379 results about "Virtual network interface" patented technology

Methods, systems, and computer programs for creating isolated environments that include virtual machines (VM) and networks in a virtual infrastructure are presented. The method includes an operation to define a configuration of a virtual system which includes VMs, virtual network interface cards (VNIC) in the VMs, and configuration local networks (CLN). Further, the method associates each VNIC with one of the CLNs and transmits instructions to the virtual infrastructure for deploying the configuration. Deploying the configuration includes instantiating VMs and CLNs in the virtual infrastructure. Each VM is instantiated in a host monitored by a virtual lab server, and the CLNs are instantiated in the same hosts where the VMs have been instantiated. Only VMs from the configuration can connect to the instantiated CLNs. The method further transmits instructions to the virtual infrastructure to customize the VMs by executing the customization instructions in the guest operating systems of the VMs to configure the VMs' VNICs.

Firewalls and network address translators (NAT) provide many advantages for client and the Internet itself, however, these devices break many existing transmission control protocol (TCP)/Internet Protocol (IP) applications, since they conceal the identity of IP clients (i.e., peers) and block transmission control protocol (TCP) call setup requests. Firewalls and NATs make it impossible for one TCP peer to discover another and establish a connection. Embodiments of this invention provides a system and a protocol to enable two TCP peers that exist behind one or more firewalls and NATs to automatically setup a true peer-to-peer TCP connection and exchange data without making changes to the firewall or NAT devices or existing TCP-based applications. In embodiments of this invention, the synchronization between the blind TCP peers is achieved using a system that consists of a registration server, an agent application, and a virtual network interface that together relay and replicate the control signals between the two TCP peers. In addition, embodiments of this invention are also used to traverse the NAT and establish a bi-directional peer-to-peer TCP connection in the firewall.

A method and an apparatus of hypervisor level distributed load-balancing are disclosed. In one aspect, a method includes determining a location to direct a packet. The method also includes distributing the packet to process the packet through a processor. The method also includes assigning the packet to a guest such that a distribution of the packet to the guest is based on an algorithm. The method further includes altering a first destination address of the packet to a second destination address. The second destination address may be based on a virtual network interface of the guest. The method further includes convincing the guest the packet is from a virtual switch based on the second destination address. In addition, the method includes adjusting the distribution of the packet to the guest. The method also includes reducing a load of the guest through the adjustment.

This disclosure describes a system for Single Root I/O Virtualization (SR-IOV) pass-thru for network packet processing via a virtualized environment of a device. The system includes a device comprising a virtualized environment and a plurality of virtual machines having a virtual network interface for receiving and transmitting network packets. A driver for the physical network interface of the device creates a plurality of virtual devices corresponding to the physical network interface, which appear as a Peripheral Component

Interconnect (PCI) device to the virtualized environment. A virtual device of the plurality of virtual devices is assigned via the virtualized environment to each virtual machine of the plurality of virtual machines. The virtual machine uses the virtual device assigned to the virtual machine, to receive and transmit network packets via the physical network interface of the device.

A remote management controller is provided for use in conjunction with a managed host computer. The remote management controller exposes a virtual network interface controller, such as a driverless virtual USB network interface controller, to the managed host computer. Through the in-band connection provided by the virtual network interface controller, the remote management controller can communicate with in-band management applications executing on the managed host computer. The managed host computer can also access services executing on the remote management controller through the in-band communications interface. The remote management controller can also enable communication between the management client computer and in-band management applications executing on the managed host computer. The managed host computer can also access an out-of-band communications network between the remote management device and a management client computer.

A network system is provided between at least a first client site and a second client site, the first and the second client site are at a distance from one another. A client site network component is implemented at least at the first client site, the client site network component bonding or aggregating one or more diverse network connections so as to configure a bonded/aggregated connection that has increased throughput. At least one network server component may be configured to connect to the client site network component using the bonded/aggregated connection. A cloud network controller may be configured to manage the data traffic and a virtual edge providing transparent lower-link encryption for the bonded/aggregated connection between the client site network component and the network server component.

A first computer stores a correspondence between a virtual channel and a physical channel(s) in physical channel information and transmits the correspondence between the virtual channel and the physical channel(s) to a second computer having a virtual network interface to which a data transmission instruction is addressed. Upon receiving the correspondence between the virtual channel and the physical channel(s), the second computer stores the received correspondence in the physical channel information. The first computer transmits data in accordance with the data transmission instruction, using one or more physical channels associated with the virtual channel, based on the correspondence stored.

