Vmware, Inc.

Facebook, Inc.

Matthew Page

Apostolos Lerios

Jason Ansel Lango

Jack William Lindamood

Peter Avelino Ruibal

Marcel Moolenaar

Vinay Wagh

Ramya Olichandran

Rohan Desai

Antoine Pourchet

Grant Callaghan

Douglas John Beaver

Gary Menezes

A tag-based policy architecture enforces information technology (IT) policy in a virtualized computing environment using cryptographically-verifiable metadata to authenticate compute resources coupled to a computer network and to authorize access to protected resources of the network. The compute resources are illustratively virtual machine instances (VMIs) provided by a virtual data center (VDC) of the environment, whereas the protected resources are illustratively virtualized storage, network and/or other compute resources of the VDC. Each VMI includes an intermediary manager, e.g., metavisor. The tag-based policy architecture includes an infrastructure having a centralized policy decision end point (e.g., a control plane of the VDC) and distributed policy enforcement endpoints (e.g., metavisors of the VMIs) to provide end-to-end passing of the cryptographically-verifiable metadata to (i) authorize instantiation of the VMIs at the control plane, and (ii) enforce access to the virtualized resources at the metavisors.

Tag-based policy architecture

A tag-based policy architecture enforces information technology (IT) policy in a virtualized computing environment using cryptographically-verifiable metadata to authenticate compute resources coupled to a computer network and to authorize access to protected resources of the network. The compute resources are illustratively virtual machine instances (VMIs) provided by a virtual data center (VDC) of the environment, whereas the protected resources are illustratively virtualized storage, network and/or other compute resources of the VDC. Each VMI includes an intermediary manager, e.g., metavisor. The tag-based policy architecture includes an infrastructure having a centralized policy decision end point (e.g., a control plane of the VDC) and distributed policy enforcement endpoints (e.g., metavisors of the VMIs) to provide end-to-end passing of the cryptographically-verifiable metadata to (i) authorize instantiation of the VM is at the control plane, and (ii) enforce access to the virtualized resources at the metavisors.

In one embodiment, a first computing device receives a write request and data from a second computing device; iteratively attempts to write the data until a copy of the data is successfully written to each and every storage node belonging to a storage volume; and transmits a volume identifier of the storage volume and a data identifier assigned to the data to the second computing device. In one embodiment, a first computing device receives a read request and a volume identifier and a data identifier from a second computing device; accesses a cache to select the storage volume identified by the volume identifier; iteratively attempts to read data identified by the data identifier until a copy of the data is successfully read from a storage node belonging to the selected storage volume; and transmits the copy of the data to the second computing device.

Distributed storage system

Growing community of inventors

Mountain View, CA, United States of America

Matthew Page