International Business Machines Corporation

Lap Thiet Huynh

Dinakaran B Joseph

Sivaram Gottimukkala

Wesley McMillan Devine

Michael E Baskey

Jon K Franks

Dinesh C Verma

Sambit Sahu

Roy Frank Brabson

John Majikes

Jason P Hawrysz

Roberto Delima

Linwood H Overby, Jr

Michael S Law

Constantinos Kassimis

Linwood Hugh Overby, Jr

Arthur James Stagg

Michael D Williams

Chun-Shi Chang

Barry Mosakowski

Gregory M Callis

Christopher N Freeman

Bruce H Ratcliff

Jerry Wayne Stevens

Stephen R Valley

Jeffrey Alan Frey

Patricia G Driever

Robert E Moore

Gerd Breiter

Jeffrey Douglas Haggar

Einar Lueck

Michael Man Behrendt

Debanjan Saha

Bala Rajaraman

Maurice Isrel

Angelo Macchiano

Edward Glen Britton

Levent Gun

Mandis S Beigi

Ingo Adlung

Friedemann Baitinger

Kimberly Tekavec Bailey

Lee M Rafalow

Diane Iupe Shannon

David Yu Pin Yang

Roger A Bess

Alan George Packett

Loan Nguyen

David Barrett Bryant

Wesley McMillian Devine

Dakshi Agrawal

Douglas Morgan Freimuth

David Bruce Lindquist

Peter Bergersen Yocom

Rohith Kottamangalam Ashok

Ken Van Vu

David P Olshefski

David Anthony Herr

Andrew Hilliard Arrowood

John E Drake, Jr

Gerald Arnold Marin

Matthew J Sheard

Raif O Onvural

Carroll Eugene Fulkerson, Jr

Eric C Broockman

Mark T Wright

John E McGinn

Bouchung Lin

Thomas P McSweeney

Patrick S O'Donnell

Harold A Himwich

John L Brady

Joseph L McKinnon

Dinakaran D Joseph

Mickael Maison

Mark A Cossack

Dennis J Frett

Rong-Feng Chang

Timothy R Hefel

Jr Overby

Wesley Mcmillan Devine

A method for secure live migration of a virtual machine (VM) in a virtualized computing environment can include selecting a VM in a secure virtualized computing environment for live migration to a different virtualized computing environment and blocking data communications with the selected VM and other VMs in the secure virtualized computing environment. The selected VM can be live migrated to the different virtualized computing environment and the VM can be restarted in the different virtualized computing environment. Notably, a secure communicative link can be established between the restarted VM and at least one other of the VMs in the secure virtualized computing environment. Finally, data communications between the restarted VM and the at least one other of the VMs can be enabled over the secure communicative link.

Securing live migration of a virtual machine including blocking communication with other virtual machines

Embodiments of the present invention address deficiencies of the art in respect to connectivity management in a heterogeneous network and provide a method, system and computer program product for resilient and reliable end-to-end connectivity in a heterogeneous network. In one embodiment of the invention, a method for resilient and reliable end-to-end connectivity in a heterogeneous network environment can be provided. The method can include creating an instance of an abstracted network resource model (NRM) for a heterogeneous network environment of different network resource nodes. The method further can include binding an application endpoint in the instance of the abstracted NRM with a connectivity endpoint for a first of the different network resource nodes. The method yet further can include detecting an outage in the first of the different network resource nodes. Finally, the method can include re-binding the application endpoint to a second of the different network resource nodes in response to detecting the outage.

Reliable and resilient end-to-end connectivity for heterogeneous networks

Embodiments of the present invention address deficiencies of the art in respect to connectivity management in a heterogeneous network and provide a method, system and computer program product for resilient and reliable end-to-end connectivity in a heterogeneous network. In one embodiment of the invention, a method for resilient and reliable end-to-end connectivity in a heterogeneous network environment can be provided. The method can include creating an instance of an abstracted network resource model (NRM) for a heterogeneous network environment of different network resource nodes. The method further can include binding an application endpoint in the instance of the abstracted NRM with a connectivity endpoint for a first of the different network resource nodes. Finally, the method can include re-binding the application endpoint to a second of the different network resource nodes in response to detecting the outage.

In an embodiment of the invention, a method for secure live migration of a virtual machine (VM) in a virtualized computing environment can include selecting a VM in a secure virtualized computing environment for live migration to a different virtualized computing environment and blocking data communications with the selected VM and other VMs in the secure virtualized computing environment. The selected VM can be live migrated to the different virtualized computing environment and the VM can be restarted in the different virtualized computing environment. Notably, a secure communicative link can be established between the restarted VM and at least one other of the VMs in the secure virtualized computing environment. Finally, data communications between the restarted VM and the at least one other of the VMs can be enabled over the secure communicative link.

