International Business Machines Corporation

Lenovo (singapore) Pte. Ltd.

Vinit Jain

Venkat Venkatsubra

Vasu Vallabhaneni

Renato John Recio

Lance Warren Russell

Dwip N Banerjee

Deanna Lynn Quigg Brown

Lilian Sylvia Fernandes

David Jones Craft

Jayakrishna Kidambi

Kavitha Vittal Murthy Baratakke

Jeffrey Paul Messing

Omar Cardona

Rakesh Sharma

Jorge Rafael Nogueras

Vijoy A Pandey

Casimer M DeCusatis

Keshav G Kamble

Mircea R Gusat

Eric Philip Fried

Herman Dietrich Dierks

Patrick Tam Vo

Sudheesh S Kairali

Cyriel Johan Minkenberg

Harvey Gene Kiel

Amitabha Biswas

Dayavanti G Kamath

Lee Anton Sendelbach

Perinkulam I Ganesh

Nilanjan Mukherjee

Bhalachandra G Banavalikar

Abhijit Prabhakar Kumbhare

Satya Prakesh Sharma

Shawn Patrick Mullen

Rajeev Kumar Mishra

David R Willoughby

Katherine Barabash

Dean J Burdick

Agustin Mena, Iii

James Franklin Macon, Jr

Vijay R Kalangumvathakkal

Marc Joel Stephenson

Kiet Hien Lam

Kavitha V M Baratakke

Uma Krishnan

Srikanth Vishwanathan

Mel Mehrdad Bakhshi

Philip Kunsik Cho

Mladen Kovacevic

Pandu Ranga Rao Mutyala

Madhuri Madhavan Pillai

Sandeep R Patil

William Joseph Armstrong

Riyazahamad Moulasab Shiraguppi

Nataraj Nagaratnam

Daniel Gene Eisenhauer

Kyle Alan Lucke

Satya Prakash Sharma

Mark D Rogers

David Alan Hepkin

James P Allen

Stephan Benny

Baltazar De Leon, Iii

Thomas Stanley Mathews

Jeffrey James Lynch

Benny Rochwerger

Rami Cohen

Ramamohan Chennamsetty

James Stanley Tesauro

Santosh Rajagopalan

Dolapo Martin Falola

Ranadip Das

Matthew J Sheard

Robert Scott Manning

Edward Shvartsman

Mallesh K Lepakshaiah

Kavitha Ramalingam

Ketan Priyakant Pancholi

Badri Ramaswamy

Kevin Lynn Fought

Matthew Todd Brandyberry

Elizabeth Jean Murray

William Christopher Conklin

Frank Dea

Shannon Marie MacAlpine

Matthew Douglas Dirba

Agustin Mena Iii

Uma K

Deanna Lynn Brown

James Franklin Macon

Vijoy Pandey

Renato Recio

Aspects of the present invention provide an approach for providing network intrusion detection and prevention service (NIDPS) capabilities to a microservice in a networked computing environment. In an embodiment, a set of rules for accessing the microservice is retrieved. A NIDPS microservice is created within the environment of the microservice fabric that supports the microservice using the set of rules. The NIDPS microservice is established as a proxy communications destination for communications to the microservice such that communications that are intended for the microservice are instead rerouted to the NIDPS microservice. These communications are filtered by the NIDPS microservice according to the set of rules (e.g., to remove any communications that are determined to be threats).

Microservice integration fabrics network intrusion detection and prevention service capabilities

Aspects of the present invention provide an approach for performing network intrusion detection and prevention service (NIDPS) detection on a proxy server in a networked computing environment. In an embodiment, the proxy server has a front end proxy, a NIDPS component, and a back end proxy installed on it. The front end proxy decodes communications sent by external users to content servers over a network that are intercepted by the proxy server and forwards the communications to the NIDPS component. The NIDPS component performs NIDPS detection to detect whether communications comprise a network threat. Communications that have been verified as not comprising a network threat are forwarded to the back end proxy for routing to their destinations. Communications that have been verified as threats are forwarded to a cognitive engine, which initiates an automatic scaling of the NIDPS component in response to indications of network threats from the NIDPS component.

Enhanced network throughput using network intrusion detection and prevention service (NIDPS) detection

A method includes associating overlay network attributes (ONAs) with overlay virtual networks. The ONAs are managed as portable entities. A movement operation is performed on components of at least one overlay virtual network of the overlay virtual networks to servers based on management of the ONAs. An ONA is modified to identify attributes associated with the movement operation of the components of the at least one overlay virtual network.

Overlay network movement operations

A method includes associating overlay network attributes (ONAs) with virtual networks. A movement operation is performed that includes re-assigning the virtual networks to servers of overlay networks based on management of the ONAs.

Systems and methods for managing mirroring communication between virtual network clients in a distributed overlay virtual network are provided. The method comprises utilization of controlled overlay virtualization infrastructure to facilitate communication between mirrored network clients. The system comprises a source mirrored network client hosted on a first physical port, a target mirrored network client hosted on a second physical port, a first overlay termination point, a second overlay termination point and a network controller. For a set of mirrored network clients, a logical mirror virtual network address is reserved. The controller is extended to contain mapping between the logical mirror network address and a set of virtual network addresses of mirrored clients. The network controller translates the logical mirror virtual network address to a set of destination virtual network addresses of mirrored clients and allows the modified packets to be sent to a set of second virtual network clients.

