Nicira, Inc.

Vmware, Inc.

Kiran Kumar Thota

Azeem Feroz

James Christopher Wiese

Krishna Yadappanavar

Anjaneya Prasad Gondi

Sambasiva Rao Bandarupalli

For a host that executes one or more guest virtual machines (GVMs), some embodiments provide a novel encryption method for encrypting the data messages sent by the GVMs. The method initially receives a data message to send for a GVM executing on the host. The method then determines whether it should encrypt the data message based on a set of one or more encryption rules. When the process determines that it should encrypt the received data message, it encrypts the data message and forwards the encrypted data message to its destination; otherwise, the method just forwards the received data message unencrypted to its destination. In some embodiments, the host encrypts differently the data messages for different GVMs that execute on the host. When two different GVMs are part of two different logical overlay networks that are implemented on common network fabric, the method in some embodiments encrypts the data messages exchanged between the GVMs of one logical network differently than the data messages exchanged between the GVMs of another logical network. In some embodiments, the method can also encrypt different types of data messages from the same GVM differently. Also, in some embodiments, the method can dynamically enforce encryption rules in response to dynamically detected events, such as malware infections.

Method and apparatus for dynamically creating encryption rules

Method and apparatus for encrypting messages based on encryption group association

Method and apparatus for differently encrypting data messages for different logical networks

Encryption architecture

Method and apparatus for differently encrypting different flows

Exemplary methods, apparatuses, and systems receive a command to overwrite or delete data stored within an allocated portion of a file system. In response to the command, an entry is added to a first data structure. A write command is received. The portion of the file system added to the first data structure is formatted for reallocation. In performance of the write command, the portion of the file system is reallocated. Portions of the file system are allocated from a second data structure when the second data structure includes a sufficient amount of space to satisfy the write command and from the first data structure when the second data structure does not include a sufficient amount of space. The second data structure includes free portions of the file system that have been formatted for allocation. The first data structure includes free portions that have yet to be formatted.

Inline garbage collection for log-structured file systems

Encryption system in a virtualized environment

Method and apparatus for encrypting data messages after detecting infected VM

Growing community of inventors

Bakersfield, CA, United States of America

Kiran Kumar Thota