Cisco Technology, Inc.

Storage Technology Corporation

Atavium, Inc.

Quantum Corporation

Mark Alan Bakke

Timothy J Kuik

David P Thompson

Stephen P De Groote

Craig A Johnson

Paul Harry Gleichauf

Clayton Stuart Haapala

James D Muchow

Edward J Fiore

Ayman Mohammad Ghanem

Michael R Smith

Michael James Klemm

Saravanakumar Rajendran

Xiaoxue Ma

Marc David Olin

George A Rudeseal

Stephen Henry Blendermann

Charles Steven Rissmeyer

Renae M Weber

Charles Patrick Schafer

Steven Michael Halladay

Jeffrey Steven Laughlin

Thomas David West

Steven A Johnson

Michael C Wojnar

Dennis Hadders

Donald W Teske

Bonny Parker

Kyle Andrew Donald Mestery

Anuraag Mittal

Prasad Miriyala

Anusankar Elangovan

Edward Alan Soltis

William Mark Townsley

Paul Fazzone

Nadathur Srinivasan Sundar

Vishnu Emmadi

Shriram Velaga

Scott M Ferris

Narender Enduri

Eric Thorn

Pawlo P Prawdiuk

Robert G Lane

Harold G Varnis

Anthony W Steere, Jr

Dave Thompson

Bradley Scott Johnson

Paul Anthony Fazzone

Michael Smith

David Thompson

In one aspect, the present disclosure is directed to a method that includes receiving, at an edge component of a cloud-based secure access service, a corresponding access designation for each of a plurality of endpoints, each access designation specifying a type of access a corresponding endpoint has to remaining ones of the plurality of endpoints and other accessible network resources; based on the corresponding access designation of each of the plurality of endpoints, updating a routing table at the edge component, to include routing information for a subset of the plurality of endpoints having access to at least one other endpoint of the plurality of endpoints or to the other accessible network resources; and enabling routing of network traffic, via the cloud-based secure access service, between any number of the plurality of endpoints based at least in part on the routing table.

Access control and routing optimization at a cloud headend in a cloud-based secure access service environment

The present disclosure is directed to network traffic management and load balancing at a cloud-based secure access service accessible to remotely connected user devices. In one example, a cloud-based secure service system includes a network controller configured to receive network traffic from one or more user devices remotely connected to the controller; parse the network traffic into flow data and contextual information associated with the network traffic; determine that the network traffic is to be serviced by a target firewall service at the cloud-based secure service system based on the flow data and the contextual information; and direct the network traffic to the target firewall service to be serviced.

Flow parser and per flow data center utilization in a cloud-based secure access service environment

A data storage system includes a first storage layer, a second storage layer, an I/O manager, and a data organizer. The first storage layer utilizes a first type of data storage device. The first storage layer includes (i) a first data bucket that includes first data having a first data attribute, the first data bucket including a first data limit, and (ii) a second data bucket. The second storage layer utilizes a second type of data storage device. The I/O manager receives a data write request from the user and directs the data write request to the first storage layer. The data organizer (a) determines whether data in the data write request has the first data attribute; and (b) stores the data in the data write request in at least one of the first data bucket and the second data bucket if the data in the data write request has the first data attribute. When a volume of data in the first data bucket reaches the first data limit, the data organizer moves the volume of data in the first data bucket from the first storage layer to the second storage layer.

Systems and methods for random to sequential storage mapping

Systems and methods for data management using tagging rules and/or policies. The systems and methods described herein may allow users or administrators to easily label data, so as to organize the data in using any suitable terminology or parameters. Tagging rules (or tag rules) may apply or assign one or more tags to a data file or object. A tag may relate to various components of the data file or object. For example, a tag may relate to a creation date, author, size, or information within the data, such as whether the file or object includes a picture. Once the data is associated with one or more tags, policies may determine how the data is manipulated, stored, accessed, or otherwise used. Policies may relate to actions or operations to be performed with respect to data having one or more particular tags.

