Microsoft Technology Licensing, LLC

Oracle International Corporation

Qiang Wang

Kent Lee

David Matthew Kruse

Mark Fishel Novak

Anders Bertil Vinberg

Niels Thomas Ferguson

Nir Ben-Zvi

Christopher Warner McCarron

Samartha Chandrashekar

Yevgeniy Anatolievich Samsonov

Amitabh Prakash Tamhane

Andrew J Wallace

Samuel Neely

John Anthony Messec

Neil K Koorland

Vivek Sharma

Min Wei

Kinshumann

Max Glenn Morris

Deepak Agarwal

Kinshuman Kinshumann

Jin Lin

Travis Portz

Michael Bishop Ebersol

Jingbo Wu

Simon P Atwell

Bruce A McMillan

Simon P Attwell

David Kimler Altobelli

Saeed Noursalehi

Haining Mo

Erik Hedberg

Christopher Mccarron

Liyong Chen

The disclosed systems, methods and computer readable media relate to managing Non-Volatile Memory Express (NVMe) over Transmission Control Protocol (TCP) (NVMeOTCP) connections between a smart network interface card (smartNIC) and a block storage data plane (BSDP) of a cloud computing environment. A software agent ('agent') executing at the smartNIC may manage a number of network paths (active and, in some cases, passive network paths). The agent may monitor the network traffic (e.g., input/output operations (IOPS)) through the paths (e.g., using established NVMeOTCP connections corresponding to the paths). If a condition is met relating to a performance threshold associated with the monitored paths, the agent may increase or decrease the number established NVMeOTCP connections to match real time network conditions.

Load-based management for NVME over TCP connections

The techniques disclosed herein enable a system to configure a confidential virtual resource unit by provisioning a security component to a tenant's virtual resource unit. The system creates multiple different virtual trust layers within the confidential virtual resource unit. This creation effectively defines security boundaries between the virtual trust layers. The virtual trust layers are associated with different privileges, such that a higher privileged virtual trust layer is provided with more privileges compared to a lower privileged virtual trust layer. In one example, a lower privileged virtual trust layer may include basic virtual resource components (e.g., drivers, applications, processes, functions, workloads executing within a guest operating system) and a higher privileged virtual trust layer is the location to which a virtual security component is provisioned by the system.

Provisioning a security component from a cloud host to a guest virtual resource unit

A smart network interface card (smartNIC) may receive first traffic for a first process configured with a first bandwidth limit. The smartNIC may receive second traffic for a second process configured with a second bandwidth limit, the second bandwidth limit corresponding to a larger value between a second transmit limit and a second receive limit associated with the second process. The smartNIC may queue the received traffic associated with the first process and the second process in a scheduler, the scheduler having a first set of queues configured to store traffic from the first process, and a second set of queues configured to store traffic from the second process. The smartNIC may forward queued traffic from the first set of queues or the second set of queues, a maximum amount of forwarded first process traffic corresponding to the first bandwidth limit minus an amount of forwarded second process traffic.

Bandwidth control inside a shared network interface card

The disclosed systems, methods, and computer readable media relate to managing persistent memory within a smart network interface card (smartNIC) of a cloud-computing environment, or at storage device of the host instance on which the smartNIC operates and to which the smartNIC has access. The smartNIC may be configured with various modes that enable passthrough of input/output operations to or from non-volatile remote storage (e.g., a block storage data plane volume) or storage of at least some of the data corresponding to the input/output operations within the persistent memory managed by the smartNIC. The smartNIC may be configured to select a storage location for data between a pool of candidate storage including the persistent storage managed by the smartNIC or the non-volatile remote storage. These techniques improve communications between the smartNIC and the non-volatile remote storage and reduce the risk of network jitters and overall network latency.

