311 results about "Overlay network" patented technology

A multi-cloud overlay network for supporting communications between a first public cloud network and a second public cloud network. The overlay network features a management virtual private network, which includes a network load balancing (NLB) component and a controller registered as a target on a port of the NLB component. The overlay network further includes one or more spoke or transit gateways and a multi-cloud access virtual private cloud (VPC) operating within the first public cloud network, and a remote cloud load balancer component operating the second public cloud network. The remote cloud load balancer component is communicatively coupled between the multi-cloud access VPC and one or more remote spoke or transit gateways. The multi-cloud access VPC includes a VPC endpoint that is assigned a private IP address and communicatively coupled to the NLB component and a virtual private network (VPN) gateway communicatively coupled to a private transport.

The present disclosure relates to cyber-attack mitigation, information theoretic security in-motion, at-rest and storage intrusion mitigation with exclusive-path, content routing across an overlay network. Overlay network built upon Data Transport Controllers (DTC), SG nodes and SV nodes. System modules are deployed across various geo locations in a Wide Area Network, operating at the control of Universal Security Controller (USC). USC extracts system, security and storage activity telemetry data from Secure Vaults, Storage Gateways and Data Transport Controllers to orchestrate Autonomous Security Operations. SG nodes create SP fragments and store in SV nodes upon a data input operation. USC initiates an Exclusive-path content forwarding from the first SG node, across the DTC overlay through an exclusive list of DTC nodes and move it to second SG node. USC keeps the security control of SG nodes, DTC nodes and SV nodes and realize multi-vectored storage security at-rest and in-motion. SG nodes are connected to SV nodes which are micro-segmented, data vaults with restricted network reachability.

A system and method are provided for communicating security service context within a network. Intermediary nodes located along the path of a data flow apply various security services to the data flow, and keep a record of the security services by generating in-band and out-of-band information. The in-band information is limited, e.g., by the maximum transmission unit (MTU) to short attestations that fit within optional IPv6 extension headers. The out-of-bound information, which is recorded, e.g., in a ledger using an overlay network, provides additional information fully describing the security services. Based on the in-band and out-of-band information (e.g., using the attestations to retrieve the additional information from the ledger), the data flow is either allowed or denied entrance to a particular workload. Applying the security services and generating the in-band and out-of-band information can be performed using data processing units (DPUs) and / or an extended Berkley packet filters (eBPFs).

Embodiments are directed to managing access to network resources. A first mesh agent may be configured to provide a client with access to a resource via an overlay network. The first mesh agent may determine an identity and an activity associated with requests such that the identity corresponds to an entity that may be authenticated to access the overlay network and the resource. A policy container associated with the activity may be determined based on characteristics of the requests such that the policy container may include policies associated with the activity. The requests may be validated based on the policies included in the policy container such that the validated requests may be forwarded to the resource and invalidated requests may be discarded and such that persistence of the connection may be maintained during the validation.

The invention is suitable for the field of abnormal data monitoring, and provides an abnormal data monitoring method and system based on artificial intelligence, and the system comprises a real-time data flow collection module, a cross-level correlation analysis module, a dynamic baseline model building module, an abnormal behavior comparison module, and an abnormal traceability module. According to the method, through real-time data acquisition, cross-hierarchy analysis, dynamic modeling, anomaly detection and deep threat tracing, an efficient and intelligent anomaly monitoring closed loop is constructed, and remarkable beneficial effects are presented. According to the method, firstly, real-time data flow capture and cross-level correlation analysis are utilized to ensure that interaction behaviors of multiple protocol levels in a network are comprehensively covered, and a complex abnormal mode is recognized in combination with context information; according to the multi-dimensional analysis, the detection accuracy is remarkably improved, false alarm and missing alarm are effectively reduced, meanwhile, an abnormal mark data set with weights is generated, and high-quality data support is provided for follow-up processes.

