International Business Machines Corporation

Sivaram Gottimukkala

Lap Thiet Huynh

Dinakaran B Joseph

Jason P Hawrysz

Wesley McMillan Devine

Linwood Hugh Overby, Jr

Barry Mosakowski

Jon K Franks

Michael S Law

John Majikes

Christopher N Freeman

Dinesh C Verma

Sambit Sahu

Gerd Breiter

Roberto Delima

Einar Lueck

Michael Man Behrendt

Debanjan Saha

Michael E Baskey

Mandis S Beigi

Roger A Bess

Dakshi Agrawal

Douglas Morgan Freimuth

Hugh Edward Hockett

Rohith Kottamangalam Ashok

Roy Frank Brabson

Linwood H Overby, Jr

David P Olshefski

Michael John Burr

Kristin R Whetstone

Dinakaran D Joseph

Wesley Mcmillan Devine

Jr Overby

A method for secure live migration of a virtual machine (VM) in a virtualized computing environment can include selecting a VM in a secure virtualized computing environment for live migration to a different virtualized computing environment and blocking data communications with the selected VM and other VMs in the secure virtualized computing environment. The selected VM can be live migrated to the different virtualized computing environment and the VM can be restarted in the different virtualized computing environment. Notably, a secure communicative link can be established between the restarted VM and at least one other of the VMs in the secure virtualized computing environment. Finally, data communications between the restarted VM and the at least one other of the VMs can be enabled over the secure communicative link.

Securing live migration of a virtual machine including blocking communication with other virtual machines

Embodiments of the present invention address deficiencies of the art in respect to connectivity management in a heterogeneous network and provide a method, system and computer program product for resilient and reliable end-to-end connectivity in a heterogeneous network. In one embodiment of the invention, a method for resilient and reliable end-to-end connectivity in a heterogeneous network environment can be provided. The method can include creating an instance of an abstracted network resource model (NRM) for a heterogeneous network environment of different network resource nodes. The method further can include binding an application endpoint in the instance of the abstracted NRM with a connectivity endpoint for a first of the different network resource nodes. The method yet further can include detecting an outage in the first of the different network resource nodes. Finally, the method can include re-binding the application endpoint to a second of the different network resource nodes in response to detecting the outage.

Reliable and resilient end-to-end connectivity for heterogeneous networks

Embodiments of the present invention address deficiencies of the art in respect to connectivity management in a heterogeneous network and provide a method, system and computer program product for resilient and reliable end-to-end connectivity in a heterogeneous network. In one embodiment of the invention, a method for resilient and reliable end-to-end connectivity in a heterogeneous network environment can be provided. The method can include creating an instance of an abstracted network resource model (NRM) for a heterogeneous network environment of different network resource nodes. The method further can include binding an application endpoint in the instance of the abstracted NRM with a connectivity endpoint for a first of the different network resource nodes. Finally, the method can include re-binding the application endpoint to a second of the different network resource nodes in response to detecting the outage.

In an embodiment of the invention, a method for secure live migration of a virtual machine (VM) in a virtualized computing environment can include selecting a VM in a secure virtualized computing environment for live migration to a different virtualized computing environment and blocking data communications with the selected VM and other VMs in the secure virtualized computing environment. The selected VM can be live migrated to the different virtualized computing environment and the VM can be restarted in the different virtualized computing environment. Notably, a secure communicative link can be established between the restarted VM and at least one other of the VMs in the secure virtualized computing environment. Finally, data communications between the restarted VM and the at least one other of the VMs can be enabled over the secure communicative link.

Securing live migration of a virtual machine from a secure virtualized computing environment, over an unsecured network, to a different virtualized computing environment

A method, system and computer program product for determining a relative priority for a job. A 'policy' is selected based on the job itself and the reason that the job is being executed, where the policy includes a priority range for the job and for an application. A priority for the job that is within the priority range of the job as established by the selected policy is determined based on environmental and context considerations. This job priority is then adjusted based on the priority of the application (within the priority range as established by the policy) becoming the job's final priority. By formulating a priority that more accurately reflects the true priority or importance of the job by taking into consideration the environmental and context considerations, job managers will now be able to process these jobs in a more efficient manner.

Determining a relative priority for a job using context and environmental considerations

A computer-implemented method of enabling security in network resources provisioned as part of a service landscape instance is provided. The method includes initiating an orchestration process for creating a landscape service instance to provide services to a service subscriber over a data communications network. The method further includes deriving from the orchestration process at least one parameter, and generating at least one security configuration profile based upon the at least one parameter for at least one system of the landscape service instance.

Method of automating and personalizing systems to satisfy security requirements in an end-to-end service landscape

A computer-implemented method is provided for updating network security policy rules when network resources are provisioned in a service landscape instance. The method includes categorizing network resources in a service landscape instance based on a service landscape model. The method further includes responding to the provisioning of a network resource by automatically generating one or more security policy rules for a newly-provisioned network resource. Additionally, the method includes updating security policy rules of pre-existing network resources in the service landscape instance that are determined to be eligible to communicate with the newly-provisioned network resource so as to include the newly-provisioned network resource as a remote resource based on the service landscape model.

Method of dynamically updating network security policy rules when new network resources are provisioned in a service landscape

Embodiments of the present invention address deficiencies of the art in respect to e2e SLA support in a network of both manageable and unmanageable portions and provide a method, system and computer program product for e2e SLA compliance across both managed and unmanaged network segments. In one embodiment of the invention, a method for e2e SLA compliance across both managed and unmanaged network segments can be provided. The method can include identifying both a managed segment and an unmanaged segment of an e2e network for a communications path implicated by an SLA, determining an observed delay for the unmanaged segment of the e2e network, computing from a desired delay for the communications path and the observed delay a differential delay, and constraining the managed segment to meet the differential delay in order to assure meeting the desired delay for the communications path implicated by the SLA.

End-to-end (E2E) service level agreement (SLA) compliance across both managed and unmanaged network segments

End-to-end (e2e) service level agreement (SLA) compliance across both managed and unmanaged network segments

Techniques are disclosed that enable an application to prioritize its traffic in an application-specific manner, such that traffic which is most important to this application can be prioritized over traffic that is less important to this application, where this prioritization information is reflected in differential treatment of the traffic within the network. An application conveys relative priority information for its traffic to a Web proxy or edge server, and this device then consults stored policy information to determine how the traffic should be prioritized in the network. The Web proxy also ensures that usage of network resources is balanced among multiple applications. Cookies are used for transmitting priority information between the edge server and application in an efficient manner.

Application prioritization in a stateless protocol

A fast policy classification method and system. A policy differentiator can be provided which can include a policy repository configured to store hierarchical policy classification trees. The policy differentiator further can include a hashing module configured to produce integer values for string based selector attributes. In one aspect of the invention, the hashing module can include a longest string hashing function. A policy matching engine can be provided which is configured to locate policy rules in the hierarchical policy classification trees according to the integer values produced for the string based selector attributes. Finally, a policy matching engine interface can be provided through which policy queries and resulting policy decisions of the policy matching engine can be communicated between the policy matching engine and the policy enforcement entity.

Fast policy classification for strings

Growing community of inventors

Morrisville, NC, United States of America

Sivaram Gottimukkala