Sun Microsystems, Inc.

Terraspring, Inc.

Oracle America, Inc.

Tom R Markson

Germano Caronni

Glenn Carter Scott

Amit Narayan Gupta

Christoph L Schuba

Sandeep Kumar

Ashar Aziz

Martin Patterson

Sandeep Kulmar

Mark Gray

Rich Skrenta

Methods and systems consistent with the present invention provide dynamic security policies that change the granularity of the security at the node level, process level, or socket level. Specifically, a channel number and virtual address are associated with various processes included in a process table. Since a security policy is required for all processes, secure and insecure processes located on the same channel may communicate with one another. Moreover, processes located on different channels may communicate with one another by a gateway that connects both channels. This scalable blanketing security approach provides an institutionalized method for securing any process, node or socket by providing a unique mechanism for policy enforcement at runtime or by changing the security policies.

System and method for enabling scalable security in a virtual private network

Methods and systems consistent with the present invention establish a virtual network on top of current IP network naming schemes. The virtual network uses a separate layer to create a modification to the IP packet format that is used to separate network behavior from addressing. As a result of the modification to the packet format, any type of delivery method may be assigned to any address or group of addresses. The virtual network also maintains secure communications between nodes, while providing the flexibility of assigning delivery methods independent of the delivery addresses.

System and method for separating addresses from the delivery scheme in a virtual private network

Methods and apparatus providing a dynamically sized, highly scalable and available server farm are disclosed. A Virtual Server Farm (VSF) is created out of a wide scale computing fabric ('Computing Grid') which is physically constructed once and then logically divided up into VSFs for various organizations on demand. Each organization retains independent administrative control of a VSF. A VSF is dynamically firewalled within the Computing Grid. Allocation and control of the elements and topology in the VSF is performed by a Control Plane connected to all computing, networking, and storage elements in the computing grid through special control ports. No physical rewiring is necessary in order to construct VSFs in many different configurations, including single-tier Web server or multi-tier Web-server, application server, database server configurations.

Extensible computing system

Methods and systems consistent with the present invention provide a Supernet, a private network constructed out of components from a public-network infrastructure. Supernet nodes can be located on virtually any device in the public network (e.g., the Internet), and both their communication and utilization of resources occur in a secure manner. As a result, the users of a Supernet benefit from their network infrastructure being maintained for them as part of the public-network infrastructure, while the level of security they receive is similar to that of a private network. The Supernet has an access control component and a key management component which are decoupled. The access control component implements an access control policy that determines which users are authorized to use the network, and the key management component implements the network's key management policies, which indicate when keys are generated and what encryption algorithm is used. Both access control and key management are separately configurable. Thus, the Supernet provides great flexibility by allowing different key management policies to be used with the same access control component.

Decoupling access control from key management in a network

Methods and systems consistent with the present invention provide a Supernet, a private network constructed out of components from a public-network infrastructure. The Supernet provides flexible and dynamic mobility support. When a destination node moves to a new location, it automatically updates the sending nodes with its new IP address. The destination node can choose among a number of ways to update the sending nodes, providing flexibility not found in conventional networks. Thus, a node can change locations repeatedly and continue to communicate directly with other nodes without the use of a proxy or other middleman.

Method and system for facilitating relocation of devices on a network

Methods and systems consistent with the present invention provide a Supernet, a private network constructed out of components from a public-network infrastructure. The Supernet provides channel-specific file system views such that the file system of the Supernet is partitioned on a per-channel basis so that nodes on one channel see a different view of the network file system than the nodes on a different channel.

Channel-specific file system views in a private network using a public-network infrastructure

Methods and systems consistent with the present invention provide a Supernet, a private network constructed out of components from a public-network infrastructure. Supernet nodes can be located on virtually any device in the public network (e.g., the Internet), and both their communication and utilization of resources occur in a secure manner. The Supernet also uses multicast communication to create Ethernet-like communication between its nodes. In using multicasting, each communication of each node on a channel in the private network is sent to a multicast address which sends it to all of the nodes on the channel. Sending a copy of every communication to all of the other nodes on the channel makes system tasks, like debugging, easy for the nodes on the channel. The multicasting provided by the private network is dynamic in that multicast addresses can be assigned for use by a channel and reclaimed so as to allow sharing of the multicast addresses.

Using multicasting to provide ethernet-like communication behavior to selected peers on a network

Methods and systems consistent with the present invention provide a Supernet, a private network constructed out of components from a public-network infrastructure. Supernet nodes can be located on virtually any device in the public network (e.g., the Internet), and both their communication and utilization of resources occur in a secure manner by providing for anonymous communications within the network through addressing. As a result, the users of a Supernet benefit from their network infrastructure being maintained for them as part of the public-network infrastructure, while the level of security they receive is similar to that of a private network. Additionally, the nodes of the Supernet are not geographically restricted in that they can be connected to the Supernet from virtually any portal to the Internet in the world.

Truly anonymous communications using supernets, with the provision of topology hiding

Methods and apparatus providing a dynamically sized, highly scalable and available server farm are disclosed. A Virtual Server Farm (VSF) is created out of a wide scale computing fabric (&ldquo;Computing Grid&rdquo;) which is physically constructed once and then logically divided up into VSFs for various organizations on demand. Each organization retains independent administrative control of a VSF. A VSF is dynamically firewalled within the Computing Grid. A allocation and control of the elements in the VSF is performed by a Control Plane connected to all computing, networking, and storage elements in the computing grid through special control ports. The internal topology of each VSF is under control of the Control Plane. No physical rewiring is necessary in order to construct VSFs in many different configurations, including single-tier Web server or multi-tier Web-server, application server, database server configurations. Each tier of a multi-tier VSF (e.g. Web server tier, application server tier, database server tier, etc) can be dynamically sized based on the load on the servers in that particular tier. Storage devices may include a plurality of pre-defined logical blueprints that are associated with roles that may be assumed by the computing grid elements. Initially, no computing element is dedicated to any particular role or task such as Web server, application server, database server, etc. The role of each computing element is acquired from one of a plurality of pre-defined, stored blueprints, each of which defines a boot image for the computing elements that are associated with that role.

A Virtual Server Farm (VSF) is created out of a wide scale computing fabric (&ldquo;Computing Grid&rdquo;) which is physically constructed once and then logically divided up into VSFs for various organizations on demand. Allocation and control of the elements in the VSF is performed by a control plane connected to all computing, networking, and storage elements in the computing grid through special control ports. The control plane is comprised of a control mechanism hierarchy that includes one or more master control process mechanisms communicatively coupled to one or more slave control process mechanisms. The one or more master control process mechanisms instruct the slave control process mechanisms to establish VSFs by selecting subsets of processing and storage resources.

Method and apparatus for controlling an extensible computing system

An apparatus for allowing communications to a target host on a network to be upgraded from a non-secured session to a secured session. The apparatus including a processor; a memory coupled to the processor and storing an access control list; and a network interface coupled to the processor, the network interface communicating with a target host; wherein the memory is configured to cause the processor to: (1) create an access control entry for the target host in the access control list; (2) exchange security information with the target host; (3) update the entry for the target host to include the security information; and, (4) communicate with said target host using said security information. A method for allowing communications to a target host on a network to be upgraded from a non-secured session to a secured session having the steps of: (1) creating an access control entry for the target host in the access control list; (2) exchanging security information with the target host; (3) updating the entry for the target host to include the security information; and, (4) communicating with the target host using the security information.

Growing community of inventors

San Mateo, CA, United States of America

Tom R Markson