Microsoft Technology Licensing, LLC

Samsung Electronics Co., Ltd.

Pano Logic, Inc.

Pankaj Garg

Jeffrey Kinsey

Aly E Orady

Nils Milton Bunger

Teju Khubchandani

Himadri Choudhury

Matthew B Debski

Dali Kilani

Praveen Balasubramanian

Stephen E Bensley

Alireza Dabagh

Andrew J Ritz

Albert Gordon Greenberg

Dustin Lyle Green

Eric P Traut

Sandeep Singhal

Daniel Max Firestone

Neel K Jain

Parag Chakraborty

Luis M Hernandez

Luis I Martinez Castillo

Jacob Kappeler Oshins

Benjamin M Schultz

Murari Sridharan

Bruce Lee Worthington

Shuvabrata Ganguly

Pankaj Shukla

Robert C Combs

Narasimhan Agrahara Venkataramaiah

Sambhrama Madhusudhan Mundkur

Yimin Deng

Benjamin A Leis

Madhan Sivakumar

Bryan William Tuttle

Yau Ning Chin

Yue Zuo

Nihar Niranjan Shah

Yu-Shun Wang

HoYuen Chau

Attilio Mainetti

Davor Bonaci

Hoyuen Chau

Kishore Gummadidala

Onur Feliz

Ramakanth Gunuganti

Meiying Li

Seyedeh Pardis Miri

Vinod K K L Swamy

Edward J Reed

Brian L Henry

Sandeep Kishan Singhal

In a network virtualization system, metadata is passed in an encapsulation header from one network virtualization edge to another network virtualization edge or to a service connected to a network virtualization edge. The metadata may carry packet processing instructions, diagnostic information, hop-specific information, or a packet identifier. Using the metadata information in the packet header, the datacenter network may provide services such as remote segmentation offload, small packet coalescing, transparent packet compression, and end-to-end packet tracing.

Enhanced network virtualization using metadata in encapsulation header

A cloud service provider's enterprise edge device and network interface are configured to establish a single tunnel connection with a remote server for delivering data packets to multiple distinct virtual machines on the remote server. The provider's enterprise edge device stores the network address information for each virtual machine and remote server to attach the destination network addresses to the data packet for transmission to the appropriate virtual machine on the remote server. Utilizing a single tunnel to transmit data packets to multiple virtual machines increases scalability at the provider's enterprise edge device and reduces system resources compared to other implementations in which the provider uses a tunnel for each virtual machine on a remote server.

Flexible unnumbered destination tunnels for virtual networks

Reliable address discovery cache techniques are described. In an implementation, a reliable communication channel is established for control messages related to address resolution in a network. The communication channel is employed for communication of messages for internet protocol (IP) address acquisition, release, and mapping staleness between clients (e.g., nodes or endpoints) in the network and a cache manager component configured to maintain and update an address map for the clients. The cache manager component may also be configured to send directed messages via the communication channel to propagate changes in the mapping to the clients. Further, clients may provide explicit notifications regarding address release and staleness to the cache manager component to facilitate updating of the address map. In this way, a reliable and up-to-date address map is maintained and the amount of broadcast discovery messages and bandwidth consumed overall for address discovery operations may be reduced.

Reliable address discovery cache

Multi-tenant network stack techniques are described. In an implementation, a host instantiates an instance of virtual machine that is configured to serve networks service to multiple tenants and corresponding virtual networks. To do so, a framing layer of the virtual machine may be configured to obtain configuration data indicative of topology for a multi-tenant virtual networking environment from a virtual switch of a host device. The framing layer uses the configuration data to construct routing compartments and interfaces as abstractions of each virtual network in accordance with the topology. The routing compartments are isolated from each other and provide a mechanism for applications to process network input/output (I/O) in the context of a specific tenant or virtual network. The single virtual machine is able to provide services and applications to serve multiple tenants that are independent of the underlying virtualization technology.

Multi-tenant network stack

An algorithm for dynamically adjusting the number of processors servicing Virtual Machine Queues (VMQ) and the mapping of the VMQ to the processors based on network load and processor usage in the system. The algorithm determines the total load on a processor and depending on whether the total load exceeds or falls below a threshold respectively, the algorithm moves at least one of the VMQs to a different processor based on certain criteria such as whether the destination processor is the home processor to the VMQ or whether it shares a common NUMA node with the VMQ. By doing so, better I/O throughput and lower power consumption can be achieved.

