专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

21. 发明授权

US11171920B2 Publication of firewall configuration 有权
公开(公告)号：US11171920B2
公开(公告)日：2021-11-09
申请号：US15421285
申请日：2017-01-31
申请人： Nicira, Inc.
发明人： Kaushal Bansal , Uday Masurekar , Subrahmanyam Manuguri , Jingmin Zhou , Shadab Shah , Igor Ganichev
IPC分类号： H04L29/06
摘要： A novel method for distributing firewall configuration of a software defined data center is provided. The network manager of the data center receives update requests from tenants of the data center and correspondingly generates update fragments and delivers the generated update fragment to local control planes controlling the enforcing devices. Each local control plane in turn integrates the update fragments it receives into its firewall rules table. For each rule and/or section thusly integrated, the local control plane uses the rule or the section's assigned priority number to establish ordering in the firewall rules table of the local control plane.

22. 发明授权

US11088990B2 Translation cache for firewall configuration 有权
公开(公告)号：US11088990B2
公开(公告)日：2021-08-10
申请号：US15386214
申请日：2016-12-21
申请人： Nicira, Inc.
发明人： Kaushal Bansal , Uday Masurekar , Shadab Shah , James Joseph Stabile , Steven Peters
IPC分类号： H04L29/06 , G06F12/0813 , G06F12/0875
摘要： Some embodiments provide a method for distributing firewall configuration in a datacenter comprising multiple host machines. The method retrieves a rule in the firewall configuration for distribution to the host machines. The firewall rule is associated with a minimum required version number. The method identifies a high-level construct in the firewall rule. The method queries a translation cache for the identified high-level construct. The translation cache stores previous translation results for different high-level constructs. Each stored translation result is associated with a version number. When the translation cache has a stored previous translation result for the identified high-level construct that is associated with a version number that is equal to or newer than the minimum required version number, the method uses the previous translation result stored in the cache to translate the identified high-level construct to a low-level construct.

23. 发明授权

US10630644B2 Managing firewall flow records of a virtual infrastructure 有权
公开(公告)号：US10630644B2
公开(公告)日：2020-04-21
申请号：US15380885
申请日：2016-12-15
申请人： NICIRA, INC.
发明人： Shadab Shah , Kaushal Bansal , Uday Masurekar , Jerry Pereira , Sunitha Krishna
IPC分类号： H04L29/06
CPC分类号： H04L63/0263 , H04L63/0254 , H04L63/1425
摘要： In a computer-implemented method for managing firewall flow records, firewall flow records of a virtual infrastructure including a distributed firewall are received, wherein the firewall flow records are captured according to firewall rules of the distributed firewall, and wherein the firewall flow records each include tuples and at least one field of network traffic data. Responsive to detecting a number of received firewall flow records exceeding a threshold value, it is determined whether the tuples are identical for any of the firewall flow records. Provided the tuples are not identical for any of the firewall flow records, the tuples for the firewall flow records are modified to generate modified firewall flow records. It is determined whether the tuples are identical for any of the modified firewall flow records. Provided the tuples are identical for any of the modified firewall flow records, the modified firewall flow records for which the tuples are identical are coalesced into a single firewall flow record.

24. 发明授权

US10320665B2 Configuration of a logical router for dynamic routing 有权
公开(公告)号：US10320665B2
公开(公告)日：2019-06-11
申请号：US15642343
申请日：2017-07-06
申请人： NICIRA, INC.
发明人： Abhishek Goliya , Uday Masurekar , Minjal Agarwal
IPC分类号： H04L12/775 , H04L29/08
摘要： Some embodiments provide a method for configuring a logical router to exchange routing data with a neighboring router through a dynamic routing protocol. The logical router is implemented as multiple routing components. The method receives identification data for the neighboring router with which to peer the logical router. Based on the identification data, the method identifies a subset of the routing components to peer with the neighboring router. The method generates configuration data for each routing component in the identified subset. Each identified routing component uses the configuration data to exchange routing data with the neighboring router through the dynamic routing protocol.