Application level mirroring in distributed overlay virtual networks

Embodiments of the invention relate to providing virtual network domain movement operations for overlay networks. One embodiment includes a method that includes determining one or more overlay network attributes (ONAs) for a plurality of virtual networks. The one or more ONAs are associated with the virtual networks. The one or more ONAs are managed as one or more portable entities by one or more of creating ONAs, deleting ONAs, moving ONAs, combining ONAs and dividing ONAs. A movement operation is performed on the one or more virtual networks among one or more servers of one or more overlay networks based on the management of the one or more ONAs.

A method includes receiving tunnel information and end point information in response to a request to a distributed cluster. A common tunnel type supported by a source switch and a destination switch is selected. A packet is encapsulated with the common tunnel type supported by the source switch and the destination switch for a destination virtual machine (VM).

Interoperability for distributed overlay virtual environment

In one embodiment, a system includes a switch controller configured to communicate with a plurality of network devices in a network. The switch controller includes a processor and logic integrated with and/or executable by the processor. The logic is configured to determine a throughput associated with a workload in the network and select an optimum location for the workload in the network based on the throughput associated with the workload. In another embodiment, a computer program product includes a computer readable storage medium having program code embodied therewith. The embodied program code is readable/executable by a processor to cause the processor to determine a throughput associated a workload in a network. The embodied program code is also readable/executable by the processor to cause the processor to select an optimum location for the workload in the network based on the throughput associated with the workload.

Workload deployment with real-time consideration of global network congestion

In one embodiment, an apparatus includes a processor and logic integrated with and/or executable by the processor. The logic is configured to communicate with a first physical switch, a second physical switch, and an overlay network that connects the first physical switch to the second physical switch. The logic is also configured to receive a request for a communication path through the overlay network for a packet, the request including at least the packet, first information about a source of the packet, the source of the packet being connected to the first physical switch, and second information about a most closely connected physical switch to a destination of the packet. Moreover, the logic is configured to determine the destination of the packet, the destination of the packet being connected to the second physical switch. Also, the logic is configured to determine whether to apply a security policy to the packet.

Providing services to virtual overlay network traffic

According to one exemplary embodiment, a method for automatic network reconfiguration associated with a failover event is provided. The method may include instructing a file system to capture a plurality of attributes associated with a plurality of data following the failover event, whereby the plurality of attributes comprises a fileset identifier, a first gateway node identifier, and a second gateway node identifier. The method may include determining, based on the captured fileset identifier, a virtual local area network associated with the fileset, whereby the determined virtual area network includes at least one software defined network switch. The method may include reconfiguring the at least one software defined network switch to stop sending a plurality of network traffic to the first gateway node and to start sending the plurality of network traffic to the second gateway node, whereby the plurality of network traffic is associated with the fileset.

Automatic reconfiguration of network parameters during file system failover

A method includes forwarding a request to a distributed overlay virtual Ethernet (DOVE) connectivity service (DCS) cluster for tunnel information by a source switch. In response to the request for tunnel information, the tunnel information and end point information are received. A common tunnel type supported by the source switch and a destination switch is selected. A packet is encapsulated with the common tunnel type supported by the source switch and the destination switch for a destination virtual machine (VM).

A data handling system network includes a data handling system that is communicatively coupled to a switch by a network. The data handling system includes one or more logical partitions. Each logical partition includes a plurality of virtual switches and a plurality of virtual network interface cards. Each virtual network interface card is associated with a particular virtual switch and includes a plurality of QoS queues. The switch includes one or more switch partitions. Each switch partition includes a plurality of QoS queues that are associated with the QoS queues of the virtual network interface card. A packet is received with the virtual switch and the virtual switch sets and associates a QoS priority flag with the received packet. The virtual switch forwards the packet to a QoS queue comprised within the virtual network interface card based upon the QoS priority flag.

Quality of service in multi-tenant network

In one embodiment, a system includes a switch controller configured to communicate with each of a plurality of network devices in a network, the switch controller including a processor and logic integrated with and/or executable by the processor, the logic being configured to: receive a request to instantiate a new workload or to move a current workload in the network, determine a throughput associated with the new or current workload, and select an optimum location to place the new workload or to move the current workload in the network based on the throughput associated with the new or current workload. According to another embodiment, a method includes receiving a request at a switch controller to instantiate or move a workload, determining a throughput associated with the workload, and selecting an optimum location to place or move the workload based on the throughput associated with the workload.

In one embodiment, a method for applying security policy in an overlay network includes receiving a request, including a packet, for a communication path through an overlay network, determining whether a security policy is to be applied to the packet based on at least one of: contents of the packet, first information, and second information, selecting a communication path between a source physical switch and a destination physical switch, wherein the selected communication path directly connects the source physical switch to the destination physical switch when it is determined to not apply the security policy to the packet, and the selected communication path connects the source physical switch to the destination physical switch via a security appliance when it is determined to apply the security policy to the packet, and sending the selected communication path to the source physical switch.

Growing community of inventors

Austin, TX, United States of America

Vinit Jain