The invention discloses a graph mapping method based on precise synthesis, and the method comprises the steps: constructing a precise synthesis structure library based on NPN equivalence classes, and inputting the precise synthesis structure library into a Boolean network; k-Cut cutting enumeration is carried out on the input Boolean network, a truth table is calculated, cutting is matched with a structure in a precise comprehensive structure library through Boolean matching, and rapid search is realized in combination with NPN classification; the overlay network is generated through multi-round mapping optimization, logic sharing nodes are mined in combination with structural hash, and the multi-round mapping optimization comprises delay-oriented mapping, global area topological optimization and local accurate area optimization; and a new target network is generated based on the optimized overlay network, redundant nodes are removed, and final network construction is completed. According to the method, manual intervention is not needed through full-process automatic mapping and a redundancy removal mechanism, the labor cost of a technical mapping link in chip design is remarkably reduced, and the method is particularly suitable for efficient design of complex circuits and emerging majority of logic base technologies.

The present application relates to the technical field of networks, and provides a traffic stream transmission method, apparatus and system. In the solution provided by the present application, an acceleration node in an overlay network can receive a plurality of traffic streams sent by a server, and acquire SLA requirements of the plurality of traffic streams. Moreover, the acceleration node can reduce the transmission quality of at least one target traffic stream having a lower SLA requirement when it is detected that the network resources of the overlay network do not satisfy the SLA requirements of the plurality of traffic streams. Thus, it can be ensured that when a plurality of traffic streams contend for network resources, the transmission quality of a traffic stream having a higher SLA requirement is first guaranteed.

The invention discloses an ultra wide band direction finding information extraction method based on a multi-input single-output delay superposition network. The method comprises the following steps: acquiring an antenna receiving signal and an attitude transformation matrix of an antenna; processing an antenna receiving signal to obtain a time point of a first peak leading edge detection threshold value and pulse sequence data in a complex form; carrying out 64-time up-sampling processing on the pulse sequence data in the plural form, and drawing an amplitude-time curve and a phase-time curve; determining a peak value corresponding to the adjacent antenna according to the peak value leading edge time point; calculating the peak values corresponding to the adjacent antennas to obtain the time difference of arrival and the phase difference of the adjacent antennas; and ultra-wideband direction-finding information positioning is realized. According to the invention, group delay can be carried out on the ultra-wideband pulse signal by adopting the delay line with the given length, and the ultra-wideband direction-finding information positioning precision is improved. The ultra wide band direction finding information extraction method based on the multi-input single-output delay overlay network can be widely applied to the technical field of ultra wide band positioning.

A network controller in an overlay network maintains a total set of identification-based policies and identification mappings for online users of the network for distribution to notifications across network elements of the network. When a new user is online, the controller identifies a site of a network where the user is online, and determines an identification map and applicable policy for the user for distribution to network elements at the identified site. The controller assigns an index value to each identity and communicates the index with the corresponding identity map and policy to the network element. The network element encapsulates cross-site traffic with an index value corresponding to the sender, so that the receiver network element can obtain the index value from the encapsulated header format, query the controller for a corresponding identification map, and apply a policy to traffic determined as relevant based on the sender's identification map obtained from the controller.

Embodiments provide solutions for establishing a secure communication channel between systems. A controller e.g. an administrator is able to construct a logical network of computing resources and define the relationships between those resources and the hierarchical structures that they are part of. Tags are used to label or identify the resources in accordance with their role or class within their network e.g. “staff laptop”, “guest laptop” etc., and multiple Tags can be assigned to a given resource. Policies (rules) associated with each tag provide a richness of functionality for each type of class as well as enabling constraints regarding use, security and / or user-related permissions to be applied across an entire group of network resources in a simple, efficient and secure manner. The controller can construct, define and control the resources within the connected environment. Embodiments provide solutions for preventing ARP poisoning attacks, and also improved approaches to DNS and PKI in an overlay network.

A process can include determining a plurality of Network Address Translation (NAT) routes associated with respective edge routers included in a same virtual private network (VPN) for communicating with a software-defined wide area network (SDWAN). A process can include identifying a first subset of the plurality of NAT routes as mapped to a first public NAT address included in a NAT pool associated with the VPN. A process can include tagging each NAT route of the first subset with a tag value indicative of a preferred router for receiving return traffic of the respective NAT route. A process can include routing traffic on a respective NAT route of the plurality of NAT routes based on applying, at an SDWAN controller, a corresponding control policy matching the tag value of the respective NAT route.