Persistent memory based caching for intelligent network interface cards

The present embodiments relate to throttling input/output (IO) processing tasks at a centralized node (e.g., a SmartNIC device) and implement multiple routing paths to prevent performance degradation in handling data patterns. For instance, the centralized node can implement a throttling system to assign portions of a number of input/output operations to be performed to a series of extent servers in a cloud infrastructure environment. The present embodiments also can implement multiple paths and/or multiple path groups to route the assigned portions of the I/O operations. For instance, the assigned portions of I/O operations can be routed to the extent servers via a first path of multiple paths. In the event of a failure of the first path, the assigned portions of I/O operations can be re-directed to a second path or another path in the path group.

Increased data processing performance of a non-volatile memory express (NVME) block store

A virtual secure mode is enabled for a virtual machine operating in a computing environment that is associated with a plurality of different trust levels. First, a virtual secure mode image is loaded into one or more memory pages of a virtual memory space of the virtual machine. Then, the one or more memory pages of the virtual memory space are made inaccessible to one or more trust levels having a relatively lower trust level than a launching trust level that is used by a virtual secure mode loader to load the virtual secure mode image. A target virtual trust level is also enabled on a launching virtual processor for the virtual machine that is higher than the launching trust level.

Secure management of operations on protected virtual machines

Deploying an encrypted entity on a trusted entity is illustrated herein. A method includes, at a trusted entity, wherein the trusted entity is trusted by an authority as a result of providing a verifiable indication of certain characteristics of the trusted entity meeting certain requirements, receiving an encrypted entity from an untrusted entity. The untrusted entity is not trusted by the authority. At the trusted entity, a trust credential from the authority is used to obtain a key from a key distribution service. The key distribution service is trusted by the authority. The key is used to decrypt the encrypted entity to allow the encrypted entity to be deployed at the trusted entity.

The present invention extends to methods, systems, and computer program products for securely and efficiently extending data processing pipeline functionality. Data processing agents register, potentially based solely on configuration data contained in the data processing agents, to manipulate data of a data processing pipeline. Configuration data can identify a specified event (e.g., an SMTP verb) the data processing agent is to hook into. Upon detection of a specified event, one or more agents that have registered for the specified event are loaded into secure zones. Process boundaries separate agents from one another and from other processes such that execution of each agent is isolated from other processes. Pipeline related data (e.g., electronic message data) is transferred to each loaded agent. Application Program Interfaces ('APIs') can be used to transfer data between modules that implement embodiments of the present invention.

Securely and efficiently extending data processing pipeline functionality

Securely extending data processing pipeline functionality

A method that enables multiple spam detection solutions to be deployed in a manageable and rational manner to determine if a message is spam is presented. A framework invokes anti-spam filters to analyze the message and return confidence levels of whether a message is spam. The framework evaluates the highest confidence level against a set of defined thresholds. If the highest confidence level is greater than the highest threshold set by the administrator, the action specified for the highest threshold is taken. The highest confidence level is also compared against all thresholds and the action associated with the nearest threshold that has been exceeded is taken.

Framework to enable integration of anti-spam technologies

A method that determines if a sender's message is to be sent to a recipient is presented. A challenge module analyzes the message and sends a challenge message to the sender if the sender is not in the recipient's address store. The challenge message includes a pseudo unique token for the sender recipient pair such that the sender must respond differently to each challenge message for a particular message. In one embodiment, the challenge message requires the sender to obtain a certificate from a certificate authority or a set of authorities.

Challenge response messaging solution

A method that enables multiple spam detection solutions to be deployed in a manageable and rational manner to determine if a message is spam is presented. A framework invokes one or more anti-spam filters to analyze the message and return a confidence level of whether a message is spam and that confidence level is added to a summary of confidence levels. The framework evaluates a summary of confidence levels against a set of defined thresholds. If the summary of confidence levels is greater than the highest threshold set by the administrator, the action specified for the highest threshold is taken. Otherwise, subsequent filters are used to evaluate the message until either the maximum threshold is exceeded or all filters have evaluated the message. After all filters have evaluated the message, the summary of confidence levels is compared against all thresholds and the action associated with that matching threshold is taken.

Growing community of inventors

Redmond, WA, United States of America

Qiang Wang