# US 11,310,241 B2 · Mirroring virtual network traffic > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,241 B2 - Document ID: US11310241B2 - Status: Granted - Kind: B2 - Application number: 16/233,981 - Filed: 2018-12-27 - Published: 2020-03-19 - Granted: 2022-04-19 - Earliest claimed: 2018-09-18 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Chandrasekar Srinivasan; Neha Aggarwal; Deven Jagasia; Fengfen Liu; Karthik Ananthakrishnan; Avijit Gupta; Ganesh Srinivasan; Nisheeth Srivastava; Rishabh Tewari; Michal Czeslaw Zygmunt; Harish Kumar Chandrappa; Gabriel Silva; Naveen Prabhat; Sumit Sharad Dhoble; Xinyan Zan; Maitrey Kumar; Wei Xia - Web page: https://patentgrep.com/patent/US11310241B2 ## CPC - G06F 9/54: Interprogram communication - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 9/5077: {Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455)} - G06F 9/547: {Remote procedure calls [RPC]; Web services} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/552: {involving long-term monitoring or reporting} - H04L 43/12: Network monitoring probes - H04L 43/20: the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0263: {Rule management} - H04L 63/104: {Grouping of entities} - H04L 63/105: {Multiple levels of security} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/1095: Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45591: {Monitoring or debugging support} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - G06F 2209/508: Monitor - G06F 2209/542: Intercept - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - H04L 43/026: using flow identification - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The disclosed system implements techniques to enable a tenant of a cloud-based platform to effectively and efficiently apply a policy that copies data packets communicated to or from a virtual machine in the tenant's own virtual network. When applied, the policy mirrors data traffic associated with a workload executing on a virtual machine in the tenant's virtual network. To mirror the data traffic, a copy of a data packet is streamed to another virtual machine so that network analytics can be performed (e.g., performance analytics, security analytics, etc.). In various examples, the policy can be a role-based mirroring policy that defines a plurality of roles in association with a role-based access model that scales operations and that provides improved security for a tenant's virtual network. ## Claims ### Claim 1 A system comprising: one or more hardware processors; and computer-readable media storing instructions that, when executed by the one or more hardware processors, cause the system to: establish, in association with a tenant subscription, a role-based mirroring policy capable of being applied within a virtual network hosted by a cloud-based platform, the role-based mirroring policy defining at least: a first role for an owner of a virtual machine to execute a workload, on the virtual machine, that causes data packets to be communicated to or from the virtual machine; and a second role for an authorized agent to monitor the workload; receive a remote call via an application programming interface (API) configured as part of the cloud-based platform, wherein the remote call requests application of the role-based mirroring policy to the workload executing on the virtual machine, wherein the remote call includes user information associated with a user requesting application of the role-based mirroring policy; verify, based on the user information, that the user requesting application of the role-based mirroring policy is associated with the second role; configure at least one component in a host node of the cloud-based platform that hosts the virtual machine to apply the role-based mirroring policy; determine, by the at least one component, that an individual data packet is communicated to or from the virtual machine; create, by the at least one component and based on application of the role-based mirroring policy, a copy of the individual data packet that is communicated to or from the virtual machine; and stream the copy of the individual data packet to another virtual machine in the virtual network, or in a peer virtual network hosted by the cloud-based platform, so that network analytics can be performed on data traffic. ### Claim 2 (depends on 1) The system of claim 1, wherein the authorized agent comprises the user. ### Claim 3 (depends on 1) The system of claim 1, wherein the remote call specifies an identifier for the virtual machine such that the policy is applied to all data packets communicated to or from the virtual machine. ### Claim 4 (depends on 1) The system of claim 1, wherein the remote call specifies an identifier for a virtual network interface controller of the virtual machine such that the policy is applied to data packets communicated to or from the virtual machine via the virtual network interface controller. ### Claim 5 (depends on 1) The system of claim 1, wherein the remote call specifies an identifier for a collection of Internet Protocol (IP) addresses used by the virtual machine such that the policy is applied to data packets communicated to or from the virtual machine via an IP address in the collection of IP addresses. ### Claim 6 (depends on 5) The system of claim 5, wherein the collection of IP addresses is an extension of an IP address space used in a private network operated by a tenant of the cloud-based platform. ### Claim 7 (depends on 1) The system of claim 1, wherein the remote call requests that the policy apply a filter to the data packets communicated to or from the virtual machine, the filter specifying one or more of: a direction of traffic to be copied; a type of packet to be copied; a number of bytes of a packet payload to be