237 results about "Overlay network" patented technology

A multi-cloud overlay network for supporting communications between a first public cloud network and a second public cloud network. The overlay network features a management virtual private network, which includes a network load balancing (NLB) component and a controller registered as a target on a port of the NLB component. The overlay network further includes one or more spoke or transit gateways and a multi-cloud access virtual private cloud (VPC) operating within the first public cloud network, and a remote cloud load balancer component operating the second public cloud network. The remote cloud load balancer component is communicatively coupled between the multi-cloud access VPC and one or more remote spoke or transit gateways. The multi-cloud access VPC includes a VPC endpoint that is assigned a private IP address and communicatively coupled to the NLB component and a virtual private network (VPN) gateway communicatively coupled to a private transport.

Embodiments are directed to managing access to network resources. A first mesh agent may be configured to provide a client with access to a resource via an overlay network. The first mesh agent may determine an identity and an activity associated with requests such that the identity corresponds to an entity that may be authenticated to access the overlay network and the resource. A policy container associated with the activity may be determined based on characteristics of the requests such that the policy container may include policies associated with the activity. The requests may be validated based on the policies included in the policy container such that the validated requests may be forwarded to the resource and invalidated requests may be discarded and such that persistence of the connection may be maintained during the validation.

The invention is suitable for the field of abnormal data monitoring, and provides an abnormal data monitoring method and system based on artificial intelligence, and the system comprises a real-time data flow collection module, a cross-level correlation analysis module, a dynamic baseline model building module, an abnormal behavior comparison module, and an abnormal traceability module. According to the method, through real-time data acquisition, cross-hierarchy analysis, dynamic modeling, anomaly detection and deep threat tracing, an efficient and intelligent anomaly monitoring closed loop is constructed, and remarkable beneficial effects are presented. According to the method, firstly, real-time data flow capture and cross-level correlation analysis are utilized to ensure that interaction behaviors of multiple protocol levels in a network are comprehensively covered, and a complex abnormal mode is recognized in combination with context information; according to the multi-dimensional analysis, the detection accuracy is remarkably improved, false alarm and missing alarm are effectively reduced, meanwhile, an abnormal mark data set with weights is generated, and high-quality data support is provided for follow-up processes.

The invention discloses a graph mapping method based on precise synthesis, and the method comprises the steps: constructing a precise synthesis structure library based on NPN equivalence classes, and inputting the precise synthesis structure library into a Boolean network; k-Cut cutting enumeration is carried out on the input Boolean network, a truth table is calculated, cutting is matched with a structure in a precise comprehensive structure library through Boolean matching, and rapid search is realized in combination with NPN classification; the overlay network is generated through multi-round mapping optimization, logic sharing nodes are mined in combination with structural hash, and the multi-round mapping optimization comprises delay-oriented mapping, global area topological optimization and local accurate area optimization; and a new target network is generated based on the optimized overlay network, redundant nodes are removed, and final network construction is completed. According to the method, manual intervention is not needed through full-process automatic mapping and a redundancy removal mechanism, the labor cost of a technical mapping link in chip design is remarkably reduced, and the method is particularly suitable for efficient design of complex circuits and emerging majority of logic base technologies.

The invention discloses an ultra wide band direction finding information extraction method based on a multi-input single-output delay superposition network. The method comprises the following steps: acquiring an antenna receiving signal and an attitude transformation matrix of an antenna; processing an antenna receiving signal to obtain a time point of a first peak leading edge detection threshold value and pulse sequence data in a complex form; carrying out 64-time up-sampling processing on the pulse sequence data in the plural form, and drawing an amplitude-time curve and a phase-time curve; determining a peak value corresponding to the adjacent antenna according to the peak value leading edge time point; calculating the peak values corresponding to the adjacent antennas to obtain the time difference of arrival and the phase difference of the adjacent antennas; and ultra-wideband direction-finding information positioning is realized. According to the invention, group delay can be carried out on the ultra-wideband pulse signal by adopting the delay line with the given length, and the ultra-wideband direction-finding information positioning precision is improved. The ultra wide band direction finding information extraction method based on the multi-input single-output delay overlay network can be widely applied to the technical field of ultra wide band positioning.

A network controller in an overlay network maintains a total set of identification-based policies and identification mappings for online users of the network for distribution to notifications across network elements of the network. When a new user is online, the controller identifies a site of a network where the user is online, and determines an identification map and applicable policy for the user for distribution to network elements at the identified site. The controller assigns an index value to each identity and communicates the index with the corresponding identity map and policy to the network element. The network element encapsulates cross-site traffic with an index value corresponding to the sender, so that the receiver network element can obtain the index value from the encapsulated header format, query the controller for a corresponding identification map, and apply a policy to traffic determined as relevant based on the sender's identification map obtained from the controller.