Systems and methods for data management using zero-touch tagging

Systems and methods for mapping random data writes to sequential or semi-sequential storage. Data writes may be initially directed to an SSD or other relatively low latency and high IOPS data storage layer. The data may remain in the SSD storage layer until a group of data may be written, together, to a sequential or semi-sequential storage layer. A data organizer may group the data into data buckets based on tags and/or policies associated with the data. In this way, data subject to similar lifetime, priority, data protection, and/or other policies may be stored on a same segment or other portion of the sequential storage layer. Similarly, data having similar access patterns, authors, files, objects, or project affiliations, may be stored together on a same segment of the sequential storage layer.

In one embodiment, a method includes receiving static profiles each comprising one or more properties of an operating environment, receiving a dynamic profile for identifying a configuration of an interface based on the static profile associated with said dynamic profile, associating the dynamic profile with one of the static profiles based on the operating environment of the interface, and automatically updating the association upon identifying a change in the operating environment. An apparatus is also disclosed.

Dynamic policy based interface configuration for virtualized environments

In one embodiment, an apparatus includes a port profile manager for receiving a port configuration policy and creating a port profile for the port configuration policy. The apparatus further includes a management interface for transmitting the port profile to a management station operable to receive input mapping the port profile to one or more interfaces associated with virtual machines. The port profile manager receives and stores the mapping input at the management station, for use in configuring the interfaces according to the port configuration policy. A method for policy based configuration of interfaces in a virtual machine environment is also disclosed.

Policy based configuration of interfaces in a virtual machine environment

Described herein are techniques for preventing MAC address spoofs in a virtualization cluster. When a virtual switch first sees a new MAC address on a port designated as being a secure port, the packet is redirected to a virtual supervisor agent used to manage the distributed virtual switch. Assuming the MAC may be bound to the secure port, the supervisor agent broadcasts a message to both the virtual switch that redirected the packet and to virtual switches on other virtualization servers within the cluster.

Preventing MAC spoofs in a distributed virtual switch

A method and system to exchange information between computer applications are provided. The system may include a source operating system, a destination operating system and an offload stack, all residing on the device. The source operating system and the destination operating system appear to users as distinct network entities. The offload stack may be configured to function as an intermediate network device for the source operating system. The offload stack, in one embodiment, comprises a back end to receive a message from the source operating system to the destination operating system, an analyzer to determine that the destination operating system resides on the device and a cut though socket module to process the message such that a network layer of the offload stack is bypassed.

Method and system to transfer data utilizing cut-through sockets

Methods and apparatus for transferring data from an application server are provided. By offloading network and file system stacks to a common stack accessible by multiple operating systems in a virtual computing system, embodiments of the present invention may achieve data transfer support for web and application servers without the data needing to be copied to or reside in the address space of the server operating systems.

Zero-copy network and file offload for web and application servers

In one embodiment, an apparatus includes a port channel manager for receiving information identifying switches connected to a group of physical ports at a network device and creating subgroups each comprising the physical ports connected to one of the switches. The apparatus further includes a virtual interface agent for assigning a virtual interface connecting a virtual switch to a virtual machine, to one of the subgroups. Traffic received from the virtual machine on the virtual interface is transmitted to one of the switches on one of the physical ports in the assigned subgroup. A method for grouping ports for association with virtual interfaces is also disclosed.

Port grouping for association with virtual interfaces

A method, system, apparatus, and signal-bearing media for provided discovering a target device via one port of a plurality of virtual ports, creating a target data structure associated with the target device, and allocating a second port of the plurality of virtual ports to a host if the second port is available. In an embodiment, an initiator identifier for the host may be created based on a port number of the second port and a media access control address and sent to the target device to identify the host.

Transparent mode

In one embodiment, an apparatus includes a processor configured for operation in a control plane in a distributed virtual switch in communication with a plurality of virtual machines each having a virtual interface. The processor is operable to identify other control planes in the distributed virtual switch, assign a virtual interface identifier to one of the virtual interfaces, receive a configuration for the virtual interface, and share the configuration with the other control planes in the distributed virtual switch. The virtual interface identifier provides a unique identifier for the virtual interface across all of the control planes. The apparatus further includes memory for storing the configuration of the virtual interface. A method for operating a network device associated with a control in the distributed virtual switch is also disclosed.

Distributed data center access switch

Growing community of inventors

Maple Grove, MN, United States of America

Mark Alan Bakke