Cisco Technology, Inc.

Storage Technology Corporation

International Business Machines Corporation

Timothy J Kuik

Mark Alan Bakke

David P Thompson

Stephen P De Groote

Clayton Stuart Haapala

Craig A Johnson

Paul Harry Gleichauf

Xiaoxue Ma

Kyle Andrew Donald Mestery

Yi Yang

Yibin Yang

Udayakumar Srinivasan

Saravanakumar Rajendran

James D Muchow

Renae M Weber

Nadathur Srinivasan Sundar

Hemanth Basappa Mallikarjunaswamy

Sumit Kala

Behzad R Dastur

Michael R Smith

Murali Basavaiah

Anand Girish Parthasarathy

Anuraag Mittal

Anusankar Elangovan

Flavio Fernandes

Hank R Gibson

Stephen DeGroote

Dave Thompson

Robert G Lane

Anthony W Steere, Jr

David Thompson

Udayakamar Srinivasan

Stephen Degroote

This disclosure describes techniques for providing virtual resources (e.g., containers, virtual machines, etc.) of a clustered application with information regarding a cluster of physical servers on which the distributed clustered application is running. A virtual resource that supports the clustered application is executed on a physical server of the cluster of physical servers. The virtual resource may receive an indication of a database instance (or other application) running on a particular physical server of the cluster of physical servers that is nearest the physical server. The database instance may be included in a group of database instances that are maintaining a common data set on respective physical servers of the group of physical servers. The virtual resource may then access the database instance on the particular physical server based at least in part on the database instance running on the particular server that is nearest the physical server.

Optimizing clustered applications in a clustered infrastructure

A first security policy associated with a first tenant in a multi-tenant hosting data processing environment is created. A first virtual machine is caused to execute on a first host, the first virtual machine associated with a first group defined by the first security policy. A controller is caused to send, from the controller to an agent executing on the first host, authorized communication information, the authorized communication information specifying a set of virtual machines associated with the first group. The agent is caused to configure a second routing entry in the first host, the second routing entry derived from the authorized communication information, the second routing entry causing the first virtual machine to reject outgoing network traffic intended for a second IP address, the second IP address associated with a third virtual machine outside the first group.

Routing level access control for tenant virtual machines in a cloud networking environment

A first encryption key associated with a first tenant is created. The first encryption key is configured in a host where a virtual machine associated with the first tenant is executing, the host including a network interface controller configured to have a virtual network interface function, the virtual network interface function executing on the host and being associated with the virtual machine of the first tenant. The virtual network interface function is caused to bind the first encryption key to the virtual machine of the first tenant. The virtual network interface function is caused to encrypt outgoing network traffic of the first tenant using the first encryption key. The virtual network interface function is caused to decrypt incoming network traffic for the first tenant using the first encryption key.

Secure communications among tenant virtual machines in a cloud networking environment

The subject technology addresses the need in the art for improving intra-cloud migration of virtual machines in a cloud computing environment. A hash database may be prepopulated with key-value pairs corresponding to hash IDs and associated data chunks of a virtual machine image. In this regard, the virtual machine image may be divided into chunks using boundaries chosen by a Rabin fingerprinting technique. A hash (e.g., MD5 or SHA-1) may be computed over each chunk and act as a unique identifier for the data contained in each chunk. At appropriate times, one or more hash IDs are sent instead of the actual data chunks between clouds when performing the inter-cloud migration of a virtual machine.

Data suppression for faster migration

At a network element having a plurality of physical links configured to communicate traffic over a network to or from the network element, an uplink group is formed comprising the plurality of physical links, wherein the plurality of physical links comprise a first physical link and a second physical link. A plurality of classes of service are defined comprising a first class of service and a second class of service, wherein the first class of service and second class of service have bandwidth allocations on the first physical link. Traffic congestion is detected on the first physical link that exceeds a predetermined threshold for the first class of service. Traffic associated with one or more virtual machines associated with the first class of service on the first physical link is re-associated to the second physical link until the traffic congestion falls below the predetermined threshold.

