Vmware, Inc.

Symantec Corporation

Prahalad Gowardhan Deshpande

Ambarish Prashant Pande

Abhijit Sharma

Avinash Nigam

Amol Manohar Vaikar

Atul Jadhav

Shashank Ranjan

Vishal Ranjan

Devraj Narendra Baheti

Nikhil Bhalerao

Sumesh Jaiswal

Ravi Singhal

Amarjit Gupta

Madan Singhal

Somil Bhandari

Shubhrajyoti Mohapatra

Pratiksha Ishwarlal Gugale

Embodiments described herein generally involve identifying workloads in a multi-site networking environment. Embodiments include determining that a given network is stretched across a first network segment at a first site and a second network segment at a second site. Embodiments include creating a stretched administrative domain for the given network and mapping an address of the given network to the stretched administrative domain in a lookup table for an administrative domain associated with the first network segment. Embodiments include receiving a flow record from an observation point in the first network segment, the flow record having a source IP address associated with the second network segment and a destination IP address associated with the first network segment. Embodiments include identifying a source workload and destination workload of the flow record using the lookup table and a workload identification table that maps combinations of IP addresses and administrative domains to workloads.

Workload identification for network flows over stretched layer 2 networks

Some embodiments provide a method for evaluating locations of applications in a multi-cloud network with applications located in different cloud datacenters of one or more cloud providers. The method receives data for flows collected from the cloud datacenters. The data for each flow indicates a source and destination of the flow and applications to which at least one of the source and destination of the flow belong. The method uses network topology data to identify a subset of the flows as egress flows, each of which is charged by a cloud provider at which the flow source is located. Based on data from the cloud providers, the method determines a cost for each of the egress flows and a cost associated with each of the applications. The method provides these costs to users of the network for the users to optimize locations of the applications in the different cloud datacenters.

Egress cost optimization for multi-cloud network

An example method of identifying a hybrid connection associated with a network flow in a multi-cloud computing system includes: obtaining, by a network analyzer, network information from a plurality of data centers in the multi-cloud computing system, the plurality of data centers corresponding to a respective plurality of namespaces; identifying Internet Protocol (IP) subnetworks associated with the hybrid connection from the network information; generating connection indexes for the namespaces relating source IP subnetworks of the IP subnetworks, destination IP subnetworks of the IP subnetworks, and an identifier for the hybrid connection; searching a source IP address and a destination IP address of a flow record for the network flow in the connection indexes to obtain the identifier for the hybrid connection; and tagging the flow record with the identifier for the hybrid connection.

Identifying hybrid connectivity for traffic flows in a multi-cloud environment

A system and method for data route discovery through cross-connection tunnels uses routing configurations from a local edge router in a private cloud that include learnt and advertised subnets, as well as cross-connection tunnels for the learnt and advertised subnets, to populate a public cloud table of public cloud learnt subnets and a public cloud table of public cloud advertised subnets. The public cloud tables of public cloud learnt subnets and public cloud advertised subnets are applied to discover data routes through the cross-connection tunnels of the hybrid cloud environment.

System and method for data route discovery through cross-connection tunnels

The present disclosure provides an approach for generating one or more firewall rules to regulate communication between containerized services running within containers. The approach includes determining which services communicate with each other, independently of in which containers the services execute. The determining occurs over a period of time. If two services communicated with each other during the period of time, then the firewall allows the services to continue communicating, but only over the same ports as used during the period of time. If two services did not communicate during the period of time, then the firewall does not allow the services to communicate after the expiration of the period of time. In some embodiments, redetermining the communication flow over a new period of time may occur after the initial period of time so as to refresh the firewall rules.

Recommending network NANO-segmentation for micro-services using flow analysis

The disclosure provides an approach for service deployment. Embodiments include receiving an indication of user intent for deployment of one or more services in a network from a user that is not an administrator of the network, wherein the indication of the user intent comprises a domain specific language (DSL). Embodiments include parsing the indication of the user intent to determine one or more constraints for deploying the one or more services. Embodiments include receiving topology information for the network, wherein the topology information comprises associations between racks and machines in the network. Embodiments include receiving network performance information for the network. Embodiments include determining one or more deployment rules for the one or more services based on the one or more constraints, the topology information, and the network performance information. Embodiments include deploying the one or more services in the network based on the one or more deployment rules.

Rack-aware and network performance-aware service deployment

A system and method for topology construction in hybrid cloud environments includes receiving connection information from a local perimeter edge router of a local network that has a known topology and receiving connection information from a remote perimeter edge router of a remote network that is provided by a cloud provider. The received local perimeter edge router connection information is associated with the received remote perimeter edge router connection information. The associated connection information is normalized to a generic model, the generic model representing connections having different link layer policies in a generic way and the normalized connection information is applied to a network topology of the local network and the remote network.

System and method for topology construction in hybrid cloud environments

The present disclosure provides an approach for creating one or more firewall rules to regulate communication between containers. The approach includes calculating a trust score for each container. To generate a rule for any two containers, a difference between the trust scores is computed, and if the difference in trust levels is too large, then the more trustworthy container is not allowed to communicate with the less trustworthy container. If the difference in trust scores is not too large, then the trustworthy container is allowed to communicate with the other trustworthy container, or an untrustworthy container is allowed to communicate with another untrustworthy container.

Security context aware nano-segmentation for container based microservices

A computer-implemented method for providing targeted data loss prevention on unmanaged computing devices may include (1) identifying a data loss prevention policy that defines permissible data handling within set bounds to prevent unauthorized data exfiltration from the set bounds, (2) identifying an application to install on at least one unmanaged endpoint device, where (i) the unmanaged endpoint device lacks a data loss prevention agent configured to apply the data loss prevention policy to the entire unmanaged endpoint device and (ii) the application is to be provided to the unmanaged endpoint device to operate on sensitive data from within the set bounds, and (3) wrapping the application in an application wrapper that intercepts system calls from the application and applies the data loss prevention policy to sensitive data implicated in the system calls. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Dharwad, India

Prahalad Gowardhan Deshpande