copied; a destination to which packets to be copied are sent; a source from which packets to be copied are received; or that only a packet header is to be copied. ### Claim 8 (depends on 1) The system of claim 1, wherein the copy of the individual data packet comprises a full copy. ### Claim 9 (depends on 1) The system of claim 1, wherein the at least one component comprises at least one of a software defined networking switch, a network interface controller, or a Field-Programmable Gate Array. ### Claim 10 (depends on 1) The system of claim 1, wherein the policy is useable to define an intended state of the virtual network for a tenant of the cloud-based platform, the virtual network belonging to the tenant. ### Claim 11 A method comprising: receiving a remote call via an application programming interface (API) configured as part of a cloud-based platform, wherein: the remote call requests application of a role-based mirroring policy that copies data packets communicated to or from a virtual machine in a virtual network hosted by the cloud-based platform; the role-based mirroring policy defines a first role for a first user to execute a workload that causes the data packets to be communicated to or from the virtual machine and a second role for a second user to monitor the workload; and the remote call includes user information associated with the second user requesting application of the role-based mirroring policy; verifying, by one or more processors and based on the user information, that the second user is authorized to apply the role-based mirroring policy that copies data packets communicated to or from the virtual machine; determining that an individual data packet is communicated to or from the virtual machine; and transmitting, in accordance with the role-based mirroring policy, a copy of the individual data packet to another virtual machine in the virtual network, or in a peer virtual network hosted by the cloud-based platform, so that network analytics can be performed on data traffic. ### Claim 12 (depends on 11) The method of claim 11, wherein the API receives the remote call in association with a tenant subscription that enables the role-based mirroring policy to be applied to the data packets communicated to or from the virtual machine. ### Claim 13 (depends on 11) The method of claim 11, wherein the remote call specifies an identifier for the virtual machine such that the role-based mirroring policy is applied to all data packets communicated to or from the virtual machine. ### Claim 14 (depends on 11) The method of claim 11, wherein the remote call specifies an identifier for a virtual network interface controller of the virtual machine such that the role-based mirroring policy is applied to data packets communicated to or from the virtual machine via the virtual network interface controller. ### Claim 15 (depends on 11) The method of claim 11, wherein the remote call specifies an identifier for a collection of Internet Protocol (IP) addresses used by the virtual machine such that the role-based mirroring policy is applied to data packets communicated to or from the virtual machine via an IP address in the collection of IP addresses. ### Claim 16 A system comprising: one or more hardware processors; and computer-readable media storing instructions that, when executed by the one or more hardware processors, cause the system to: receive a remote call via an application programming interface (API) configured as part of a cloud-based platform, wherein: the remote call requests application of a role-based mirroring policy that copies data packets communicated to or from a virtual machine in a virtual network hosted by the cloud-based platform; the role-based mirroring policy defines a first role for a first user to execute a workload that causes the data packets to be communicated to or from the virtual machine and a second role for a second user to monitor the workload; and the remote call includes user information associated with the second user requesting application of the role-based mirroring policy; verify, based on the user information, that the second user is authorized to apply the role-based mirroring policy that copies data packets communicated to or from the virtual machine; determine that an individual data packet is communicated to or from the virtual machine; and transmit, in accordance with the role-based mirroring policy, a copy of the individual data packet to another virtual machine in the virtual network, or in a peer virtual network hosted by the cloud-based platform, so that network analytics can be performed on data traffic. ### Claim 17 (depends on 16) The system of claim 16, wherein the remote call specifies an identifier for the virtual machine such that the role-based mirroring policy is applied to all data packets communicated to or from the virtual machine. ### Claim 18 (depends on 16) The system of claim 16, wherein the remote call specifies an identifier for a virtual network interface controller of the virtual machine such that the role-based mirroring policy is applied to data packets communicated to or from the virtual machine via the virtual network interface controller. ### Claim 19 (depends on 16) The system of claim 16, wherein the remote call specifies an identifier for a collection of Internet Protocol (IP) addresses used by the virtual machine such that the role-based mirroring policy is applied to data packets communicated to or from the virtual machine via an IP address in the collection of IP addresses. ### Claim 20 (depends on 16) The system of claim 16, wherein the API receives the remote call in association with a tenant subscription that enables the role-based mirroring policy to be applied to the data packets communicated to or from the virtual machine.