Securing live migration of a virtual machine from a secure virtualized computing environment, over an unsecured network, to a different virtualized computing environment

A system and method for monitoring liveliness includes a management device which has an application layer where applications are executed. A connection monitor is located other than on the application layer, and the connection monitor is configured to receive requests from clients and deliver the requests to components on the application layer. The components include a generic application monitor which responds to liveliness monitor requests from the clients for all applications monitored, and one or more applications which response to requests to that application.

Method and system for generic application liveliness monitoring for business resiliency

A method, system and computer program product for optimizing quality of service settings for virtual machine deployment and migration. A first network (e.g., user network) is provided that is dedicated to running user workloads deployed on virtual machines. A second network (e.g., cloud management network), isolated from the first network, is also provided that is dedicated to virtual machine deployment and migration. As a result of the first and second networks not being shared, the administrative server utilizes unique quality of service settings for virtual machine deployment and migration supported by the second network that would otherwise not be possible if the first and second networks were shared.

Implementing a private network isolated from a user network for virtual machine deployment and migration and for monitoring and managing the cloud environment

An integrated hybrid system is provided. The hybrid system includes compute components of different types and architectures that are integrated and managed by a single point of control to provide federation and the presentation of the compute components as a single logical computing platform.

Management of a data network of a computing environment

Intrusion detection is performed by communicating an initialization request from an intrusion detection system enabled application to an intrusion module to begin intrusion detection. Also, a request is communicated to a policy transfer agent to provide an intrusion detection system policy specifically configured for the application. The application identifies where in the application code the intrusion detection system policy is to be checked against an incoming or outgoing communication. Information obtained by the application program is selectively evaluated against information in the intrusion detection system policy. A conditional response is made based upon information in the intrusion detection system policy if an intrusion associated with the application program is detected.

Application based intrusion detection

Embodiments of the present invention address deficiencies of the art in respect to network services protocol implementation configuration and provide a method, system and computer program product for platform independent configuration of multiple network services protocol implementations. In one embodiment of the invention, a method for configuring a network services protocol implementation can include configuring a platform independent configuration for a network services protocol implementation. Thereafter, a target node can be selected to receive a deployment of the network services protocol implementation and the configured platform independent configuration can be transformed into a platform specific configuration for the target node. Finally, the transformed platform specific configuration can be deployed onto the target node.

Platform independent configuration of multiple network services

Methods, systems, and computer program products for dynamically modifying an application program's behavior in response to changing environmental conditions (such as network changes, system changes, and so forth). The application may solicit such information, and/or may receive unsolicited environmental change notifications. In response to a change notification, the application may take one or more of the following approaches to adapt to the changing conditions: (1) alter its execution; (2) modify its use of, or control of, other cooperating application; and (3) modify the selection of application execution threads. (An application might also decide to make no changes in its behavior.)

Dynamic modification of application behavior in response to changing environmental conditions

A computer-implemented method of enabling security in network resources provisioned as part of a service landscape instance is provided. The method includes initiating an orchestration process for creating a landscape service instance to provide services to a service subscriber over a data communications network. The method further includes deriving from the orchestration process at least one parameter, and generating at least one security configuration profile based upon the at least one parameter for at least one system of the landscape service instance.

Method of automating and personalizing systems to satisfy security requirements in an end-to-end service landscape

A computer-implemented method is provided for updating network security policy rules when network resources are provisioned in a service landscape instance. The method includes categorizing network resources in a service landscape instance based on a service landscape model. The method further includes responding to the provisioning of a network resource by automatically generating one or more security policy rules for a newly-provisioned network resource. Additionally, the method includes updating security policy rules of pre-existing network resources in the service landscape instance that are determined to be eligible to communicate with the newly-provisioned network resource so as to include the newly-provisioned network resource as a remote resource based on the service landscape model.

Method of dynamically updating network security policy rules when new network resources are provisioned in a service landscape

Embodiments of the present invention address deficiencies of the art in respect to e2e SLA support in a network of both manageable and unmanageable portions and provide a method, system and computer program product for e2e SLA compliance across both managed and unmanaged network segments. In one embodiment of the invention, a method for e2e SLA compliance across both managed and unmanaged network segments can be provided. The method can include identifying both a managed segment and an unmanaged segment of an e2e network for a communications path implicated by an SLA, determining an observed delay for the unmanaged segment of the e2e network, computing from a desired delay for the communications path and the observed delay a differential delay, and constraining the managed segment to meet the differential delay in order to assure meeting the desired delay for the communications path implicated by the SLA.

End-to-end (E2E) service level agreement (SLA) compliance across both managed and unmanaged network segments

Growing community of inventors

Cary, NC, United States of America

Lap Thiet Huynh