Vmware, Inc.

Igor Golikov

Alex Markuze

Israel Cidon

Eyal Zohar

Avishay Yanai

Aran Bergman

Lior Gal

Chen Dar

Yaniv Ben-Itzhak

Shay Vargaftik

Guy Golan Gueta

Ittai Abraham

Toly Kournik

Tsvetomir Dimirov Dimitrov

Some embodiments of the invention provide a method for WAN (wide area network) optimization for a WAN that connects multiple sites, each of which has at least one router. At a gateway router deployed to a public cloud, the method receives from at least two routers at least two sites, multiple data streams destined for a particular centralized datacenter. The method performs a WAN optimization operation to aggregate the multiple streams into one outbound stream that is WAN optimized for forwarding to the particular centralized datacenter. The method then forwards the WAN-optimized data stream to the particular centralized datacenter.

WAN optimization in the public cloud

The method of some embodiment provides DNS service for an SD-WAN. The method receives a DNS request for a domain name (e.g., a FQDN) from one of the compute nodes connected to the SD-WAN (e.g., from a branch site or datacenter site, or a machine of a remote user). The method selects a particular network address (e.g., a particular IP address) from several network addresses (e.g., several IP addresses) of several different sets of servers that are associated with the domain name based on measurements taken by agents deployed in the SD-WAN and based on SD-WAN DNS-resolution selection criteria. The method provides the particular network address in response to the DNS request to the machine that sent the DNS request (e.g., to the branch site or datacenter that sent the DNS request, or to the machine of the remote user that sent the request).

Providing DNS service in an SD-WAN

Some embodiments provide a method for transmitting data at a network interface controller (NIC) of a computer that operates as a server. The computer includes multiple storage devices. The method receives a request from a client device for a particular file. The method translates the particular file into a memory location corresponding to a particular one of the storage devices at the computer. The method transmits the requested file from the particular storage location to the client device.

Smart NIC responding to requests from client device

Some embodiments provide a method for performing data message processing at a smart NIC of a computer that executes a software forwarding element (SFE). The method determines whether a received data message matches an entry in a data message classification cache stored on the smart NIC based on data message classification results of the SFE. When the data message matches an entry, the method determines whether the matched entry is valid by comparing a timestamp of the entry to a set of rules stored on the smart NIC. When the matched entry is valid, the method processes the data message according to the matched entry without providing the data message to the SFE executing on the computer.

Accelerating data message classification with smart NICs

Some embodiments provide a method for sending data messages at a network interface controller (NIC) of a computer. From a network stack executing on the computer, the method receives (i) a header for a data message to send and (ii) a logical memory address of a payload for the data message. The method translates the logical memory address into a memory address for accessing a particular one of multiple devices connected to the computer. The method reads payload data from the memory address of the particular device. The method sends the data message with the header received from the network stack and the payload data read from the particular device.

Logical memory addressing by smart NIC across multiple devices

In a novel tunnel-less SD-WAN, when an ingress node of the SD-WAN receives a new packet flow, it identifies the path of the flow through the SD-WAN, and sends an initial prepended set of SD-WAN header values before the first packet for the flow to the next hop along this identified path, rather than encapsulating each packet of the flow with encapsulating tunnel headers that store SD-WAN next hop data for the flow. The prepended set of SD-WAN header values are then used to not only forward the first packet through the SD-WAN, but also to create records at each subsequent hop, which are then used to forward subsequent packets of the flow through the SD-WAN.

Tunnel-less SD-WAN

WAN optimization for encrypted data traffic using fully homomorphic encryption

Wan optimization for encrypted data traffic using fully homomorphic encryption

Some embodiments provide a method for, at a network interface controller (NIC) of a computer, accessing data in a network. From the computer, the method receives a request to access data stored at a logical memory address. The method translates the logical memory address into a memory address of a particular network device storing the requested data. The method sends a data message to the particular network device to retrieve the requested data.

Logical memory addressing for network devices

Some embodiments of the invention provide a WAN optimization method for optimizing traffic flows through a WAN connecting multiple sites each having at least one router. The method is performed in a kernel space of a first router at a first site. From a second router at a second site, the method receives, in an optimized data stream originating from a source device at the second site and destined to a destination device at the first site, a file including compressed segments not yet stored in a database of the first router. The method copies the compressed segments to a shared memory used with a decompression program operating in the first router's user space. For each compressed segment, the method receives, from the decompression program, a decompressed segment obtained by decompressing the compressed segment, and stores the decompressed segment in a kernel space memory for use in processing the file.

Advanced storage operations for wan optimization

Some embodiments of the invention provide a WAN optimization method for optimizing traffic flows through a WAN. The method is performed in a kernel space of a first router at a first site. From a second router at a second site, the method receives, in an optimized data stream from a second site source device to a first site destination device, a file including compressed segments not yet stored by the first router, and copies the compressed segments to a memory shared with a decompression program in the first router's user space. For each compressed segment, the method receives a notification that a decompressed segment obtained by decompressing the compressed segment has been written to a disk storage of the first router, the notification including a block address for the decompressed segment, and updates a cache of the first router with an entry mapping the decompressed segment to the block address.

Advanced storage operations for WAN optimization

WAN optimization using probabilistic data filters

Some embodiments provide a method of reducing network congestion in a virtual network. The method, at a first CFE of the virtual network, receives multiple encapsulated data packets of a data stream. The encapsulated data packets having been encapsulated by a second CFE, operating on a server of the virtual network. The second CFE identifies a load percentage of the server, sets explicit congestion notification (ECN) bits on a percentage of the data packets based on the load percentage of the server, and encapsulates each data packet. The first CFE determines whether to forward a new connection to the second CFE based at least on the percentage of data packets from the first CFE with the ECN bits set.

Explicit congestion notification in a virtual environment

In some embodiments, a method sends first messages that request first information for a set of blocks of the blockchain to the N replicas. Each replica maintains a respective instance of the blockchain. Second messages is received from at least a portion of the N replicas. The second messages include the first information for the set of blocks from each respective instance of the blockchain that is maintained by the N replicas. The method analyzes the first information to determine whether a consensus on the first information is reached by a number of replicas. When consensus is reached, a request is sent to a replica for one or more blocks to back up to a backup blockchain and second information is received for the one or more blocks from the replica. The method uses the second information to back up the one or more blocks in the backup blockchain.

Growing community of inventors

Kfar Saba, Israel

Igor Golikov