Embodiments provide solutions for establishing a secure communication channel between systems. A controller e.g. an administrator is able to construct a logical network of computing resources and define the relationships between those resources and the hierarchical structures that they are part of. Tags are used to label or identify the resources in accordance with their role or class within their network e.g. “staff laptop”, “guest laptop” etc., and multiple Tags can be assigned to a given resource. Policies (rules) associated with each tag provide a richness of functionality for each type of class as well as enabling constraints regarding use, security and / or user-related permissions to be applied across an entire group of network resources in a simple, efficient and secure manner. The controller can construct, define and control the resources within the connected environment. Embodiments provide solutions for preventing ARP poisoning attacks, and also improved approaches to DNS and PKI in an overlay network.

Systems and methods are disclosed for securely executing user-defined functions within a cloud data platform. A method involves receiving, via hardware processors, a request to execute a user-defined function (UDF) contained within a sandbox process. The UDF comprises code for performing specified operations that necessitate access to external resources. To facilitate this access, a secure egress path is established using an overlay network designed to isolate the UDF's network traffic from other processes. Authentication and authorization details for the UDF are managed externally to the sandbox process, ensuring that the UDF's functionality remains orthogonal to the cloud data platform's operations. This approach enables the secure and controlled execution of UDFs, allowing them to interact with external systems while maintaining the integrity and security of the cloud data platform environment.

Techniques are disclosed for implementing a key management service in a reduced footprint data center. A cryptographic service can execute at a computing device of the reduced footprint data center. The cryptographic service can generate a master encryption key and encrypt the master encryption key using a secure component of the computing device to produce an encrypted master encryption key. The encrypted master encryption key can be stored in a block storage volume communicatively connected to the computing device. The cryptographic service can transmit the master encryption key to a host region data center and receive a wrapped master encryption key. The cryptographic service can store the wrapped master encryption key in a database of the reduced footprint data center.

A VXLAN access authentication method includes: An authentication point device receives a VXLAN authentication packet, where the VXLAN authentication packet is a VXLAN packet. The VXLAN authentication packet includes a VXLAN header and an authentication request sent by a terminal, the VXLAN header includes a first VNI, and the authentication request includes an authentication credential. The authentication point device obtains permission of the terminal or a second VNI based on the authentication credential. The permission of the terminal corresponds to the second VNI. The authentication point device sends the permission of the terminal or the second VNI to a control point device, where the control point device is a device that encapsulates the authentication request into the VXLAN authentication packet. In this application, VXLAN access authentication is performed on an overlay network, so that configuration complexity can be reduced when a VXLAN access authentication mode is modified or created.

A bot detection service associated with an overlay network operates to score traffic as a probability of being a bot, as opposed to returning a binary classification (i.e., bot or human). According to the approach herein, scoring is determined through probability estimates, wherein a score (the probability) is based on considering a set of detections concurrently. In one embodiment, all (or substantially all) triggered (current) threat detections contribute to the score. The preferred approach penalizes requests that fail all (or substantially all) combinations of detection algorithms. According to a further feature, an automated tuning (autotuning) is also applied, e.g., using real-time empirical statistical models, to adapt the measurement of false positive probability for one or more threat detection algorithms to suit customer traffic trends. The approach herein is also extensible to include any number of future threat detection algorithms.

Network operators can define port mappings for UDP destination ports and the encapsulated protocol / traffic type (X) in UDP. BGP may be used to notify the UDP destination port-to-traffic type mapping to an encapsulator. A generic UDP encapsulation mechanism (X-in-UDP), where UDP can be used to encapsulate packets of any user configured protocol / traffic type X (e.g., IPv4, IPv6, MPLS, etc.), is described. Primary benefits of using UDP for encapsulation are to leverage UDP port numbers for load-balancing. Generic UDP encapsulation of any protocol / traffic type using user defined port-maps provides flexibility to network operators in constructing different overlay networks. UDP encapsulation helps leverage fine-grade load balancing over Equal-Cost Multipath (ECMP).

An edge gateway deployed within an overlay network interconnecting a first public cloud network with an on-premises network is described. Coupled to a controller, the edge gateway is configured to receive a configuration file and attestation data from a controller, analyze the configuration file to obtain at least a first network address being used as an interface for secure communications with the controller, establish a secure interconnect with the controller based on the attestation data, and conduct a provisioning operation to initiate a request to the controller for edge gateway software thereby automated provisioning the edge gateway without human intervention. The edge gateway experiences automated provisioning based on a configuration file and attestation data upload.

