Hewlett-packard Development Company, L.p.

Hewlett Packard Enterprise Development LP

Banyanops, Inc.

Other

Yoshio Frank Turner

Jose Renato Santos

Gopalakrishnan Janakiraman

Jose Renato G Santos

Jean Tourrilhes

Dinesh Kumar Subhraveti

Michael S Schlansker

Sujata Banerjee

Jichuan Chang

David Lowell

Mike Schlansker

Aravind Menon

Puneet Sharma

Jeongkeun Lee

Jeffrey Clifford Mogul

Charles F Clark

Kevin T Lim

Niraj Tolia

Jayanth Gummaraju

Matteo Monchiero

Junggun Lee

Yadi Ma

Tarun Desikan

Parthasarathy Ranganathan

John Alan Wickeraad

Nathan Lorenzo Binkert

Jung Gun Lee

Priya Mahadevan

Praveen Yalagandula

Kenneth Mark Wilson

Paul S Keltcher

Jayaram Mudigonda

Alvin AuYoung

Malena Rosa Mesarina

Joon-Myung Kang

Lucian Popa

Chaithan M Prakash

Jose Ranato Santos

Myung Jin Lee

Jen Cheng Huang

Dave Lenrow

Joon Myung Kang

David Lenrow

Jean Tourrilhs

A control system authorizes access to a networked resource. The control system includes a client agent associated with a client resource running at a user device, and a destination agent associated the networked resource. The client agent transparently injects one or more identity tokens associated with the client resource and one or more access tokens associated with the networked resource into a network request issued by the client resource and directed to the networked resource. The destination agent intercepts the network request and uses the access tokens to selectively route the network request in accordance with one or more security policies associated with the access tokens.

Methods and systems for use in authorizing access to a networked resource

Example implementations disclosed herein can be used to generate composite network policy graphs based on multiple network policy graphs input by network users that may have different goals for the network. The resulting composite network policy graph can be used to program a network so that it meets the requirements necessary to achieve the goals of at least some of the network users. In one example implementation, a method can include receiving multiple network policy graphs, generating composite endpoint groups based on relationships between endpoint groups and policy graph sources, generating composite paths based on the relationships between the endpoints and the network policy graphs, generating a composite network policy graph based on the composite endpoint groups and the composite paths, and analyzing the composite network policy graph to determine conflicts or errors.

Network policy graphs

Example embodiments relate to providing efficient routing in software defined networks. In example embodiments, an indirect group table includes a first group entry that is associated with a first route tree in a software defined network, wherein the indirect group table affects a plurality of forwarding table entries associated with the first group entry. A failure is detected in the first route tree during a data transmission, and a notification of the failure is sent to a remote controller device, where the remote controller device identifies a second route tree that does not include the failure. After the remote controller device updates the first group entry to be associated with the second route tree, the data transmission is performed using the second route tree.

Efficient routing in software defined networks

Disclosed herein are a system, non-transitory computer readable medium, and method for governing communications of a bare metal guest in a cloud network. A network interface handles packets of data in accordance with commands by a control agent.

Governing bare metal guests

In some examples, input network policies are combined to form a composite network policy, each input network policy of the input network policies specifying at least one characteristic of communications allowed between endpoint groups in a network. Metadata associated with the composite network policy is added, the metadata including information regarding a reason for disallowance of a communication between endpoint groups.

Adding metadata associated with a composite network policy

Example implementations disclosed herein can be used to allocate network resources in a software defined network (SDN). In one example implementation, a method can include receiving a plurality of resource allocation proposals from a plurality of controller modules, instructing the controller modules to generate votes for the plurality of resource allocation proposals, and selecting one of the plurality of resource allocation proposals based on the votes to instantiate the selected resource allocation proposal in the SDN.

