Cisco Technology, Inc.

Cohesity, Inc.

Juniper Networks, Inc.

Pensando Systems Inc.

Ravi Kumar Gadde

Mohit Aron

Vinay Reddy

Vipin Jain

Enrico Schiattarella

Xin Ru Wang

James P Rivers

Nischal Sheth

Sankar Ramamoorthi

Xin Wang

Chaitanya Kodeboyina

Satyadeva Konduru

Umesh Mangla

Sukhesh Halemane

Palathingal Frank

Ravishankar Ganesh Ithal

Cesare Cantù

Sunil Patro

Techniques are disclosed for allocating shared resources to nodes in a distributed computing network system. Nodes request a lock for each instance of a computing resource (e.g., a virtual IP address associated with a service provided by the distributed computing network system) from a distributed lock manager. The distributed lock manager maintains a queue of requests for each instance of the shared resource. Upon receiving a lock from the distributed lock manager, the receiving node performs a fairness allocation protocol to determine whether to accept the lock. If so determined, the shared computing resources associated with the lock is configured.

Distributed fair allocation of shared resources to constituents of a cluster

Methods and network interface devices for establishing a secure and authenticated network connection are provided. The method comprises: receiving, from a requesting entity, a destination IP address and a first certificate that is used to establish a secure network connection, wherein the first certificate comprises a first security attribute that is associated with a source destination IP address; identifying, with aid of one or more processors, a stored second security attribute associated with the destination IP address; and determining, with aid of the one or more processors, a policy action based at least in part on the first security attribute and the second security attribute.

Methods and systems for cryptographic identity based network microsegmentation

A lock associated with a computing resource is received. It is determined whether to accept the lock based on a fairness allocation protocol. The lock is accepted based on a determination of the fairness allocation protocol.

An authorization method using provisioned certificates is disclosed. The method includes writing security attributes to fields within a certificate and issuing the certificate to a software application on a principal node. The software application requests to perform actions on one or more resources on a resource node, sending one or more action requests along with a copy of its certificate. The resource node has an agent which verifies the permissions from the certificate and routes the request to its designated resource. The resource node returns one or more messages to the principal node, verifying whether or not complete the requests.

Authorization with a preloaded certificate

Methods and apparatus are disclosed for applying network policy to communications originating at operating system virtual interfaces. In an example embodiment, a network device is networked with a switch. The network device may include a first operating system interface, a virtualization adapter, and an input output port. In an example embodiment, the virtualization adapter receives a first frame from the first operating system interface. The virtualization adapter may tag the first frame to indicate an association between the first frame and the first operating system interface. The first frame may then be transmitted with a second frame being associated with a second operating system interface, to the switch via the input output port. In an example embodiment, the switch is configured to receive the frame, examine a tag and then to enforce a network policy upon the first frame, based on the tag.

Apparatus and method for applying network policy at virtual interfaces

Techniques are described for providing encryption and authentication for different types of routing protocol communications based on a variety of factors. A method comprises configuring, on a network router, a set of logical interfaces for communicating routing protocol messages with one or more peer routing devices, maintaining a set of security associations that define corresponding authentication information and encryption information for the routing protocol messages, and maintaining one or more descriptor sets that each specify a set of criteria, wherein, for at least one of the descriptor sets, the set of criteria specifies one of the logical interfaces of the network router. The method further comprises selecting one of the descriptor sets having criteria that match an individual flow, selecting one of the security associations based on the selected descriptor set, and applying the selected security association to secure the outbound flow of the routing protocol messages.

Authentication and encryption of routing protocol traffic

A method and network device (e.g., a switch) is described for assigning virtual Ethernet bindings. The method may comprise accessing the network device to obtain information related to hardware (e.g., switching hardware) of the network device. Thereafter, an uplink binding from a plurality of physical uplinks is selected based on the information. A virtual network interface of a virtual machine is then mapped to the selected uplink binding.

System and method for virtual Ethernet interface binding

By using an extended bitmap window and arrival sequence numbers, a multiprocessor system may perform anti-replay checks on incoming packets in a similar order as a single processor system. In one implementation, a device may provide an anti-replay check window that includes an original window and an extension window, the original window being contiguous to the extension window. In addition, the device may receive a packet with an anti-replay sequence number and receive another packet whose anti-replay sequence number is within a range of the original window. In addition, the device may determine if the packet has arrived before the other packet by less than a threshold if the anti-replay sequence number of the packet falls within a range of the extension window. Further, the device may retain the packet if the packet has arrived before the other packet by less than the threshold.

Heuristic IPSec anti-replay check

A process for managing encrypted group communication according to a single security association (SA) for network traffic from a sender includes receiving a request for an encrypted communication among a plurality of network devices. A common decryption key and a common security parameters index (SPI) are provided to each of the network devices participating in the communication. The common security parameters index facilitates locating, in respective databases associated with each of the network devices, security association information that is associated with the common security association. Information is encrypted based on the common security association, and unicasted to each of the network devices. In an embodiment, the common security parameters index provided to each network device is established by the sender. For example, the SPI is established by a conference server and sent to each device participating in a voice conference.

Growing community of inventors

San Jose, CA, United States of America

Ravi Kumar Gadde