Cisco Technology, Inc.

Ian James Wells

Kyle Andrew Donald Mestery

Grzegorz Boguslaw Duraj

Yichen Wang

Dominik Rene Tornow

Urmil Vijay Dave

David Delano Ward

Vasudevan Mahalingam

Carlos M Pignataro

Nagendra Kumar Nainar

Rajiv Asati

William Mark Townsley

Om Prakash Suthar

Yoann Desmouceaux

Pierre Pfister

Arghya T Mukherjee

Santanu Dasgupta

Guillaume Ruty

Kyle Mestery

Rahim Lalani

Aloys Augustin

Viktor Mats Emanuel Leijon

Andree Toonk

Chandragupta Ganguly

Vinod Pandarinathan

Ajay Kalambur

John Wei-I Wu

Jerome Henry

Robert Edgar Barton

Gregory J Shepherd

Vincent E Parla

Santosh Ramrao Patil

Christopher Metz

Jerome Tollet

Aloÿs Christophe Augustin

Avaneesh Anandrao Kadam

Matthew William Gillies

Vikram Prasad Munishwar

Durgaprasad Sukhadeo Pawar

Kyle Andrew Mestery

This technology defines an envelope of a set of constraints to impose a network characteristic. A function is created to form a combined set of envelopes to configure resources for use in the network. A path is discovered from a first state to a second state based on the combined set of envelopes. A set of service descriptors configures the function based on a load demand for the network. A path selection is tested of a set of envelopes against the load demand for the network. The set of constraints of a path selection is determined as to whether the load demand is met demand. In response to a set of envelopes meeting the load demand, a path selection is enabled for a set of constraints defined by the set of envelopes, else if the load demand is not met, then an error message is returned to the network provider.

Connecting service level outputs to orchestration inputs

Provided herein are techniques to facilitate providing consumer-defined workloads for a network slice of a slice provider network. In at least one example, a method may include transmitting a query to a slice provider function for topology information of an instantiated network slice in which the instantiated network slice includes slice resources provided at a plurality of network locations. The method may further include obtaining the topology information that identifies, at least in part, the plurality of network locations at which the slice resources and identifying, based at least in part on the topology information, at least one network location of the instantiated network slice at which to instantiate a consumer-defined workload, and transmitting a request to instantiate the consumer-defined workload that includes at least one location identifier of the at least one network location and a workload identifier of the consumer-defined workload to be instantiated.

Techniques to facilitate consumer-defined workloads for a network slice of a slice provider network

A method includes receiving a DNS request, notifying a serverless orchestrator system of data associated with the DNS request, provisioning a function on a serverless function node based on the DNS request, notifying a load balancer regarding the serverless function node, providing a response to the DNS request and routing an API request associated with the DNS request to the serverless function node.

Systems and methods providing serverless DNS integration

Techniques for transferring address rights (e.g., internet protocol address(es), media access control address(es), etc.) amongst devices in a data center network fabric. A data center (DC) authority (e.g., network controller and/or a service controller) of a data center network fabric may determine that a device in the network is to communicate on an address in the network. The DC authority may create and sign a token that indicates a verifiable authorization to communicate on the address. The token may allow any device that posses the token to communicate on the address, following verification from an associated network switch. Additionally, the token may be signed by a device in the network in possession of the token, and delegated to another device in the data center network fabric following a migration of a service from one server to another, for example.

Transferring verifiable address rights between devices of a data center (DC) network

Techniques for creating consent contracts for devices that indicate whether the devices consent to receiving network-based communications from other devices. Further, the techniques include enforcing the consent contracts such that network-based communications are either allowed or disallowed in the network-communications layer prior to the network communications reaching the devices. Rather than simply allowing a device to communicate with any other device over a network, the techniques described herein include building in consent for network-based communications where the consent is consulted at one or more points in a communication process to make informed decisions about network-based traffic.