Network resource allocation proposals

A control system facilitates communication between a plurality of networked services. The control system includes a client agent associated with a first service of the networked services, and a destination agent associated with a second service of the networked services. The client agent includes an injection mechanism that intercepts a network request issued by the first service, transparently injects a token into the network request while the network request is in transit, and automatically transmits the network request to the second service in accordance with one or more security policies associated with the second service. The destination agent includes an interception mechanism that intercepts the network request, extracts the tokens from the network request, and determines whether to forward the network request to the second service.

Transparently enhanced authentication and authorization between networked services

Example embodiments relate to providing efficient routing in software defined networks. In example embodiments, an indirect group table includes a first group entry that is associated with a first route tree in a software defined network. A failure is detected in the first route tree during a data transmission, and a notification of the failure is sent to a remote controller device, where the remote controller device identifies a second route tree that does not include the failure. After the remote controller device updates the first group entry to be associated with the second route tree, the data transmission is performed using the second route tree.

Identifying a component within an application executed in a network includes obtaining a traffic matrix, the traffic matrix defining a rate for which packets of data are exchanged between VMs corresponding to an application, analyzing the traffic matrix to identify VMs within a component, modifying the traffic matrix to create a modified traffic matrix, and defining, for the application, a tenant application graph (TAG) model based on the modified traffic matrix.

Identifying a component within an application executed in a network

According to an example, a method for bandwidth guarantee and work conservation includes determining virtual machine (VM) bandwidth guarantees assigned to VMs in a network including a source VM that communicates with destination VMs. The method further includes assigning minimum bandwidth guarantees to communications between the source VM with the destination VMs by dividing a VM bandwidth guarantee assigned to the source VM between the destination VMs based on active VM-to-VM communications between the source VM and the destination VMs. The method also includes allocating, by a processor, spare bandwidth capacity in the network to a communication between the source VM and a destination VM based on the assigned minimum bandwidth guarantees.

Bandwidth guarantee and work conservation

Managing non-congestion-controlled message traffic in a datacenter. Any non-congestion-controlled packets originating in a sending server and intended for a receiving server are encapsulated in the sending server and transmitted through a virtual circuit having a message transport protocol with rate control. The packets are decapsulated in the receiving server.

Methods of and apparatus for managing non-congestion-controlled message traffic in a datacenter

Illustrated is a system and method to generate a teaching message with a host device address that impersonates a device source address, the impersonation to instruct an additional network device as to the host device address. It further include a transmitter to transmit the teaching message to the additional network device. It also includes traversing a forwarding table to identify an additional network device that has yet to receive a teaching message since an expiration of a predefined threshold value, the teaching message to relate to a source device. It also includes a transmitter to transmit a teaching message to the additional network device.

Teaching a network device using unsolicited teaching messages

Packet processing for packets from a virtual machine includes receiving a packet from an external switch at a computer system hosting a plurality of virtual machines. If the received packet is a learning packet, storing a packet signature determined from the learning packet. For a packet to be transmitted from a virtual machine in the computer system, determining if the packet's signature matches the stored packet signature. If the packet's signature matches the stored packet signature, performing an action associated with the packet signature.

Virtual machine packet processing

In a method () for routing packets between a plurality of top switches (-) and a plurality of leaf switches (-) using a balancing table () in a fat tree network (), a failed link between at least one top switch () and at least one leaf switch () is detected (). In addition, the balancing table () is modified () based on the detected failed link, and the packets are routed () between the plurality of top switches (-) and the plurality of leaf switches (-) in the fat tree network () based on the modified balancing table ().

Method for routing data packets in a fat tree network

Topology input is used to identify a set of data flows as between a set of virtual machines (VMs), as well as one or more network services for one or more of the data flows. A determination is made as to a minimal number of network service virtual machines (NSVMs) for use in providing the one or more network services. An arrangement is determined for server resources and network resources of the data center network on which a virtual network topology is provided for the tenant, including the set of VMs and the number of NSVMs.

Providing a virtual network topology in a data center

Growing community of inventors

Redwood City, CA, United States of America

Yoshio Frank Turner