Dynamic queuing and pinning to improve quality of service on uplinks in a virtualized environment

In one embodiment, an apparatus includes a port profile manager for receiving a port configuration policy and creating a port profile for the port configuration policy. The apparatus further includes a management interface for transmitting the port profile to a management station operable to receive input mapping the port profile to one or more interfaces associated with virtual machines. The port profile manager receives and stores the mapping input at the management station, for use in configuring the interfaces according to the port configuration policy. A method for policy based configuration of interfaces in a virtual machine environment is also disclosed.

Policy based configuration of interfaces in a virtual machine environment

A method and system to exchange information between computer applications are provided. The system may include a source operating system, a destination operating system and an offload stack, all residing on the device. The source operating system and the destination operating system appear to users as distinct network entities. The offload stack may be configured to function as an intermediate network device for the source operating system. The offload stack, in one embodiment, comprises a back end to receive a message from the source operating system to the destination operating system, an analyzer to determine that the destination operating system resides on the device and a cut though socket module to process the message such that a network layer of the offload stack is bypassed.

Method and system to transfer data utilizing cut-through sockets

Methods and apparatus for transferring data from an application server are provided. By offloading network and file system stacks to a common stack accessible by multiple operating systems in a virtual computing system, embodiments of the present invention may achieve data transfer support for web and application servers without the data needing to be copied to or reside in the address space of the server operating systems.

Zero-copy network and file offload for web and application servers

Techniques are provided for improve quality of service on uplinks in a virtualized environment. At a server apparatus having a plurality of physical links configured to communicate traffic over a network to or from the server apparatus, forming an uplink group comprising a plurality of physical links. A first class of service is defined that allocates a first share of available bandwidth on the uplink group, and a second class of service is defined that allocates a second share of available bandwidth on the uplink group. The bandwidth for the first class of service is allocated across the plurality of physical links of the uplink group, and the bandwidth for the second class of service is allocated across the plurality of physical links of the uplink group. Traffic rates are monitored on each of the plurality of physical links to determine if a physical link is congested indicating that a bandwidth deficit exists for a class of service. In response to determining that one of the plurality of physical links is congested, bandwidth is reallocated for a class of service to reduce the bandwidth deficit for a corresponding class of service.

A centralized control processor provides a unified management mechanism for multiple multicast switches or servers running virtual switches that is also capable of sending query messages based upon a subset of ports.

Central controller for coordinating multicast message transmissions in distributed virtual network switch environment

In one embodiment a method includes selectively controlling a virtual network switch to control a quality of service (QoS) for a flow associated with a virtual machine (VM). Controlling the QoS may include controlling the virtual switch to provide classification, congestion management, congestion avoidance, bandwidth limiting, traffic shaping, and/or priority manipulation. The method may also include migrating a policy associated with a virtual interface between the VM and the virtual switch from a first server to a second server when the VM is to be migrated from the first server to the second server. The migration may also include moving statistics associated with the policy. The method may include selectively adapting the policy or an existing policy on the receiving server when a discrepancy is detected between the policies. The method may include reserving resources to provide guaranteed minimum bandwidth, even without control of an ingress and egress queue.

Virtual switch quality of service for virtual machines

An apparatus for offloading network, block and file functions from an operating system comprises a network interface coupled to a network for receiving packet flows; one or more processors each having one or more processor cores; a computer-readable medium carrying one or more operating systems and an input/output networking stack which are hosted in one or more of the processor cores. The networking stack is shared among the operating systems. The networking stack comprises instructions which when executed cause receiving a request for data transfer from one of the operating systems at internal network, block and file system interfaces, and permitting data to be transferred between the internal interfaces and a plurality of external interfaces by preventing the operating systems from performing the data transfer and performing the data transfer on behalf of the operating systems.

Growing community of inventors

Lino Lake, MN, United States of America

Timothy J Kuik