Cisco Technology, Inc.

Skyport Systems, Inc.

Washington University

William Norman Eatherton

Philippe Lacroute

Stefan Alexander Dyckerhoff

Thomas John Giuli

Robert Stephen Rodgers

Keith Eric Holleman

Srivatsan Rajagopal

Edward Ronald Swierk

Michael John Beesley

Paul Edward Fraley

Vijay Krishnaji Tapaskar

Daniel Sergeevich Selifonov

Keith Anthony Low

Neil Vincent Geraghty

Zubin D Dittia

Jaushin Lee

John Andrew Fingerhut

Priyank Ramesh Warkhede

Vijay Rangarajan

Bangalore Priyadarshan

Jonathan S Turner

John H W Bettink

Shyamsundar Nandkishor Maniyar

Fusun Ertemalp

Dileep Kumar Devireddy

Rami Zemach

Earl T Cohen

Hugh Weber Holbrook

Michael Brian Galles

Daniel E Lenoski

Vitaly Sukonik

Venkateshwar Rao Pullela

Bhushan Mangesh Kanekar

Moshe Voloshin

Hugh Holbrook

Dalit Sagi

Peram Marimuthu

Donald Edward Steiss

John Joseph Williams, Jr

Michael Laor

Ganesh Sadasivan

Xiaoxue Ma

Rengabashyam Srinivas

Vinod Gerard John Peris

John H Bettink

Bangalore L Priyadarshan

In general, embodiments of the invention relate managing the interaction of applications with one or more file systems and/or data managed by the file systems. More specifically, embodiments of the invention relate to providing applications with access to an overlay file system (OFS) and then servicing OFS operations using a file system module and one or more underlay file systems (UFSes) that are not directly accessible to the applications.

Method and system for managing file system access and interaction

A method and system for deploying applications. The method includes deploying an application image of an application to a computing device, where the application is accessible using a first uniform resource locator (URL). The method also includes sending an application creation message to an authoritative domain name system (DNS) server to create a record mapping the first URL to a second URL. The first URL is in a first domain and the second URL is in a second domain. The method further includes providing, to the computing device, a digital certificate associated with the application. The method further includes generating certificate data using the digital certificate and sending, to a remote application server, the second URL and certificate data. A client software module may establish a connection to the application on the computing device using the second URL and the certificate data.

Method and system for software application deployment

A method and system for verifying integrity of computing devices. The method includes providing a first integrity associated with a server executing on a computing device to a management service, and receiving, in response to providing the first integrity measurement, a first mutual attestation value from the management service. The method further includes providing a second integrity associated with a network adaptor executing on a computing device to a management service, and receiving, in response to providing the second integrity measurement, a second mutual attestation value from the management service. The method further includes performing a mutual attestation between the server and the network adaptor using the first mutual attestation value and the second mutual attestation value, and notifying the management service that the mutual attestation has been successfully completed.

Method and system for verifying the integrity of computing devices

A method and system for configuring computing devices. The method includes receiving, by a computing device, a first cache list object from a management service. The method also includes comparing the first cache list object to a second cache list object on the computing device, and based on the comparing, identifying a first object fingerprint that is present in the first cache list object and that is not present in the second cache list object. The method further includes obtaining, from a location that is external to the computing device, a first object corresponding to the first object fingerprint; and updating a configuration of the computing device using the first object.

Method and system for configuring computing devices

A method and system for authenticating applications. The method includes receiving, by a service virtual machine (SVM), a secret from a management service. The SVM is executing on a computing device. The method also includes providing, by the SVM, the secret to an application executing on an application virtual machine (AVM). The AVM is executing on the computing device. The method further includes providing, by the application, the secret to a remote application server in order for the remote application server to authenticate the application.

Method and system for authentication by intermediaries

A method and system for key management. The method includes receiving, by a control domain on a server, a request for a tenant key, and obtaining an authorization secret from a management service, where the management service is external to the server. The method further includes, in response to the request, decrypting, after obtaining the authorization secret, an encrypted platform master key to obtain a platform master key, decrypting an encrypted tenant key to obtain the tenant key using the platform master key, and providing the tenant key to an entity that issued the request.

Method and system for key management

In general, embodiments of the invention relate to a method and system for managing network access for applications. More specifically, embodiments of the invention provide mock Internet Protocol (IP) addresses to the applications, where the applications may use the mock IP addresses to communicate with other systems (e.g., other computing devices, the management service, or any other system that is accessible via the network). Each mock IP address may be associated with one or more policies, where the policies dictate how packets that includes the mock IP address are processed. In one or more embodiments of the invention, the mock IP addresses may be used to maintain a class of service (CoS) between applications executing on the computing devices and an application service provider (ASP).