25. 发明授权

US10129142B2 Route configuration for logical router 有权
公开(公告)号：US10129142B2
公开(公告)日：2018-11-13
申请号：US14871977
申请日：2015-09-30
申请人： Nicira, Inc.
发明人： Abhishek Goliya , Uday Masurekar
IPC分类号： H04L12/751 , H04L12/713 , H04L12/741 , H04L12/715
摘要： Some embodiments provide a method for implementing a logical router (LR) in a logical network. The method receives configuration data connecting a first LR to a second LR, which includes several logical routing components with separate routing tables. For each of one or more routes configured for the first LR, the method adds a route to the routing table of a distributed routing component of the second LR. The added route has a next hop address of an interface of the first LR. The method also adds, for each of the one or more routes configured for the first LR, a route to the routing tables of each of one or more centralized routing components of the second LR. The next hop address of the added route is an address of an interface of the distributed routing component that is internal to the second LR.

26. 发明申请

US20180007008A1 Firewall Configuration Versioning 审中-公开
公开(公告)号：US20180007008A1
公开(公告)日：2018-01-04
申请号：US15386207
申请日：2016-12-21
申请人： Nicira, Inc.
发明人： Kaushal Bansal , Uday Masurekar , Shadab Shah , James Joseph Stabile , Steven Peters
IPC分类号： H04L29/06
CPC分类号： H04L63/0218 , G06F12/0813 , G06F12/0875 , G06F2212/1052 , G06F2212/152 , G06F2212/154 , G06F2212/60 , G06F2212/62 , H04L63/0263
摘要： Some embodiments provide a method for managing firewall protection in a datacenter that includes multiple host machines that each hosts a set of data compute nodes. The method maintains a firewall configuration for the host machines at a network manager of the data center. The firewall configuration includes multiple firewall rules to be enforced at the host machines. The method aggregates a first set of updates to the firewall configuration into a first aggregated update and associates the first aggregated update with a first version number. The method distributes a first host-level firewall configuration update to a first host machine based on the first aggregated update and associates the first host machine with the first version number. The method aggregates a second set of updates to the firewall configuration into a second aggregated update and associates the second aggregated update with a second version number.

27. 发明授权

US09582308B2 Auto detecting legitimate IP addresses using spoofguard agents 有权
标题翻译：使用欺骗代理自动检测合法的IP地址
公开(公告)号：US09582308B2
公开(公告)日：2017-02-28
申请号：US14230473
申请日：2014-03-31
申请人： Nicira, Inc.
发明人： Uday Masurekar , Aravind Srinivasan
IPC分类号： G06F9/455 , H04L29/06
CPC分类号： G06F9/45558 , G06F2009/45595 , H04L63/1466
摘要： A method of blocking spoofed packets. The method receives an address allocation message from an address provisioning server that provisions addresses for virtual machines. The address allocation message includes a source address. The method stores the source address of the address allocation message. The method forwards the address allocation message to a virtual machine. The method receives, from the virtual machine, a packet with a second source address. When the second source address is the same as the first source address, the method allows the packet to be forwarded. When the second source address is not the same as the first source address, the method blocks the second packet. An additional method determines the first source address from an initial packet sent from the virtual machine instead of the address allocation method.
摘要翻译：一种阻止欺骗性包的方法。该方法从提供虚拟机的地址的地址配置服务器接收地址分配消息。地址分配消息包括源地址。该方法存储地址分配消息的源地址。该方法将地址分配消息转发到虚拟机。该方法从虚拟机接收具有第二源地址的分组。当第二个源地址与第一个源地址相同时，该方法允许转发数据包。当第二个源地址与第一个源地址不同时，该方法将阻止第二个数据包。附加方法从虚拟机发送的初始分组而不是地址分配方法确定第一个源地址。

