Allocation of tokens for network packets based on application type
AssigneeVMware, Inc.
InventorIndresh Mishra
Life of this patent
Estimating the term…
Abstract
Described herein are systems, methods, and software to manage the deployment and use of application identifier tokens in a distributed firewall environment. In one implementation, a computing environment generates tokens associated with application types executing on virtual nodes in the computing environment. After generating the tokens, the computing environment provides at least one token of the tokens to each of the virtual nodes based on at least one application type executing on the virtual node. When a communication is identified in the virtual node associated with an application, the virtual node may encapsulate the communication and a corresponding token in a packet and forward the packet via a virtual network interface associated with the virtual node.
Claims14
A method comprising:
- identifying application types associated with applications executing on virtual nodes in a computing environment;
- for each application type of the application types, generating a token associated with the application type, wherein the token is generated via a random value generator;
- providing at least one token of the tokens to each of the virtual nodes based on at least one application type of the application types executing on the virtual node;
- in a virtual node of the virtual nodes, identifying a communication from an application executing on the virtual node;
- generating a packet to support the communication, wherein the packet comprises a token associated with the application type for the application;
- communicating the packet via a virtual network interface associated with the virtual node;
- in a firewall for the virtual nodes, determining a forwarding action for the packet based at least in part on the token;
- identifying an expiration of the tokens associated with the application types;
- in response to the expiration and for each application type of the application types, identifying a second token associated with the application type;
- and
- providing at least one token of the second tokens to each of the virtual nodes based on at least one application type of the application types executing on the virtual node to replace the expired tokens.
A computing apparatus comprising:
- a storage system;
- a processing system operatively coupled to the storage system;
- and
- program instructions stored on the storage system that, when executed by the processing system, direct the processing system to:
- identify application types associated with applications executing on virtual nodes in a computing environment;
- for each application type of the application types, generate a token associated with the application type, wherein the token is generated via a random value generator;
- provide at least one token of the tokens to each of the virtual nodes based on at least one application type of the application types executing on the virtual node;
- in a virtual node of the virtual nodes, identify a communication from an application executing on the virtual node;
- generate a packet to support the communication, wherein the packet comprises a token associated with the application type for the application;
- communicate the packet via a virtual network interface associated with the virtual node;
- in a firewall for the virtual nodes, determine a forwarding action for the packet based at least in part on the token;
- identify an expiration of the tokens associated with the application types;
- in response to the expiration and for each application type of the application types, identify a second token associated with the application type;
- and
- provide at least one token of the second tokens to each of the virtual nodes based on at least one application type of the application types executing on the virtual node to replace the expired tokens.
Dependencies are inferred from the claim text.