Some embodiments provide a novel method for forwarding data messages between first and second host computers. To send, to a first machine executing on the first host computer, a flow from a second machine executing on the second host computer, the method identifies a destination network address of the flow. The method uses the identified destination network address to identify a particular tunnel endpoint group (TEPG) including a particular set of one or more tunnel endpoints (TEPs) associated with a particular non-uniform memory access (NUMA) node of a set of NUMA nodes of the first host computer. The particular NUMA node executes the first machine. The method selects, from the particular TEPG, a particular TEP as a destination TEP of the flow. The method sends the flow to the particular TEP of the particular NUMA node of the first host computer to send the flow to the first machine.

Systems and methods are disclosed for securely executing user-defined functions within a cloud data platform. A method involves receiving, via hardware processors, a request to execute a user-defined function (UDF) contained within a sandbox process. The UDF comprises code for performing specified operations that necessitate access to external resources. To facilitate this access, a secure egress path is established using an overlay network designed to isolate the UDF's network traffic from other processes. Authentication and authorization details for the UDF are managed externally to the sandbox process, ensuring that the UDF's functionality remains orthogonal to the cloud data platform's operations. This approach enables the secure and controlled execution of UDFs, allowing them to interact with external systems while maintaining the integrity and security of the cloud data platform environment.

Techniques are disclosed for implementing a key management service in a reduced footprint data center. A cryptographic service can execute at a computing device of the reduced footprint data center. The cryptographic service can generate a master encryption key and encrypt the master encryption key using a secure component of the computing device to produce an encrypted master encryption key. The encrypted master encryption key can be stored in a block storage volume communicatively connected to the computing device. The cryptographic service can transmit the master encryption key to a host region data center and receive a wrapped master encryption key. The cryptographic service can store the wrapped master encryption key in a database of the reduced footprint data center.

A VXLAN access authentication method includes: An authentication point device receives a VXLAN authentication packet, where the VXLAN authentication packet is a VXLAN packet. The VXLAN authentication packet includes a VXLAN header and an authentication request sent by a terminal, the VXLAN header includes a first VNI, and the authentication request includes an authentication credential. The authentication point device obtains permission of the terminal or a second VNI based on the authentication credential. The permission of the terminal corresponds to the second VNI. The authentication point device sends the permission of the terminal or the second VNI to a control point device, where the control point device is a device that encapsulates the authentication request into the VXLAN authentication packet. In this application, VXLAN access authentication is performed on an overlay network, so that configuration complexity can be reduced when a VXLAN access authentication mode is modified or created.

A bot detection service associated with an overlay network operates to score traffic as a probability of being a bot, as opposed to returning a binary classification (i.e., bot or human). According to the approach herein, scoring is determined through probability estimates, wherein a score (the probability) is based on considering a set of detections concurrently. In one embodiment, all (or substantially all) triggered (current) threat detections contribute to the score. The preferred approach penalizes requests that fail all (or substantially all) combinations of detection algorithms. According to a further feature, an automated tuning (autotuning) is also applied, e.g., using real-time empirical statistical models, to adapt the measurement of false positive probability for one or more threat detection algorithms to suit customer traffic trends. The approach herein is also extensible to include any number of future threat detection algorithms.

The invention discloses an Internet of Things equipment linkage control method and system based on cloud computing and a storage medium, and relates to the technical field of intelligent control. The method comprises the following steps: constructing a home coverage network; executing network partition aggregation, establishing a network partition aggregation result, and configuring a distributed computing center; synchronizing monitoring data of the sensor group to a distributed computing center; calling and positioning the home equipment by using the distributed computing center, reading the equipment state of the corresponding home equipment, performing linkage control optimization of the equipment in the region, and establishing a first linkage control result; if the probability evaluation result of the partition linkage meets a preset threshold value, synchronizing the first linkage control result and the monitoring data to a centralized computing center; and performing linkage control on the home equipment by using the second linkage control result. The technical problems of slow response and low efficiency of linkage control of the Internet of Things equipment in the prior art are solved, and the technical effect of improving the real-time performance and efficiency of linkage control of the Internet of Things equipment is achieved.