Indicating network-based consent contracts using packet-level data

Centralized consent vendors for managing network-based consent contracts

This disclosure describes techniques for performing application-based tagging. An example method includes receiving, at a virtual socket, non-packetized data from an application and generating, by the virtual socket, a label based on the application. One or more data packets are generated by packetizing at least a portion of the non-packetized data. A header field of the one or more data packets includes a tag based on the label.

Application-based data labeling

This disclosure describes techniques and mechanisms for using a domain-specific language (DSL) to express and compile serverless network functions, and optimizing the deployment location for the serverless network functions on network devices. In some examples, the serverless network functions may be expressed entirely in the DSL (e.g., via a text-based editor, a graphics-based editor, etc.), where the DSL is a computer language specialized to a particular domain, such as a network function domain. In additional examples, the serverless network functions may be expressed and compiled using a DSL in combination with a general-purpose language (GSL). Once the serverless network function have been expressed and/or compiled, the techniques of this disclosure further include determining an optimized network component on which the serverless network function is to execute, and deploying the serverless function to the optimized network component.

Identifying execution environments for deploying network functions

Creating network-based consent contracts

Techniques for Network Address Translation (NAT)-based steering of traffic in cloud-based networks. The techniques may include establishing, by a frontend node of a network, a connection with a client device. The frontend node may receive, via the connection, a packet including an indication of an identity of a service hosted on a backend node of the network. Based at least in part on the indication, the frontend node may establish a second connection with the backend node. Additionally, the frontend node may store a mapping indicating that packets received from the client device are to be sent to the backend node. The techniques may also include receiving another packet at the frontend node or another frontend node of the network. Based at least in part on the mapping, the frontend node or other frontend node may alter one or more network addresses of the other packet and forward it to the backend node.

Network address translation (NAT)-based traffic steering

Techniques and mechanisms to reduce double encryption of packets that are transmitted using encrypted tunnels. The techniques described herein include determining that portions of the packets are already encrypted, identifying portions of the packets that are unencrypted, and selectively encrypting the portions of the packets that are unencrypted prior to transmission through the encrypted tunnel. In this way, potentially private or sensitive data in the packets that is unencrypted, such as information in the packet headers, will be encrypted using the encryption protocol of the encrypted tunnel, but the data of the packets that is already encrypted, such as the payload, may avoid unnecessary double encryption. By reducing (or eliminating) the amount of data in data packets that is double encrypted, the amount of time taken by computing devices, and computing resources consumed, to encrypted traffic for encrypted tunnels may be reduced.

Partial packet encryption for encrypted tunnels

Enforcing consent contracts to manage network traffic

Techniques for load balancing communication sessions in a networked computing environment are described herein. The techniques may include establishing a first communication session between a client device and a first computing resource of a networked computing environment. Additionally, the techniques may include storing, in a data store, data indicating that the first communication session is associated with the first computing resource. The techniques may further include receiving, at a second computing resource of the networked computing environment, traffic associated with a second communication session that was sent by the client device, and based at least in part on accessing the data stored in the data store, establishing a traffic redirect such that the traffic and additional traffic associated with the second communication session is sent from the second computing resource to the first computing resource.

Load balancing communication sessions in a networked computing environment

Systems, methods, and computer-readable media are provided for reusing execution environments and code of serverless functions while ensuring isolation in serverless computing environments. In some examples, a method can include, in response to a first request to run a serverless function, executing, at an execution environment on a network, computer-readable code configured to perform the serverless function; after the computer-readable code has executed, modifying a pointer to an area of memory used to store a first state of the serverless function to reference a different area of memory; in response to a second request to run the serverless function, reusing, at the execution environment, the computer-readable code to perform the serverless function; and based on the pointer referencing the different area of memory, using the different area of memory to store a second state of the serverless function.

Reuse of execution environments while guaranteeing isolation in serverless computing

Growing community of inventors

San Jose, CA, United States of America

Ian James Wells