28. 发明申请

US20170034129A1 DISTRIBUTED TUNNELING FOR VPN 审中-公开
标题翻译： VPN分布式隧道
公开(公告)号：US20170034129A1
公开(公告)日：2017-02-02
申请号：US15140027
申请日：2016-04-27
申请人： Nicira, Inc.
发明人： Sandesh Sawant , Amit Chopra , Vinayak Shashikant Naik , Jayant Jain , Anirban Sengupta , Uday Masurekar
IPC分类号： H04L29/06 , H04L9/08 , H04L12/741 , H04L12/46 , H04L29/08
CPC分类号： H04L63/0272 , G06F9/45558 , G06F2009/45595 , H04L9/083 , H04L12/4633 , H04L45/74 , H04L63/0428 , H04L63/061 , H04L67/1097 , H04L69/14
摘要： A novel method of providing virtual private access to a software defined data center (SDDC) is provided. The SDDC uses distributed VPN tunneling to allow external access to application services hosted in the SDDC. The SDDC includes host machines for providing computing and networking resources and a VPN gateway for providing external access to those resources. The host machines that host the VMs running the applications that VPN clients are interested in connecting performs the VPN encryption and decryption. The VPN gateway does not perform any encryption and decryption operations. The packet structure is such that the VPN gateway can read the IP address of the VM without decrypting the packet.
摘要翻译：提供了一种向软件定义数据中心（SDDC）提供虚拟专用访问的新方法。 SDDC使用分布式VPN隧道来允许外部访问SDDC中托管的应用程序服务。 SDDC包括用于提供计算和网络资源的主机，以及用于提供对这些资源的外部访问的VPN网关。托管运行VPN客户端有意连接的应用程序的虚拟机的主机执行VPN加密和解密。 VPN网关不执行任何加密和解密操作。分组结构使得VPN网关可以在不解密分组的情况下读取VM的IP地址。

29. 发明授权

US09215213B2 Method and apparatus for distributing firewall rules 有权
标题翻译：用于分发防火墙规则的方法和装置
公开(公告)号：US09215213B2
公开(公告)日：2015-12-15
申请号：US14231683
申请日：2014-03-31
申请人： Nicira, Inc.
发明人： Kaushal Bansal , Uday Masurekar , Aravind Srinivasan , Shadab Shah , Serge Maskalik
IPC分类号： H04L12/24 , H04L29/06 , G06F21/85
CPC分类号： H04L63/20 , H04L63/02 , H04L63/0245 , H04L63/0263
摘要： Some embodiments of the invention provide a novel method for specifying firewall rules. In some embodiments, the method provides the ability to specify for a particular firewall rule, a set of network nodes (also called a set of enforcement points below) at which the particular firewall should be enforced. To provide this ability, the method of some embodiments adds an extra tuple (referred to below as the AppliedTo tuple) to a firewall rule. This added AppliedTo tuple lists the set of enforcement points at which the firewall rule has to be applied (i.e., enforced).
摘要翻译：本发明的一些实施例提供了一种用于指定防火墙规则的新方法。在一些实施例中，该方法提供为特定防火墙规则指定特定防火墙应被强制执行的一组网络节点（也称为下面的一组强制点）的能力。为了提供这种能力，一些实施例的方法将额外的元组（以下称为AppliedTo元组）添加到防火墙规则中。这个添加的应用程序元组列出了必须应用防火墙规则（即强制执行）的一组强制点。

30. 发明申请

US20150237013A1 SPECIFYING POINT OF ENFORCEMENT IN A FIREWALL RULE 有权
标题翻译：规定一个防火墙执法要点
公开(公告)号：US20150237013A1
公开(公告)日：2015-08-20
申请号：US14231682
申请日：2014-03-31
申请人： Nicira, Inc.
发明人： Kaushal Bansal , Uday Masurekar , Aravind Srinivasan , Shadab Shah , Serge Maskalik
IPC分类号： H04L29/06
CPC分类号： H04L63/20 , H04L63/02 , H04L63/0245 , H04L63/0263
摘要： Some embodiments of the invention provide a novel method for specifying firewall rules. In some embodiments, the method provides the ability to specify for a particular firewall rule, a set of network nodes (also called a set of enforcement points below) at which the particular firewall should be enforced. To provide this ability, the method of some embodiments adds an extra tuple (referred to below as the AppliedTo tuple) to a firewall rule. This added AppliedTo tuple lists the set of enforcement points at which the firewall rule has to be applied (i.e., enforced).
摘要翻译：本发明的一些实施例提供了一种用于指定防火墙规则的新方法。在一些实施例中，该方法提供为特定防火墙规则指定特定防火墙应被强制执行的一组网络节点（也称为下面的一组强制点）的能力。为了提供这种能力，一些实施例的方法将额外的元组（以下称为AppliedTo元组）添加到防火墙规则。这个添加的应用程序元组列出了必须应用防火墙规则（即强制执行）的一组强制点。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式