Network operators can define port mappings for UDP destination ports and the encapsulated protocol / traffic type (X) in UDP. BGP may be used to notify the UDP destination port-to-traffic type mapping to an encapsulator. A generic UDP encapsulation mechanism (X-in-UDP), where UDP can be used to encapsulate packets of any user configured protocol / traffic type X (e.g., IPv4, IPv6, MPLS, etc.), is described. Primary benefits of using UDP for encapsulation are to leverage UDP port numbers for load-balancing. Generic UDP encapsulation of any protocol / traffic type using user defined port-maps provides flexibility to network operators in constructing different overlay networks. UDP encapsulation helps leverage fine-grade load balancing over Equal-Cost Multipath (ECMP).

An edge gateway deployed within an overlay network interconnecting a first public cloud network with an on-premises network is described. Coupled to a controller, the edge gateway is configured to receive a configuration file and attestation data from a controller, analyze the configuration file to obtain at least a first network address being used as an interface for secure communications with the controller, establish a secure interconnect with the controller based on the attestation data, and conduct a provisioning operation to initiate a request to the controller for edge gateway software thereby automated provisioning the edge gateway without human intervention. The edge gateway experiences automated provisioning based on a configuration file and attestation data upload.

The present invention belongs to the technical field of network communications. Disclosed are a network quality tuning method and system. The method comprises: a controller controls a forwarding unit to create an overlay service; after completing the creation of the overlay service, the forwarding unit receives routing information; the forwarding unit reports the routing information to the controller; after receiving the routing information, the controller forms routing data and records same into the database; an underlay test module tests the underlay network quality; the underlay test module reports an underlay test result to a network quality monitoring module; an overlay test module tests the overlay network quality; when the network quality monitoring module determines that the network quality has anomaly, a fault processing module forms a flow tuning policy and notifies the controller; and the controller generates a corresponding tuning configuration according to the tuning policy, sends the tuning configuration to the forwarding unit, and completes sending of the tuning configuration by means of the forwarding unit.

Embodiments are directed to managing communication over a network. Entities may be determined based on network traffic in an underlay network and classified based on characteristics of the entities, portions of the network traffic in the underlay network, or the like. Policies for an overlay network may be generated based on the classified entities or the portions of the network traffic. Policies may be deployed to gateways that may be associated with the entities such that the gateways facilitate access to the overlay network based on the policies. In response to determining other entities in the underlay network based on other network traffic in the overlay network and the network traffic in the underlay network, the one or more policies may be updated based on the other network traffic in the overlay network, the network traffic in the underlay network, or the one or more other entities.

The invention discloses a full-quadrilateral grid generation method based on a predefined mode, and particularly relates to the technical field of grid generation, and the method comprises the specific steps: cleaning a geometric model, setting a predefined mode of grid generation according to the cleaned geometric model, and defining a grid generation rule, the method comprises the following steps: carrying out grid division according to a geometric model and a predefined mode, generating a full-quadrilateral grid based on an overlay network technology, carrying out cooperative scheduling on generation of the full-quadrilateral grid by utilizing a mode based on a distributed architecture platform, optimizing the full-quadrilateral grid by utilizing a post-processing technology, and carrying out quality inspection on the generated full-quadrilateral grid. According to the method, the generation efficiency of the full-quadrilateral grid is evaluated by combining the result of quality inspection of the full-quadrilateral grid and the calculation precision in the grid generation process, and a grid quality control strategy is provided according to the evaluation result, so that the contradiction between data consistency and processing speed when a large-scale complex geometric model is processed is effectively solved.

Some embodiments provide a method for configuring a network to bridge data messages between a logical overlay network layer 2 (L2) segment and a physical L2 segment. The method identifies each host computer in the network on which at least one logical network endpoint connected to the logical overlay network L2 segment executes. For each identified host computer, the method configures a forwarding element executing on the identified host computer to bridge (i) data messages sent from the logical network endpoints executing on the identified host computer to network endpoints connected to the physical L2 segment and (ii) data messages sent from network endpoints connected to the physical L2 segment, executing on the identified host computer and on other host computers in the network, to the logical network endpoints executing on the identified host computer.