Method and system for managing class of service in a network

In general, embodiments of the invention relate to a method and system for managing network access for applications. More specifically, embodiments of the invention provide mock Internet Protocol (IP) addresses to the applications, where the applications may use the mock IP address to communicate with other systems. Each mock IP address may be associated with one or more policies, where the policies dictate how packets that include the mock IP address is processed.

Method and system for managing network access

A method and system for accessing local resources. The method includes intercepting, by a proxy, a request from an application to access a local resource, where the application is executing in an application virtual machine (AVM) on a computing device and where the proxy is executing on a service virtual machine (SVM) on the computing device. The method further includes replacing, by the proxy, a placeholder credential in the request with a local resource credential to obtain a second request. The method also includes sending, by the proxy, the second request to the local resource, receiving, by the proxy, a response to the second request from the local resource, and providing the response to the application.

Method and system for protecting credentials

Methods and apparatus are disclosed for generating and using an enhanced tree bitmap data structure in determining a longest prefix match, such as in a router, packet switching system. One implementation organizes the tree bitmap to minimize the number of internal nodes that must be accessed during a lookup operation. A pointer is included in each of the trie or search nodes to the best match so far entry in the leaf or results array which allows direct access to this result without having to parse a corresponding internal node. Moreover, one implementation stores the internal node for a particular level as a first element in its child array. Additionally, one implementation uses a general purpose lookup engine that can traverse multiple tree bitmaps or other data structures simultaneously, and perform complete searches, partial searches, and resume partial searches such as after receiving additional data on which to search.

Method and apparatus for generating and using enhanced tree bitmap data structures in determining a longest prefix match

A resource interconnect architecture and associated descriptor protocol provides more efficient communication between different resources in a data processing system. One embodiment uses a backdoor interconnect that allows some resources to communicate without using a central resource interconnect. Another embodiment uses nested descriptors that allow operations by different resources to be chained together without having to communicate back to an originating descriptor resource. In another embodiment, the descriptors are generated in hardware or in software. Other embodiments assign priority or privilege values to the descriptors that optimize processing and error handling performance.

Method and apparatus for communicating over a resource interconnect

Methods and apparatus are disclosed for storing tree data structures among and within multiple memory channels, which may be of particular use with, but not limited to tree bitmap data structures. A subtree (or entire tree) typically includes one or more leaf arrays and multiple tree arrays. One or more leaf arrays are typically stored in a first set of memory channels of N+1 sets of memory channels, the N+1 sets of memory channels including N sets of memory channels plus the first set of memory channels. Each of N contiguous levels of the multiple tree arrays are stored in a different one of said N sets of memory channels, wherein each of the multiple tree arrays at a same level of said N contiguous levels is stored in the same memory channel set of said N sets of memory channels. A memory channel for storing a particular level is typically assigned based on one or more current occupancy levels of the memory channels.

Method and apparatus for storing tree data structures among and within multiple memory channels

Methods and apparatus are disclosed for defining flow types and instances thereof such as for identifying packets corresponding to instances of the flow types. A flow type is defined and includes a set of properties including at least one of the possible properties selectable when defining a flow type. An instance of the flow type is defined and a set of corresponding associative memory entries is generated. A lookup word generator of a packet processing engine is typically notified of the use of the flow type, and one or more lookup words are generated typically by extracting fields from a received packet and/or from other sources. Based on a result of lookup operations on the set of associative memories entries using the generated one or more lookup words, the received packet can be identified as whether it matches or does not match the instance of the flow type.

Methods and apparatus for defining flow types and instances thereof such as for identifying packets corresponding to instances of the flow types

Methods and apparatus are disclosed for processing packets, for example, using a high performance massively parallel packet processing architecture, distributing packets or subsets thereof to individual packet processors and gathering the processed packet or subsets and forwarding the resultant modified or otherwise processed packets, accessing packet processing resources across a shared resource network, accessing packet processing resources using direct memory access techniques, and/or storing one overlapping portion of a packet in a global packet memory while providing a second overlapping portion to a packet processor. In one implementation, the processing of the packet includes accessing one or more processing resources across a resource network shared by multiple packet processing engines. In one implementation, a global packet memory is one of these resources. In one implementation, these resources are accessed using direct memory access (DMA) techniques. In one implementation, a descriptor used in a prior DMA request is modified and then used in a second DMA request.

Methods and apparatus for processing packets including accessing one or more resources shared among processing engines

Tree data structures are stored among and within multiple memory channels, which may be of particular use with, but not limited to tree bitmap data structures. A subtree (or entire tree) typically includes one or more leaf arrays and multiple tree arrays. One or more leaf arrays are typically stored in a first set of memory channels of N+1 sets of memory channels, the N+1 sets of memory channels including N sets of memory channels plus the first set of memory channels. Paths of the multiple tree arrays are typically stored in said N memory channels, wherein each tree array of the multiple tree arrays associated with one of said paths is stored in a different one of said N sets of memory channels.

Growing community of inventors

San Jose, CA, United States of America

William Norman Eatherton