Nicira, Inc.

Vmware, Inc.

Vasantha Kumar

Amit Vasant Patil

Azeem Feroz

Sriram Gopalakrishnan

Amit Chopra

Sandeep Kasbe

Hrishikesh Ghatnekar

Anil Kv Kumar

James Christopher Wiese

Prasad Sharad Dabak

Leena Shuklendu Soman

Rayanagouda Bheemanagouda Patil

Nidhi Sharma

Vaibhav Rekhate

Naveen Ramaswamy

Nilesh Awate

Mandar Barve

Patil Rayanagouda

Vaishali Sontakke

Lakshmi Sravya Koppula

Stalin Rajakilli

Zaid Bepari

Example methods are provided for flow-based forwarding element configuration in a network environment. An example method may comprise obtaining a set of security policies associated with the group of workloads; and based on the set of security policies, identifying an allowed forwarding path between a destination and a first workload. The method may also comprise configuring a whitelist set of flow entries and sending configuration information to the flow-based forwarding element to cause the flow-based forwarding element to apply the whitelist set. The whitelist set may include a first flow entry specifying match fields and a first action to allow communication over the allowed forwarding path, but excludes a second flow entry specifying a second action to block communication over a forbidden forwarding path between the destination and the second workload. The match fields may include transport layer information and network layer information.

Flow-based forwarding element configuration

Some embodiments provide a novel method for authorizing network requests for a machine in a network. In some embodiments, the method is performed by security agents that execute on virtual machines operating on a host machine. In some embodiments, the method captures a network request (e.g., network control packets, socket connection request, etc.) from a primary application executing on the machine. The method identifies an extended context for the network request and determines whether the network request is authorized based on the extended context. The method then processes the network request according to the determination. The extended context of some embodiments includes identifications for primary and secondary applications associated with the network request. Alternatively, or conjunctively, some embodiments include identifications for primary and secondary users associated with the network request.

Extended context delivery for context-based authorization

Example methods and systems for score-based dynamic firewall rule enforcement in a software-defined networking (SDN) environment. One example method may comprise in response to detecting a first request to access a first resource, identifying a first score associated with the user, and a firewall rule that is applicable to the user based on information associated with the user. The firewall rule may be applied to allow access to the first resource. The method may further comprise adjusting the first score to a second score that represents a more restrictive access level compared to the first score. In response to detecting a second request to access the first resource, applying the firewall rule to block the second request based on the second score.

Score-based dynamic firewall rule enforcement

Embodiments of the present disclosure relate to predicting and preventing performance lag of virtual network appliances. Embodiments include determining a benchmark score for a virtual appliance running on a computing device. Embodiments include providing the benchmark score and one or more virtual appliance settings of the virtual appliance as inputs to a trained predictive model and receiving a predicted performance value as an output from the trained predictive model. Embodiments include using the predicted performance value to perform one or more actions.

Efficient network services with performance lag prediction and prevention

The technology disclosed herein enables segregation of network traffic on an application basis. In a particular embodiment, a method is performed in a virtual network interface for a first guest Operating System (OS) executing on a host and includes receiving guest data packets from the first guest OS. The method further includes associating the guest data packets with respective ones of a plurality of applications executing within the first guest OS and separating the guest data packets into respective ones of a plurality of application port interfaces each corresponding to at least one of the plurality of applications. The method also includes passing the guest data packets to a host network interface using the plurality of application port interfaces.

Network traffic segregation on an application basis in a virtual computing environment

Certain embodiments described herein are generally directed to systems and methods for preventing access to files on a virtual machine. One example method involves receiving network information associated with a network connection opened at the virtual machine and determining a process that opened the network connection. The method further involves receiving information indicative of a file access event attempted at the virtual machine and determining the process that opened the network connection initiated the file access event. The method further involves transmitting information indicative of the file access event and the network connection to a security virtual machine and receiving an enforcement decision for the file access event from the security virtual machine based on the information indicative of the file access event and the network connection. The method further involves applying the enforcement decision to either allow or prevent the file access event by the process.

Methods to restrict network file access in guest virtual machines using in-guest agents

Some embodiments provide a method for an end machine, that implements a distributed application, to redirect new network connection requests to other end machines that also implement the distributed application. The method receives a set of measurement data from a set of resources of the end machine and determines whether a measurement data received from a particular resource has exceeded a threshold. When the measurement data has exceeded the threshold, the method notifies a load balancer that balances new requests for connection to the distributed application between the end machines. The notification causes the load balancer not to send any new connection request to the end machine and redirect them to other end machines.