Embodiments are directed to using remote pods. An intermediary software is instantiated in a worker node virtual machine and is used to cause a pod virtual machine to be created, the pod virtual machine being remote from the worker node virtual machine. An overlay network is established between the intermediary software in the worker node virtual machine and a pod space in the pod virtual machine. The overlay network is used to cause containers to be created in the pod virtual machine, where the worker node virtual machine is configured to use the overlay network to manage communications with the pod virtual machine.

The invention discloses a data transmission method and device, and belongs to the technical field of communication. The method comprises the following steps: acquiring a first message, wherein the first message is a message needing to be transmitted in an overlay network; and packaging the first message to obtain a second message, and transmitting the second message through the overlay network. Wherein the header of the second message comprises a service extension field, the service extension field is used for carrying service information, and the service information is used for realizing the corresponding service. According to the method provided by the invention, the new service can be flexibly expanded through the message transmitted in the overlay network.

The invention discloses a network threat systematic protection method, and belongs to the technical field of network security. According to the method, a unified policy center is constructed, and three layers of security policies of an overlay network, a terminal and an application are defined and issued in a unified manner; network admission control, terminal security management and API risk monitoring systems are deployed to execute strategies respectively; an intelligent linkage mechanism is established, and cross-system automatic co-processing is realized; centralized monitoring, data aggregation and visual analysis are carried out through the unified safety operation center, and support is provided for optimization; and continuously optimizing the strategy and the rule based on the operation data. According to the invention, the problems of isolation, strategy splitting and response lag of a protection system in the prior art are solved, and an active defense system with cooperative linkage and continuous evolution is constructed.

A system and method for controlling the handling of intra-VPC and inter-VPC communications is described. First, a destination of a communication is determined it resides within a first virtual private cloud network (VPC) of a source of the communication. If so, filtering communications between the destination and the source is controlled by native cloud constructs associated with a cloud service provider (CSP) underlay network for the first public cloud network. Otherwise, filtering communication between the destination and the source is controlled by a spoke gateway. The spoke gateway is part of a cloud overlay network configured to provide a communication path between the first virtual private cloud network and the second private cloud network and using micro-segmentation to set and manage security policies.

A user equipment, UE, apparatus comprising: a transceiver arranged to communicate with a first mobile network; and a processor arranged to: receive a UE Route Selection Policy, URSP, rule from the first mobile network (e.g. an underlay network), wherein the URSP rule indicates traffic that is to be sent to a second mobile network (e.g. an overlay network) via the first mobile network; detect traffic that matches the URSP rule; establish, using the transceiver, a first data connection in the first mobile network based on the URSP rule; establish, using the transceiver, connectivity to the second mobile network via the first data connection; and send, using the transceiver, selected traffic to the second mobile network via the established connectivity to the second mobile network, the selected traffic being the traffic that matches the URSP rule.

Techniques are disclosed for overlaying logical switch fabrics upon a physical switch fabric comprising multiple physical switch devices. In one example, a network device determines an overlay network associated with a received packet. The network device determines a logical identifier that is associated with the overlay network. In some examples, the logical identifier corresponds to a color. The network device selects a logical switch fabric that is associated with the logical identifier from a plurality of other logical switch fabrics that are overlaid upon a physical switch fabric comprising a plurality of network switch devices. The network device forwards the received packet to the selected logical switch fabric for transport across the physical switch fabric.

A network device in a first fabric of an overlay network is provided. During operation, the network device can receive a route advertisement from a border device via which the network device communicates outside of the first fabric. The network device can determine, based on an indicator in the route advertisement, whether a host route associated with a host coupled to a second fabric of the overlay network is included in the route advertisement. If the indicator indicates that the host route is included in the route advertisement, the network device can store the host route in a data structure on the network device. The network device can also program, in the local forwarding hardware, a prefix route associated with the host route. If the network device detects a packet destined to the host device, the network device can program the host route in the forwarding hardware.