International Business Machines Corporation

Cisco Technology, Inc.

Hoang-Nam Nguyen

Vijoy A Pandey

Christoph Raisch

Navindra Yadav

Sunil Gupta

Shashi Gandham

Supreeth Rao

Darshan Shrinath Purandare

Gerd Konrad Bayer

Praneeth Vallem

Jothi Prakash Prabakaran

Janardhanan Radhakrishnan

Xuan Zou

Umesh Paul Mahindra

Marco Kraemer

Jan-Bernd Themann

Zhenwei Hu

Hannes Hering

Carsten Otte

Ashok N Chippa

Stefan Usenbinz

Glen C Darling

Joseph Daniel Beshay

Girish Anant Kalele

Akshay Srirangam

Aspects of the disclosed technology relate to ways to authenticate customer/subscriber access to a policy update stream. A process of the technology can include steps for instantiating a network monitoring device in response to a request, the request comprising one or more configuration parameters for the network monitoring device, and receiving a first certificate from the network monitoring device, wherein the first certificate is based on the one or more configuration parameters. In some aspects, the steps can further include sending the first certificate to a processing pipeline for authentication, wherein the processing pipeline is configured to authenticate the first certificate based on a second certificate received by the processing pipeline from the network monitoring device. Systems and machine readable media are also provided.

Secure publishing for policy updates

An aspect includes a computer system with a network encryption device and a trusted container within firmware or hardware and/or within a virtual machine running on the computer system. The network encryption device includes a key store for storing secret encryption keys and a network traffic encryption engine for negotiating and/or storing encryption keys in the key store and/or for encrypting and/or decrypting network traffic using the encryption keys from the key store. The trusted container includes a flow analyzer for analyzing network traffic received from the network encryption device.

Encryption with sealed keys

Disclosed is a system configured to receive a set of network snapshot segments from an output stream of a stream processing service, compile the set of network snapshot segments from the set of messages into a first network snapshot and a second network snapshot, and compare the first network snapshot and the second network snapshot to identify a difference between the first network snapshot and the second network snapshot.

Mechanism for identifying differences between network snapshots

Aspects of the subject technology relate to a system configured to receive, from a stream processing service, a first network snapshot segment. The first network snapshot segment is associated with metadata that is used to determine that at least one additional network snapshot segment associated with the output stream has not been previously received. The system is configured to request, from the stream processing service, the at least one additional network snapshot segment and generate a first network snapshot by compiling the first network snapshot segment and the at least one additional network snapshot segment.

Mechanism for facilitating efficient policy updates

In one embodiment, a system includes at least one processor and logic integrated with and/or executable by the processor, the logic being configured to instantiate, using an interface definition language (IDL) on a first server, a remote procedure call (RPC) function to exchange information between the first server and a second server, generate at least one stub on the first server using the RPC, and generate at least one stub on the second server using the RPC, wherein the at least one stub generated on the second server does not perform any marshalling or un-marshaling of data when endianess of the two servers is the same. Other systems, methods, and computer program products for exchanging information between servers using RPCs are described in more embodiments.

Automatically generating efficient remote procedure call (RPC) code for heterogeneous systems

In one embodiment, a method includes extracting, by one or more processors, a class name from a uniform resource identifier (URI) of an application header of a standardized interface request that includes a command formatted in an application protocol. The application header includes meta-data that allows class declarations to function, at least in part, as a portion of interface description language. In another embodiment, a computer system for generating a RESTful interface includes a computer-readable memory and one or more processors in electrical communication with the memory. The one or more processors are configured to perform the method recited above. In yet another embodiment, a computer program product includes a computer-readable storage medium and program instructions stored on the computer-readable storage medium readable/executable by one or more processors to perform the method recited above.

Generation of representational state transfer interface from application programming interfaces

A data processing system includes a main storage, an input/output memory management unit (IOMMU) coupled to the main storage, a peripheral component interconnect (PCI) device coupled to the IOMMU, and a mapper. The system is configured to allocate an amount of physical memory in the main storage and the IOMMU is configured to provide access to the main storage and to map a PCI address from the PCI device to a physical memory address within the main storage. The mapper is configured to perform a mapping between the allocated amount of physical memory of the main storage and a contiguous PCI address space. The IOMMU is further configured to translate PCI addresses of the contiguous PCI address space to the physical memory address within the main storage.

Mapping device addresses to physical memory addresses

A scheduler may run a script. The script may have a plurality of configuration commands for a network device. A first configuration command of the plurality of configuration commands may be called to begin. A script engine may determine whether a termination request has been received. The script engine may run the first configuration command when it is determined the termination request is not received. While the first configuration command is running, the script engine may receive the termination request. Instead of terminating immediately upon detection of a termination request, the first configuration command may complete.

Script termination

Techniques for mapping device addresses to physical memory addresses

One or more processors receive a standardized interface request that includes a command formatted in an application protocol. One or more processors extract a class name from a uniform resource identifier (URI) of an application header of the standardized interface request. The application header includes a meta-data that allows class declarations to function as a portion of interface description language. One or more processors identify a type of the command based, at least in part, on the application protocol of the command. One or more processors process the command based on the identified type of the command, the application protocol of the command, and the meta-data. One or more processors send a standardized interface response based on a result of the processing.

A computer system with a memory containing a first guest operating system, including a first portion of the memory and a second guest operating system, including a second portion of the memory. The memory further contains an address exchange module for exchanging memory address handles, a data mover for moving data between the first and second portions of the memory, and an emulated input output memory management unit for controlling the data mover. Instructions in the memory cause the processor to: register accessible memory with the emulated input output memory management unit, write address handles to the address exchange module, read the address handles from the address exchange module, and move the data into the second portion of the memory.

Growing community of inventors

Boeblingen, Germany

Hoang-Nam Nguyen