US 10,652,213 B2Granted

Agent-less micro-segmentation of a network

AssigneeNicira, Inc.

InventorsArijit Chanda, Lifeng Chen, Sirisha Myneni, Arnold Koon-Chee Poon

Life of this patent

Estimating the term…

Loading patent…

Abstract

The technology disclosed herein enables the micro-segmentation of a network without agents. In a particular embodiment, a method provides, in a packet-handler controller of a virtual computing environment, determining one or more policies in a first format that identify one or more packet characteristics and how packets with the one or more packet characteristics should be handled within the virtual computing environment. The method further provides converting the one or more policies from the first format to a second format used by a domain controller for one or more computing systems outside of the virtual computing environment. Also, the method provides distributing the one or more policies in the second format to at least one of the one or more computing systems.

Claims20

Dependent claims

A method for agent-less micro-segmentation of a network, the method comprising:

in a packet-handler controller of a virtual computing environment, determining one or more policies in a first format that identify one or more packet characteristics and how packets with the one or more packet characteristics should be handled within the virtual computing environment;
implementing the one or more policies in the first format within the virtual computing environment by transferring the one or more policies to one or more packet handlers in the virtual computing environment that enforce the one or more policies in the first format;
converting the one or more policies from the first format to a second format used by a domain controller for one or more computing systems outside of the virtual computing environment;
and
distributing the one or more policies in the second format to at least one of the one or more computing systems that enforce the one or more policies in the second format.

2 more elements

An apparatus, having physical computing resources, implementing a packet-handler controller of a virtual computing environment for agent-less micro-segmentation of a network, the apparatus comprising:

one or more computer readable storage media of the physical computing resources;
a processing system of the physical computing resources operatively coupled with the one or more computer readable storage media;
and
program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the processing system to:
determine one or more policies in a first format that identify one or more packet characteristics and how packets with the one or more packet characteristics should be handled within the virtual computing environment;
implement the one or more policies in the first format within the virtual computing environment by transferring the one or more policies to one or more packet handlers in the virtual computing environment that enforce the one or more policies in the first format;
convert the one or more policies from the first format to a second format used by a domain controller for one or more computing systems outside of the virtual computing environment;
and
distribute the one or more policies in the second format to at least one of the one or more computing systems that enforce the one or more policies in the second format.

6 more elements

Dependencies are inferred from the claim text.