Excluding stressed machines from load balancing of distributed applications

A method to selectively encrypting packets includes filtering calls, at a virtual machine on a host, to connect sockets to server applications. When a call by a client application to connect a socket to a server application is detected, the method includes determining if the socket between the client and the server applications is to be encrypted based on identities of the client application, a user logged in on the virtual machine, or the client application and the user logged in on the virtual machine. The method includes filtering outbound packets in a protocol stack of the virtual machine. When the socket is to be encrypted and an outbound packet for the socket is detected, the method includes tagging the outbound packet for encryption by a hypervisor on the host and sending the outbound packet to a virtual network interface card (vNIC) emulated by the hypervisor.

Guest thin agent assisted host network encryption

Example methods are provided for a first endpoint to communicate with a second endpoint over a public network, the second endpoint being in a private network. The method may comprise detecting a chunk of data directly from an application executing on the first endpoint. The virtual adapter may emulate a transport protocol task offload to bypass transport protocol processing by a protocol stack of the first endpoint. The method may comprise processing the chunk of data to generate a chunk of processed data for transfer through a tunnel connecting the virtual adapter over the public network with a gateway associated with the private network and sending the chunk of processed data through a tunnel in a plurality of tunnel segments, wherein the gateway is configured to perform transport protocol processing to generate a plurality of transport protocol segments from the chunk of processed data for transfer to the second endpoint.

Transport protocol task offload emulation to detect chunks of data for communication with a private network

Some embodiments provide a novel method for monitoring network requests from a machine. The method captures the network request at various layers of a protocol stack. At a first layer of a protocol stack, the method tags a packet related to the network request with a tag value, maps the tag value to a set of tuples associated with the packet, and sends a first set of data related to the packet to a security engine. At a second layer of the network stack, the method determines whether the packet has been modified through the network stack, and sends an updated second set of data to the security engine when the packet has been modified.

Isolated network stack to manage security for virtual machines

Example methods are provided for a first endpoint to perform congestion control during communication with a second endpoint over a public network, the second endpoint being in a private network. The method may comprise generating a plurality of tunnel segments containing unreliable transport protocol data destined for the second endpoint; and determining whether congestion control is required based on a data amount of the plurality of tunnel segments and a congestion window associated with a tunnel connecting the first endpoint with the private network. The method may further comprise, in response to determination that congestion control is required, performing congestion control by dropping at least some of the plurality of tunnel segments; otherwise, sending the plurality of tunnel segments through the tunnel supported by the reliable transport protocol connection.

Congestion control during communication with a private network

The technology disclosed herein enables reduction of secure protocol overhead when transferring packets between guest elements on different hosts. In a particular embodiment, the method provides, in a first virtual network interface of a first guest element, receiving one or more first packets from a first guest element directed to a second guest element. In response to determining that the first packets will be encapsulated in a secure protocol having a first integrity check procedure provided for by the secure protocol, the method provides refraining to perform a transmit-side portion of a second integrity check procedure on the first packets as provided for by a transport protocol. The method further provides passing the first packets to a first host of the first virtual network interface in the transport protocol.

Reduction in secure protocol overhead when transferring packets between hosts

A method for performing network access filtering and/or categorization through guest introspection on a device data compute node (DCN) that executes on a host is provided. The method, through a guest introspector installed on the DCN, intercepts a data message that the DCN is preparing to send. The method identifies a category of the network resource. The method uses the category of the network resource to examine a set of network access policies that are stored on the host in order to determine whether the network access should be allowed. The method identifies a network access policy that requires the rejection of the network access when the access to the network resource causes an aggregate bandwidth for accessing the identified category of network resource to exceed a bandwidth threshold. The method rejects the network access based on the identified network access policy.

Introspection method and apparatus for network access filtering

System and method for managing firewall rules for hierarchical entities modify a processing order of the firewall rules to be executed in a distributed computer system based on hit counts of the firewall rules and direct descendent relationships of destination entities of the firewall rules.

Firewall rule management for hierarchical entities

The technology disclosed herein enables the automatic discovery of MTU size across a software defined network (SDN). In a particular embodiment, a method provides, in a management plane of the SDN, receiving a first MTU request from a first endpoint of the SDN that indicates a second endpoint of the SDN to which the first endpoint will transfer first data. The method further provides tracing a first path through the SDN for the first data between the first endpoint and the second endpoint, determining the smallest MTU along the first path, and setting a first MTU to a value less than or equal to the smallest MTU along the first path. The method also includes providing the first MTU to the first endpoint.

Growing community of inventors

Pune, India

Vasantha Kumar