Symantec Corporation

Nicira, Inc.

Symantec Operating Corporation

Veritas Technologies LLC

Laxmikant Vithal Gunda

Praveen Rakshe

Sachin Mohan Vaidya

Arnold Poon

Rajiv Krishnamurthy

Jayant Jain

Anirban Sengupta

Anindya Banerjee

Dilip Madhusudan Ranade

Navin Kabra

Radha Shelat

Sivaramakrishna Ramadugu Venkata

Mukesh Panchauli

BijayaLaxmi Nanda

Hemant Bhanawat

W Andrew Lambeth

Justin Pettit

Kuldeep Sureshrao Nagarkar

Amit Vasant Patil

Thomas Lanzatella

Prasad Sharad Dabak

Vasantha Kumar Dhanasekar

Nilesh Awate

Shie-rei Huang

Richard P Jones

Dulipsinh Deshmukh

Sara Abraham

Priyal Rathi

Andrew James Nash

Pillai Biju Shanmugham

Manoj Chaudhari

Kishor S Ghait

Nagaraj Shyam

Mugdha Sanghavi

Balaji Narasimhan

The technology disclosed herein enables micro-segmentation of virtual computing elements. In a particular embodiment, a method provides identifying one or more multi-tier applications comprising a plurality of virtual machines. Each application tier of the one or more multi-tier applications comprises at least one of the plurality of virtual machines. The method further provides maintaining information about the one or more multi-tier applications. The information at least indicates a security group for each virtual machine of the plurality of virtual machines. Additionally, the method provides identifying communication traffic flows between virtual machines of the plurality of virtual machines and identifying one or more removable traffic flows of the communication traffic flows based, at least in part, on the information. The method then provides blocking the one or more removable traffic flows.

Micro-segmentation of virtual computing elements

Methods and apparatus for application and/or context-based management of virtual networks using customizable workflows are disclosed. An example apparatus includes a context engine to monitor data traffic from a virtual machine in a data plane of a virtual network to capture context information to identify an application executing on the virtual machine; and a policy manager to receive the context information to instantiate an application entity corresponding to the application in a policy plane of the virtual network and to generate a policy associated with the application entity in the policy plane of the virtual network, the policy and the application entity enabling monitoring and management of the application via the policy plane.

Application/context-based management of virtual networks using customizable workflows

Some embodiments of the invention provide a novel architecture for capturing contextual attributes on host computers that execute one or more machines, and for consuming the captured contextual attributes to perform services on the host computers. The machines are virtual machines (VMs) in some embodiments, containers in other embodiments, or a mix of VMs and containers in still other embodiments. Some embodiments execute a guest-introspection (GI) agent on each machine from which contextual attributes need to be captured. In addition to executing one or more machines, each host computer in these embodiments executes a context engine and one or more attribute-based service engines. Through the GI agents of a host's machines, the context engine of that host in some embodiments collects contextual attributes associated with network and/or process events on the machines, and provides the contextual attributes to the service engines to use to identify service rules for processing.

Context engine model

Some embodiments provide a context engine that supplies contextual-attributes to several context-based service engines on its host computer. Different embodiments use different types of context-based service engines. For instance, in some embodiments, the attribute-based service engines include an encryption engine that performs context-based encryption or decryption operations to encrypt data messages from the machines, or to decrypt data messages received for the machines.

Performing context-rich attribute-based encryption on a host

Some embodiments provide a novel method for configuring a set of service one or more nodes on a host to perform context-rich, attribute-based services on the host computer, which executes several data compute nodes (DCNs) in addition to the set of service nodes. The method uses a context-filtering node on the host to collect a first set of attributes associated with service rules processed by the set of service nodes on the host computer. The context filter also collects a second set of attributes associated with at least one data message flow of a DCN (e.g., of a virtual machine (VM) or container) executing on the host. After collecting the first and second sets of attributes, the context filtering node on the host compares the first and second sets of attributes to generate a service tag to represent a subset of the first set of attributes associated with the data message flow. The method associates this service tag with the data message flow. This service tag can then be used to identify the subset of attributes associated with the data message flow when a service node needs to process its attribute-based service rules for the data message flow.

