DYNAMIC MANAGEMENT OF SECURITY RULES AND POLICIES

    公开(公告)号:US20240039957A1

    公开(公告)日:2024-02-01

    申请号:US17876939

    申请日:2022-07-29

    CPC classification number: H04L63/20 H04L47/32 H04L47/2408 H04L69/22

    Abstract: A method of managing security rules may include extracting metadata from a data packet received at a first network device. The metadata including network metadata and network system metadata. The method may further include distributing the metadata to at least one service endpoint registered with the first network device, receiving from the at least one service endpoint, an indication as to how traffic associated with the data packet is to be handled, and enabling the traffic based at least in part on feedback received from the at least one service endpoint and creating a first service flow hash entry of a hash table associated with the data packet at the first network device. The first service flow hash entry identified each of a number of services using a unique number. The method may further include distributing the hash table including the first service flow hash entry across a fabric to at least a second network device.

    Providing shared resources to virtual devices

    公开(公告)号:US10009253B2

    公开(公告)日:2018-06-26

    申请号:US14802868

    申请日:2015-07-17

    CPC classification number: H04L45/026 H04L41/0806 H04L41/0846

    Abstract: The present disclosure relates to providing shared resources to virtual devices on a network switch. In one example, a switch comprises a plurality of virtual device contexts (VDCs) and a default virtual device context (DVDC). The DVDC stores configuration data that identifies a network resource. The DVDC transmits a reference to the configuration data to each of the plurality of VDCs. Each of plurality of VDCs receives the reference from the DVDC. When the DVDC receive, from the at least one of the plurality of VDCs, a request to access the configuration data via the reference, the DVDC transmits at least a portion of the configuration data to the at least one of the plurality of VDCs. The at least the portion of the configuration data is operable to initiate a connection between the at least one of the plurality of VDCs and the network resource.

    APPLICATION PROGRAMMING INTERFACE SELECTION BASED ON SUSTAINABILITY

    公开(公告)号:US20250045125A1

    公开(公告)日:2025-02-06

    申请号:US18365580

    申请日:2023-08-04

    Abstract: A method to generate sustainability metric for nodes that are configured to potentially execute a network function such as an application programming interface, and to use the sustainability metric to select one of the nodes to execute the network function. The method includes receiving sustainability information for a first node and a second node in a plurality of nodes configured to execute at least part of a predetermined network function, receiving sustainability information for a location at which the first node and the second node are respectively disposed, for a given workload to be executed by the predetermined network function, generating a sustainability metric for the first node and the second node, and selecting, based on the sustainability metric, one of the first node and the second node to execute the predetermined network function.

    TCAM-based load balancing on a switch

    公开(公告)号:US11343190B2

    公开(公告)日:2022-05-24

    申请号:US16580087

    申请日:2019-09-24

    Abstract: In an example, a network switch is configured to operate natively as a load balancer. The switch receives incoming traffic on a first interface communicatively coupled to a first network, and assigns the traffic to one of a plurality of traffic buckets. This may include looking up a destination IP of an incoming packet in a fast memory such as a ternary content-addressable memory (TCAM) to determine whether the packet is directed to a virtual IP (VIP) address that is to be load balanced. If so, part of the source destination IP address may be used as a search tag in the TCAM to assign the incoming packet to a traffic bucket or IP address of a service node.

    PROVIDING SHARED RESOURCES TO VIRTUAL DEVICES
    9.
    发明申请
    PROVIDING SHARED RESOURCES TO VIRTUAL DEVICES 有权
    向虚拟设备提供共享资源

    公开(公告)号:US20160315815A1

    公开(公告)日:2016-10-27

    申请号:US14802868

    申请日:2015-07-17

    CPC classification number: H04L45/026 H04L41/0806 H04L41/0846

    Abstract: The present disclosure relates to providing shared resources to virtual devices on a network switch. In one example, a switch comprises a plurality of virtual device contexts (VDCs) and a default virtual device context (DVDC). The DVDC stores configuration data that identifies a network resource. The DVDC transmits a reference to the configuration data to each of the plurality of VDCs. Each of plurality of VDCs receives the reference from the DVDC. When the DVDC receive, from the at least one of the plurality of VDCs, a request to access the configuration data via the reference, the DVDC transmits at least a portion of the configuration data to the at least one of the plurality of VDCs. The at least the portion of the configuration data is operable to initiate a connection between the at least one of the plurality of VDCs and the network resource.

    Abstract translation: 本公开涉及向网络交换机上的虚拟设备提供共享资源。 在一个示例中,交换机包括多个虚拟设备上下文(VDC)和默认虚拟设备上下文(DVDC)。 DVDC存储标识网络资源的配置数据。 DVDC向多个VDC中的每一个发送对配置数据的引用。 多个VDC中的每一个从DVDC接收参考。 当DVDC从多个VDC中的至少一个VDC接收经由参考访问配置数据的请求时,DVDC将配置数据的至少一部分发送到多个VDC中的至少一个。 所述配置数据的至少一部分可操作以发起所述多个VDC中的所述至少一个与所述网络资源之间的连接。

    Dynamic management of security rules and policies

    公开(公告)号:US12206709B2

    公开(公告)日:2025-01-21

    申请号:US17876939

    申请日:2022-07-29

    Abstract: A method of managing security rules may include extracting metadata from a data packet received at a first network device. The metadata including network metadata and network system metadata. The method may further include distributing the metadata to at least one service endpoint registered with the first network device, receiving from the at least one service endpoint, an indication as to how traffic associated with the data packet is to be handled, and enabling the traffic based at least in part on feedback received from the at least one service endpoint and creating a first service flow hash entry of a hash table associated with the data packet at the first network device. The first service flow hash entry identified each of a number of services using a unique number. The method may further include distributing the hash table including the first service flow hash entry across a fabric to at least a second network device.

Patent Agency Ranking