Embodiments are directed to managing communication over a network. Entities may be determined based on network traffic in an underlay network and classified based on characteristics of the entities, portions of the network traffic in the underlay network, or the like. Policies for an overlay network may be generated based on the classified entities or the portions of the network traffic. Policies may be deployed to gateways that may be associated with the entities such that the gateways facilitate access to the overlay network based on the policies. In response to determining other entities in the underlay network based on other network traffic in the overlay network and the network traffic in the underlay network, the one or more policies may be updated based on the other network traffic in the overlay network, the network traffic in the underlay network, or the one or more other entities.

Some embodiments provide a method for configuring a network to bridge data messages between a logical overlay network layer 2 (L2) segment and a physical L2 segment. The method identifies each host computer in the network on which at least one logical network endpoint connected to the logical overlay network L2 segment executes. For each identified host computer, the method configures a forwarding element executing on the identified host computer to bridge (i) data messages sent from the logical network endpoints executing on the identified host computer to network endpoints connected to the physical L2 segment and (ii) data messages sent from network endpoints connected to the physical L2 segment, executing on the identified host computer and on other host computers in the network, to the logical network endpoints executing on the identified host computer.

Embodiments are directed to using remote pods. An intermediary software is instantiated in a worker node virtual machine and is used to cause a pod virtual machine to be created, the pod virtual machine being remote from the worker node virtual machine. An overlay network is established between the intermediary software in the worker node virtual machine and a pod space in the pod virtual machine. The overlay network is used to cause containers to be created in the pod virtual machine, where the worker node virtual machine is configured to use the overlay network to manage communications with the pod virtual machine.

The invention discloses a data transmission method and device, and belongs to the technical field of communication. The method comprises the following steps: acquiring a first message, wherein the first message is a message needing to be transmitted in an overlay network; and packaging the first message to obtain a second message, and transmitting the second message through the overlay network. Wherein the header of the second message comprises a service extension field, the service extension field is used for carrying service information, and the service information is used for realizing the corresponding service. According to the method provided by the invention, the new service can be flexibly expanded through the message transmitted in the overlay network.

The invention discloses a network threat systematic protection method, and belongs to the technical field of network security. According to the method, a unified policy center is constructed, and three layers of security policies of an overlay network, a terminal and an application are defined and issued in a unified manner; network admission control, terminal security management and API risk monitoring systems are deployed to execute strategies respectively; an intelligent linkage mechanism is established, and cross-system automatic co-processing is realized; centralized monitoring, data aggregation and visual analysis are carried out through the unified safety operation center, and support is provided for optimization; and continuously optimizing the strategy and the rule based on the operation data. According to the invention, the problems of isolation, strategy splitting and response lag of a protection system in the prior art are solved, and an active defense system with cooperative linkage and continuous evolution is constructed.

A system and method for controlling the handling of intra-VPC and inter-VPC communications is described. First, a destination of a communication is determined it resides within a first virtual private cloud network (VPC) of a source of the communication. If so, filtering communications between the destination and the source is controlled by native cloud constructs associated with a cloud service provider (CSP) underlay network for the first public cloud network. Otherwise, filtering communication between the destination and the source is controlled by a spoke gateway. The spoke gateway is part of a cloud overlay network configured to provide a communication path between the first virtual private cloud network and the second private cloud network and using micro-segmentation to set and manage security policies.

A user equipment, UE, apparatus comprising: a transceiver arranged to communicate with a first mobile network; and a processor arranged to: receive a UE Route Selection Policy, URSP, rule from the first mobile network (e.g. an underlay network), wherein the URSP rule indicates traffic that is to be sent to a second mobile network (e.g. an overlay network) via the first mobile network; detect traffic that matches the URSP rule; establish, using the transceiver, a first data connection in the first mobile network based on the URSP rule; establish, using the transceiver, connectivity to the second mobile network via the first data connection; and send, using the transceiver, selected traffic to the second mobile network via the established connectivity to the second mobile network, the selected traffic being the traffic that matches the URSP rule.

Techniques are disclosed for overlaying logical switch fabrics upon a physical switch fabric comprising multiple physical switch devices. In one example, a network device determines an overlay network associated with a received packet. The network device determines a logical identifier that is associated with the overlay network. In some examples, the logical identifier corresponds to a color. The network device selects a logical switch fabric that is associated with the logical identifier from a plurality of other logical switch fabrics that are overlaid upon a physical switch fabric comprising a plurality of network switch devices. The network device forwards the received packet to the selected logical switch fabric for transport across the physical switch fabric.

A network device in a first fabric of an overlay network is provided. During operation, the network device can receive a route advertisement from a border device via which the network device communicates outside of the first fabric. The network device can determine, based on an indicator in the route advertisement, whether a host route associated with a host coupled to a second fabric of the overlay network is included in the route advertisement. If the indicator indicates that the host route is included in the route advertisement, the network device can store the host route in a data structure on the network device. The network device can also program, in the local forwarding hardware, a prefix route associated with the host route. If the network device detects a packet destined to the host device, the network device can program the host route in the forwarding hardware.