Dynamic processor mapping for virtual machine network traffic queues

A method to interact with a remote USB device is disclosed. An identifying message is received from a remote client associated with the remote USB device. The remote USB device is identified based at least in part on the identifying message from the remote client. A security policy is determined for the remote USB device. A policy message is transmitted to the remote client for selectively implementing the security policy of the remote USB device. A method to interact with a local USB device is disclosed. An identifying message is determined by performing a host controller service for the local USB device. The identifying message is transmitted to a server. A policy message is received from the server for selectively implementing a security policy on the local USB device. The security policy is regarded and configuring the host controller service.

Universal serial bus selective encryption

An extensible virtual switch allows virtual machines to communicate with one another and optionally with other physical devices via a network. The extensible virtual switch includes an extensibility protocol binding, allowing different extensions to be added to the extensible virtual switch. The extensible virtual switch also includes a miniport driver on which the extensions are loaded, tying the lifetimes of the extensions to the lifetime of the extensible virtual switch.

Virtual switch extensibility

The present invention extends to methods, systems, and computer program products for offloading packet processing for networking device virtualization. A host maintains rule set(s) for a virtual machine, and a physical network interface card (NIC) maintains flow table(s) for the virtual machine. The physical NIC receives and processes a network packet associated with the virtual machine. Processing the network packet includes the physical NIC comparing the network packet with the flow table(s) at the physical NIC. When the network packet matches with a flow in the flow table(s) at the physical NIC, the physical NIC performs an action on the network packet based on the matching flow. Alternatively, when the network packet does not match with a flow in the flow table(s) at the physical NIC, the physical NIC passes the network packet to the host partition for processing against the rule set(s).

Offloading packet processing for networking device virtualization

Techniques for efficient and secure implementation of network policies in a network interface controller (NIC) in a host computing device operating a virtualized computing environment. In some embodiments, the NIC may process and forward packets directly to their destinations, bypassing a parent partition of the host computing device. In particular, in some embodiments, the NIC may store network policy information to process and forward packets directly to a virtual machine (VM). If the NIC is unable to process a packet, then the NIC may forward the packet to the parent partition. In some embodiments, the NIC may use an encapsulation protocol to transmit address information in packet headers. In some embodiments, this address information may be communicated by the MC to the parent partition via a secure channel. The NIC may also obtain, and decrypt, encrypted addresses from the VMs for routing packets, bypassing the parent partition.

Secure and efficient offloading of network policies to network interface cards

A method to interact with a local USB device is disclosed. Messages are transmitted to a remote host controller driver from a host controller associated with the local USB device. Messages are received from the remote host controller driver for the host controller. In some embodiments, a transfer descriptor prototype is received from the remote host controller driver. A completed transfer descriptor is received from the remote host controller driver. The completed transfer descriptor and the transfer descriptor prototype are transformed into a modified transfer descriptor in part by using a collection of rules. The modified transfer descriptor is submitted to the local host controller without intervention from the remote host controller driver.

Universal serial bus host controller driver over a network

In computing environments having multiple computers, where such computers may comprise virtual machines, events are logged in association with corresponding activity identifiers. When a data packet associated with an activity is transferred to a destination machine, the activity identifier corresponding to the activity is transferred along with the data packet and used by the destination machine when logging its events. This allows events from the two machines to be correlated according to the activities to which they pertain.

Cross-machine event log correlation

Systems, methods, and computer storage media are described herein that configure a switch extension associated with a virtual switch with one or more settings. In response to the configuring, the systems, methods, and computer storage media persist the one or more settings and apply the persisted one or more settings to a target switch extension of a target virtual switch. The systems, methods, and computer storage media receive the settings through a management interface. Also, the systems, methods, and computer storage media receive requests for information associated with the switch extension and provide the switch extension information in response.

Unified policy management for extensible virtual switches

A method to interact with a local USB device is disclosed. A message is received from the local USB device. Predetermined information is extracted from a proper subset of the message. The extracted information is transmitted to a local process.

Universal serial bus assistance engine

Growing community of inventors

Bellevue, WA, United States of America

Pankaj Garg