An information processing system which includes: a storage controlling module in any of computer apparatuses that runs a clone origin virtual machine, where the storage controlling module controls: booting up the clone origin virtual machine when the clone origin virtual machine is detached from a virtual network interface; acquiring running state information indicating a running state of the clone origin virtual machine; and storing an image including the running state information and virtual disk information in a storage apparatus; and a boot controlling module in any of computer apparatuses that creates a clone virtual machine, where the boot controlling module controls: resuming at least one of the clone virtual machines with the image when each of the clone virtual machines is detached from the virtual network interface; and attaching the virtual network interface to the at least one clone virtual machine.

Methods, software, and apparatus for implementing local service chaining (LSC) with virtual machines (VMs) or virtualized containers in Software Defined Networking (SDN). In one aspect a method is implemented on a compute platform including a plurality of VMs or containers, each including a virtual network interface controller (vNIC) communicatively coupled to a virtual switch in an SDN. LSCs are implemented via a plurality of virtual network appliances hosted by the plurality of VMs or containers. Each LCS comprises a sequence (chain) of services performed by virtual network appliances defined for the LSC. In connection with performing the chain of services, packet data is forwarded between VMs or containers using a cut-through mechanisms under which packet data is directly written to receive (Rx) buffers on the vNICs in a manner that bypasses the virtual switch. LSC indicia (e.g., through LSC tags) and flow tables are used to inform each virtual network appliance and/or or its host VM or container of the next vNIC Rx buffer or Rx port to which packet data is to be written.

A plurality of machine systems constituted by different VLAN constitution methods are integrated on one machine system by using virtual machines. An operation can be switched for virtual network interface cards to VLAN communication corresponding to VLAN ID set to a virtual network interface card or to VLAN communication corresponding to VLAN ID set by OS on a virtual machine using the virtual network interface card depending on whether or not VLAN ID is set.

Systems and methods implemented by a unified agent application executed on a mobile device, for unified service discovery and secure availability include authenticating a user into a plurality of cloud services including a proxy service and a Virtual Private Network (VPN) service, wherein the proxy service is utilized for Internet traffic and the VPN service is for Intranet traffic; creating and operating a link local network at the mobile device with a virtual network interface and multiple listening sockets; and intercepting traffic at the virtual network interface from one or more client applications on the mobile device and splitting the traffic between the proxy service, the VPN service, and the Internet based on a type of the traffic, a destination, and the one or more client applications.

A data compute node executes (i) a set of tenant applications connected to a third party overlay network, (ii) a set of network manager applications, and (iii) a managed forwarding element that includes a pair of overlay and underlay network virtual adapters. A packet that is received from a network manager application and addressed to an underlay network destination is sent to the underlay network destination address through a physical NIC of the host without network address translation or encapsulation. A packet that is received from a tenant application and addressed to an underlay network destination is subject to SNAT and is sent to the underlay network destination address. A packet that is received from a tenant application and is addressed an overlay destination address is encapsulated with the header of the overlay network and is sent to the overlay network destination address through the underlay virtual adapter.

A virtualization framework provides security between multiple virtual machines with respect to network communications between the virtual machines and between the virtual machines and a physical network coupled to the underlying physical computer platform. The virtualization framework includes a network interface controller driver that provides an interface to the platform network interface controller and supports execution of a plurality of virtual machines. Each virtual machine includes a virtual network interface controller that provides a network communications path between the virtual machines and to the network interface controller driver. Each virtual network interface controller further contains a programmable network packet filter that controls the selective transfer of network packets with respect to a corresponding virtual machine.

Systems, methods, and non-transitory computer-readable medium are provided to secure data centers and cloud computing. A method receives network identifiers for functions, requests a network key for each function, allocates network interfaces, requests a virtual network interface controller allocation, requests a network key for each cloud function, receives storage identifiers for functions, requests a storage key for each cloud function, allocates virtual storage disks, requests a storage interface controller allocation, requests a storage key for each cloud function. Methods secure migration of a virtual machine from a source to a target server. A server includes multiple cores where each core is dedicated to a compute function and a unique key encrypts data of each compute function. A non-transitory computer-readable medium encodes programs that execute the above methods.

