual overlay can also include elements and abstracts of the physical network(s). Moreover, automatic network security rules (e.g., Internet Protocol security-IPSec) can be derived from the connectivity model of the network.

Model-based virtual networking

Embodiments are directed to providing a multi-tenant relay service that securely relays data between computer systems. A computer system receives a portion of data that is to be passed from a first computer system belonging to a first tenant to a second, different computer system. The instantiated multi-tenant relay service is configured to securely relay data for multiple different tenants. The computer system creates a secure routing channel for routing the data of the first tenant between the first computer system and the second computer system. The secure routing channel applies a unique identifier to each portion of data received from the first tenant. The computer system also routes the received data from the first computer system to the second computer system through the secure routing channel using the applied unique identifier.

Providing virtual networks using multi-tenant relays

The present invention extends to methods, systems, and computer program products for routing using global address pairs. Embodiments of the invention use publicly routable Internet Protocol ('IP') addresses to represent sites rather than individual hosts. Hosts can be represented by a global address pair, including site public IP address and a node private IP address. Nodes route packets to address processing modules using IP-in-IP encapsulation. An outer header contains a site public IP address and is destined to a site on inter-site links. An inner header contains a node private IP address and is destined to a private endpoint in intra-site links. In some embodiments, a site public IPv4 address and a node private IPv4 address are encoded into an IPv6 address. Use of an IPv6 address makes encoding of the two IPv4 address transparent to IPv6 applications.

Routing using global address pairs

Systems, methods and computer storage media for utilizing IPv6 addressing for globally unique identification of network endpoints when communications from or to an IPv4 compatible application. An IPv4 packet of data that is from and/or directed to an IPv4 endpoint is encapsulated in an IPv6 packet of data. An IPv6 compatible address is identified for a destination of the IPv6 packet of data. The IPv6 address is a globally unique identifier that is comprised of an IPv4 identifier that represents an IPv4 address of the encapsulated IPv4 packet. The IPv6 packet of data is communicated to the destination identified by the IPv6 address. A 4 to 6 stack may intercept the incoming IPv6 packet of data before the destination to strip the IPv6 header information revealing the IPv4 packet of data.

4to6 network stack for IPv4 applications

Computerized methods, systems, and computer-readable media are provided for establishing and managing a virtual network (V-net) and virtual machine (VM) switches that enable protected and isolated interconnections between members of the V-net. The V-net members include an originating network adapter that generates data packets addressed to a destination network adapter. Upon detecting data-packet generation, a source-side VM switch accesses a forwarding table associated with the V-net, ascertains a destination-side, VM-switch locator that corresponds to an identifier of the destination network adapter, and modifies the data packets to include the identifier. The forwarding table represents a mapping between the members of the V-net and VM switches located on respective nodes within the data center. In operation, the mapping enforces communication policies that govern data-packet traffic. Upon receiving the data packets, the destination-side VM switch restores the data packets and forwards them to the destination network adapter.

Interconnecting members of a virtual network

Computerized methods, systems, and computer-storage media for establishing and managing a transmission control protocol (TCP)-based tunnel ('tunnel') are provided. The tunnel spans between a data center and a private enterprise network and connects endpoints, of a service application, that reside in each location. During communication, the endpoints transmit data packets over one or more channels (e.g., higher-level channel and lower-level channel) that comprise the tunnel. Each of the channels supports reliability mechanisms (e.g., congestion-control mechanism and loss-recovery mechanism) integrally running thereon, for ensuring complete data-packet delivery. To prevent unwarranted performance degradation caused by duplicative efforts of reliability mechanisms, a fabric controller is employed to selectively disable one or more of the reliability mechanisms individually. The selective disablement of the reliability mechanisms is invoked by predefined criteria, such as instructions from a service model or detected identity of a source/destination endpoint, and is invoked on a per network connection basis.

Selectively disabling reliability mechanisms on a network connection

The present invention provides for a systemThis document describes embodimentsfor communicating with a host using a global address and a local address.The present invention allowsThese embodiments allowfor the communication to be initiated by an entity outside the host's network. The entity initiating the communication resolves the destination host's domain name into a global address and a local address. Messages are sent to the destination host using both the global address and the local address. In one embodiment, both the global and local address are included in the message by encapsulating IP packets. Some embodiments of the present invention also use pseudo addressing.

Growing community of inventors

Kirkland, WA, United States of America

Hasan Alkhatib