Performing context-rich attribute-based services on a host

A method of providing security for containers executing on a physical host machine is provided. The method receives a notification of a file access request. The notification includes a path in a file system of the host machine being accessed by a process. From the path, the method determines whether the file access event is for accessing a location in the file system to which container file systems are mapped. The method identifies a namespace of the process using the identification of the process included in the file path. The method determines the process is a container when the namespace belongs to a service that is used to implement containers on the host machine. The method sends the identifier of the container, the identification of a VM executing the container, and the file path to a set of security applications to determine whether the file access request to be allowed.

Identifying container file events for providing container security

Some embodiments provide a novel method for performing a service at a host computer that executes data compute nodes (DCNs). For a data message, the method identifies a service tag and a set of attributes associated with the service tag. The method then uses the identified set of attributes to identify a service rule, and performs a service on the data message based on the identified service rule.

Some embodiments provide a system that detects whether a data flow is an elephant flow; and if so, the system treats it differently than a mouse flow. The system of some embodiments detects an elephant flow by examining, among other items, the operations of a machine. In detecting, the system identifies an initiation of a new data flow associated with the machine. The new data flow can be an outbound data flow or an inbound data flow. The system then determines, based on the amount of data being sent or received, if the data flow is an elephant flow. The system of some embodiments identifies the initiation of a new data flow by intercepting a socket call or request to transfer a file.

Inspecting operations of a machine to detect elephant flows

A computer-implemented method for simulating file system instances may include identifying a file system to host a simulated file system instance. The computer-implemented method may also include intercepting attempts to read from the file system. The computer-implemented method may further include, for each intercepted read attempt, generating data to fulfill the intercepted read attempt. The computer-implemented method may additionally include fulfilling the intercepted read attempt with the generated data. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for simulating file system instances

A computer-implemented method for selecting file-recall modes based on environmental properties may include (1) intercepting a request to recall a file from a secondary storage system to a primary storage system, (2) identifying a value of a dynamic environmental property associated with the file that may negatively impact performance of a mode of recalling the file from the secondary storage system to the primary storage system, (3) identifying a policy that comprises criteria for selecting an appropriate recall mode for recalling the file from the secondary storage system to the primary storage system, (4) adaptively selecting, by applying the policy to the value of the dynamic environmental property, a recall mode for recalling the file, and (5) recalling the file from the secondary storage system to the primary storage system using the selected recall mode. Various additional methods, systems, and configured computer-readable-storage media are also disclosed.

Systems and methods for adaptively selecting file-recall modes

Techniques for file classification information retention are disclosed. In one particular exemplary embodiment, the techniques may be realized as a method for file classification information retention comprising receiving an indication of creation of an email attachment, determining, using at least one computer processor, whether to extract file classification information for the email attachment, and in the event file classification information is extracted, storing the extracted file classification information in association with the email.

Techniques for file classification information retention

The virtualization of file system placeholders is described. In one embodiment, a method for virtualizing placeholders includes monitoring placeholder creation initiated by at least one archival operation, generating placeholder data in a separate data store from a file system, wherein the placeholder data comprises a plurality of placeholders that correspond with a plurality of archived files, and servicing access requests for at least one archived file of the plurality of archived files using the placeholder data.

Method and apparatus for virtualizing file system placeholders at a computer

A first computer system calculates a first value as a function of a data block. A second computer system compares the calculated first value with each of a plurality of values in a plurality of entries, respectively. The plurality of entries include a plurality of storage location pointers, respectively, that correspond to a plurality of data blocks, respectively, that were transmitted to a storage system before the first computer system calculated the first value. If the first value compares equally to a value contained in one of the plurality of entries, a storage location pointer of the one entry is transmitted to the storage system, wherein the storage location pointer corresponds to a copy of the data block that was sent to the storage system before the first computer system calculated the first value. If the calculated first value does not compare equally with any value contained in the plurality of entries, the first computer system transmits the data block to the storage system.

On-premise data deduplication for cloud environments

A computer-implemented method may include establishing a proxy file system that facilitates file archiving for a primary file system that does not support file archiving. The computer-implemented method may also include identifying a request to archive a file stored in a primary file system and copying the file to an archive file system such that a reference to the file is created in the proxy file system. The computer-implemented method may further include replacing the file in the primary file system with a symbolic link that identifies the reference in the proxy file system. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Pune Maharashtra, India

Laxmikant Vithal Gunda