Methods and apparatus for detection and handling of virtual appliance failures. In one aspect, a method is implemented on a host platform on which a hypervisor (aka Virtual Machine Manager) and a plurality of virtual machines (VMs) are running, the plurality of VMs collectively hosting a plurality of Software Defined Networking (SDN) and/or Network Function Virtualization (NFV) appliances that are communicatively coupled via a virtual network. A software-based entity running on the host platform is configured to monitor the plurality of virtual network appliances to detect failures of the virtual network appliances. In response to detection of a virtual network appliance failure, messages containing configuration information are implemented to reconfigure packet flows to bypass the virtual network appliance that has failed.

The embodiment of the invention discloses a virtual network mapping processing method and system. The method comprises the following steps: according to perimeter network status information of each region sent by management entity equipment in each region, dividing the request topology of a received virtual network topology request into a plurality of virtual subnets, and decomposing each virtualsubnet into a virtual element request sequence respectively; distributing each virtual element request sequence to the management entity equipment in each region, and carrying out mapping matching onthe logical topology and physical topology of each virtual subnet by the management entity equipment in each region in accordance with each virtual element request sequence; and merging virtual subnet mapping information sent by the management entity equipment in each region, and feeding back generated final mapping information after merging to virtual network users. The system comprises central management entity equipment and a plurality of regional management entity equipment. By utilizing the method and system provided by the invention, the processing bottleneck problem caused by overhigh computing resource consumption in the prior art is solved.

A method and apparatus that determines a plurality of matching policies for a segment of a dynamic virtualized network is described. A device retrieves a virtual network identifier of the segment, where the virtual network identifier includes a plurality of bits and a plurality of subnets and each of the plurality of subnets is a different subset of the plurality of bits. In addition, the dynamic virtualized network is a virtualized layer 2 network that is overlaid on a layer 3 physical network, where the layer 3 physical network includes a plurality of network access devices, and the segment includes a plurality of endpoints. The device further determines the plurality of matching policies for the segment from the plurality of subnets of the virtual network identifier, where each of the plurality of subnets corresponds to one of the plurality of matching policies. The device additionally applies the plurality of matching policies to each network access device that corresponds to one of the plurality of matching endpoints.

Mechanisms provide hosts such as servers and mobile devices with access to virtualized I/O resources including virtual Host Bus Adapters (vHBAs) and virtual Network Interface Cards (vNICs) over a wireless I/O interconnect. Host applications access virtualized I/O resources using virtual device drivers that communicate with virtualized I/O resources on an I/O director using a reliable communication protocol running over a wireless network. I/O data is throttled if necessary based on wireless network considerations.

The invention discloses a communication system used among polykaryon multi-operating systems. The data transmission is completed among the operating systems through a virtual data channel, and the virtual data channel comprises a virtual interface (such as a virtual network interface) corresponding to the operating systems which are mutually connected. The invention also discloses a communication method among polykaryon multi-operating systems. The invention dose not use a hardware chip, thus the hardware cost is lowered; third party software can be migrated without alteration, thus the software migrating cost is lowered; the data receiving and sending can be realized by adopting shared memory and inter-karyon information, thus no copy of the data is realized, and the data receiving and sending efficiency is increased.

The invention relates to the technical field of cloud computing management, in particular to a method for distributed virtual networks applicable to a cloud platform. According to the method, any number of physical nodes are selected as network nodes of the cloud platform, and the network nodes establish and provide virtual network service; establishment of the network nodes includes the steps that (1), a virtual switch module is installed and started, and a virtual switch and an intranet network bridge are established; (2), an intranet network card is connected into the intranet network bridge; (3), the virtual switch and the intranet network bridge are connected, and a communication module for the node and other intranet nodes is set; (4), local VLAN ports are added; (5), the multiple virtual networks are established; (6), a virtual route is established; (7), an extranet network bridge is established, and an extranet network card is connected in; (8), a virtual route is established. Single-point failures of centralized network service of the cloud platform can be avoided, load balance of the network service nodes is achieved, the virtual networks can be managed flexibly and conveniently, and the method can be used for realizing the distributed virtual networks.

Methods and apparatus are provided for integrated deflection, detection and intrusion. Within a single computer system configured for operating system virtualization (e.g., Solaris, OpenSolaris), multiple security functions execute in logically independent zones or containers, under the control and administration of a global zone. Such functions may illustratively include a demilitarized zone (DMZ) and a honeypot. Management is facilitated because all functions work within a single operating system, which promotes the ability to configure, monitor and control each function. Any given zone can be configured with limited resources, a virtual network interface circuit and/or other features.