A first network device operating as a tunnel endpoint in a tunnel fabric is provided. During operation, the first network device can receive, via a local port, a network join request to receive multicast traffic of a multicast group from a second network device. The first network device can store a multicast state for the multicast group in a data structure associated with the control plane. The multicast state can indicate that the network join request is received via a tunnel between the first and second network devices. The first network device can then determine whether a source of the multicast group is coupled to the first network device. If the source is coupled to the first network device, it can program a multicast forwarding entry corresponding to the multicast state in forwarding hardware and forward the multicast traffic to the second network device based on the multicast forwarding entry.

Some embodiments provide a method for configuring a network to bridge data messages between a hardware-implemented L2 overlay network segment and a software-implemented L2 overlay network segment. The method identifies a host computer on which a logical network endpoint connected to the software-implemented overlay executes. The hardware-implemented L2 overlay connects at least a first set of network endpoints located in a first physical network zone and connected to a first L2 network segment and a second set of network endpoints located in a second physical network zone and connected to a second L2 network segment. The identified host computer is located in the first physical network zone. The method configures a forwarding element executing on the host computer to bridge data messages between the logical network endpoint and (i) the first set of network endpoints and (ii) the second set of network endpoints.

To provide systems, methods, and devices for improved routing operations in a network computing environment.SOLUTION: An architecture 400 for host routed overlay includes a virtual customer edge router (virtual CE router), a plurality of host virtual machines, and a routed uplink from the virtual customer edge router to one or more of a plurality of leaf nodes L1 to L4. The architecture is such that the virtual customer edge router provides localized integrated routing and bridging (IRB) service for the plurality of host virtual machines of the host routed overlay.SELECTED DRAWING: Figure 4

The invention belongs to the technical field of computer information security, and particularly relates to a computer information real-time security detection method and system. According to the method, the whole detection process can quickly respond to security threat changes through the real-time acquisition and dynamic compensation mechanism of the multi-source data, potential attacks can be found and defended in time, the threat assessment and compensation mechanism is continuously optimized through multi-round iteration, the detection precision and the real-time response capability are effectively improved, and the detection efficiency is improved. Various data sources such as network traffic, memory access, program behaviors and system logs are adopted, all links of network security attacks can be comprehensively covered, the risk of misjudgment or missed judgment of single data is reduced, all the data sources complement one another, details of abnormal behaviors can be more accurately captured, and therefore the detection capacity for complex attack techniques is enhanced, and the detection efficiency is improved. The method can adapt to a novel attack technology and a rapidly changing network environment.

The invention relates to the technical field of distributed system architecture, and particularly provides a high-concurrency message processing method and system, and the method comprises the following steps: S1, carrying out the registration of a dynamic consumer group; s2, adopting a multi-stage retry strategy to carry out exception handling chain design; and S3, memory and performance optimization. Compared with the prior art, an independent message queue assembly does not need to be deployed, Redis infrastructure is reused, and the operation and maintenance overhead is reduced by 50% or above; a single node supports 100,000 + TPS, which is improved by 3-5 times compared with a traditional message queue; if the message loss rate is lower than 0.001%, the retry mechanism covers network jitter and service fault scenes; dynamic adjustment of the number of consumers and Redis Cluster fragmentation is supported, and the service elastic requirement is met.

Technique or mechanism in which network security policies are applied close to the source or origin associated with policy decisions. For example. the disclosed technology moves dropped flows from a firewall cluster to a leaf switch based on host location.

Techniques are disclosed for implementing a key management service in a reduced footprint data center. A cryptographic service can execute at a computing device of the reduced footprint data center. The cryptographic service can generate a master encryption key and encrypt the master encryption key using a secure component of the computing device to produce an encrypted master encryption key. The encrypted master encryption key can be stored in a block storage volume communicatively connected to the computing device. The cryptographic service can transmit the master encryption key to a host region data center and receive a wrapped master encryption key. The cryptographic service can store the wrapped master encryption key in a database of the reduced footprint data center.

Example methods and systems for virtual tunnel endpoint (VTEP) mapping for overlay networking are described. One example may involve a computer system monitoring multiple VTEPs that are configured for overlay networking. In response to detecting a state transition associated with a first VTEP from a healthy state to an unhealthy state, the computer system may identify mapping information that associates a virtualized computing instance with the first VTEP in the unhealthy state; and update the mapping information to associate the virtualized computing instance with a second VTEP in the healthy state. In response to detecting an egress packet from the virtualized computing instance to a destination, an encapsulated packet may be generated and sent towards the destination based on the updated mapping information. The encapsulated packet may include the egress packet and an outer header identifying the second VTEP to be a source VTEP.