Nicira, Inc.

Emc Corporation

Other

Rsa Security Inc.

James Christopher Wiese

Azeem Feroz

Kiran Kumar Thota

James Nisbet

Anirban Sengupta

Sachin Mohan Vaidya

Stephen Crosby Hoyt

David Alexander Reizes

Vasantha Kumar

Amit Vasant Patil

Yedidya Dotan

Lawrence N Friedman

Mark Weng Soon Wah

For a host that executes one or more guest virtual machines (GVMs), some embodiments provide a novel encryption method for encrypting the data messages sent by the GVMs. The method initially receives a data message to send for a GVM executing on the host. The method then determines whether it should encrypt the data message based on a set of one or more encryption rules. When the process determines that it should encrypt the received data message, it encrypts the data message and forwards the encrypted data message to its destination; otherwise, the method just forwards the received data message unencrypted to its destination. In some embodiments, the host encrypts differently the data messages for different GVMs that execute on the host. When two different GVMs are part of two different logical overlay networks that are implemented on common network fabric, the method in some embodiments encrypts the data messages exchanged between the GVMs of one logical network differently than the data messages exchanged between the GVMs of another logical network. In some embodiments, the method can also encrypt different types of data messages from the same GVM differently. Also, in some embodiments, the method can dynamically enforce encryption rules in response to dynamically detected events, such as malware infections.

Method and apparatus for dynamically creating encryption rules

Systems and techniques are described for virtual machine security. A described technique includes operating one or more virtual machines each in accordance with a respective security container, wherein the respective security container is associated with a respective rule that specifies transfer of the virtual machine from the respective security container to a quarantine container based on one or more criteria. One or more security services are operated on the one or more virtual machines to identify one or more security threats associated with one or more of the virtual machines. One or more tags generated by the endpoint security services are obtained, where each tag is for a virtual machine that is associated with one of the identified security threats. And one of the virtual machines is identified as requiring transfer to the quarantine container based on, at least, one or more of the obtained tags and the one or more criteria.

Framework for coordination between endpoint security and network security services

Method and apparatus for encrypting messages based on encryption group association

Method and apparatus for differently encrypting data messages for different logical networks

A method for performing network access filtering and/or categorization through guest introspection on a device data compute node (DCN) that executes on a host is provided. The method, through a guest introspector installed on the DCN, intercepts a data message that the DCN is preparing to send. The method identifies a category of the network resource. The method uses the category of the network resource to examine a set of network access policies that are stored on the host in order to determine whether the network access should be allowed. The method identifies a network access policy that requires the rejection of the network access when the access to the network resource causes an aggregate bandwidth for accessing the identified category of network resource to exceed a bandwidth threshold. The method rejects the network access based on the identified network access policy.

Introspection method and apparatus for network access filtering

Systems and techniques are described for virtual machine security. A described technique includes operating one or more virtual machines each in accordance with a respective security container, wherein the respective security container is associated with a respective rule that specifies transfer of the virtual machine from the respective security container to a quarantine container based on one or more criteria. One or more security services are operated on the one or more virtual machines to identify one or more security threats associated with one or more of the virtual machines. One or more tags generated by the endpoint security services are obtained, where each tag is for a virtual machine that is associated with one of the identified security threats. And one of the virtual machines is identified as requiring transfer to the quarantine container based on, at least, one or more of the Obtained tags and the one or more criteria.

Encryption architecture

A system and method for controlling at least one fan and/or a compressor are described and shown. The system may comprise an electronic controller, an indoor sensor responsive to at least one characteristic of interior air, and an outdoor sensor responsive to at least one characteristic of exterior air. The electronic controller may cause at least one fan to be activated when interior air meets certain criteria relative to a set point and exterior air meets certain criteria relative to interior air. The method may comprise the steps of measuring at least one characteristic of exterior air, at least one characteristic of interior air, and activating at least one fan when the interior air meets certain criteria relative to a set point and the exterior air meets certain criteria relative to the interior air. A compressor may be selectively activated to provide air conditioning.

System and method for controlling at least one fan and a compressor

Some embodiments of the invention provide a method for performing network access filtering and/or categorization through guest introspection (GI) on a device. In some embodiments, this GI method intercepts directly on a device a data message that device is preparing to send, and uses a service appliance to determine whether the data message can be sent. The device in some embodiments is a guest virtual machine (VM) that executes on a multi-VM host computing device along with a service VM (SVM) that is the service appliance that determines whether the data message can be sent based on a set of filtering rules. In some embodiments, the method uses one or more introspectors (e.g., network introspector and/or file introspector) to capture introspection data from the guest VM (GVM) about the data message that the GVM is preparing to send. To perform the network access filtering, the GI method in some embodiments captures contextual information, such as user and application information (e.g., application associated with a particular URL request). Hence, in some embodiments, this method seamlessly processes granular user-aware URL filtering rules (e.g., members of the sales organization can access social networking sites but not other members). This approach requires no additional configuration on networking infrastructure.

Method and apparatus for differently encrypting different flows

Encryption system in a virtualized environment

Method and apparatus for encrypting data messages after detecting infected VM

A system and method for controlling a fan unit are described and shown. The system may comprise an electronic controller, an indoor sensor responsive to at least one characteristic of interior air, and an outdoor sensor responsive to at least one characteristic of exterior air. The electronic controller may cause at least one fan of a window fan to be activated when interior air meets certain criteria relative to a set point and exterior air meets certain criteria relative to interior air. The method may comprise the steps of measuring at least one characteristic of exterior air, at least one characteristic of interior air, and activating an intake fan when the interior air meets certain criteria relative to a set point and the exterior air meets certain criteria relative to the interior air. The fan unit may optionally include a selectively activated compressor and selectively provide air conditioning.

System and method for controlling a fan unit

Growing community of inventors

Dublin, CA, United States of America

James Christopher Wiese