US 11,893,406 B2Granted

Using virtual local area networks in a virtual computer system

AssigneeVMware, Inc.

InventorHao Xu

Life of this patent

Estimating the term…

Loading patent…

Abstract

A virtual computer system includes virtualization software, and one or more physical network interfaces for connecting to one or more computer networks. The virtualization software supports one or more virtual machines (VMs), and exports one or more virtual network interfaces to the VM(s) to enable the VM(s) to access the computer network(s) through the physical network interface(s). The virtualization software modifies and filters network data frames from the VM(s) and from the physical network interface(s) to restrict one or more VMs to one or more virtual local area networks (VLANs) that are implemented within a VLAN topology. Restricting a VM to a VLAN limits the broadcast domain to which the VM belongs, which may reduce security risks facing the VM. Implementing the VLAN functionality within the virtualization software provides the functionality to every VM in the computer system, without requiring every VM to provide the functionality.

Claims20

Dependent claims

A method performed in a virtual computer system, the virtual computer system comprising virtualization software that supports a first virtual machine (VM), the virtualization software providing the first VM with a first virtual network interface, wherein the first VM includes a first network interface card (NIC) driver loaded into the first VM, the method comprising:

receiving, at the a virtual local area network (VLAN) coordinator, an outgoing network data frame from the first NIC driver;
modifying the outgoing network data frame, at the VLAN coordinator, by writing a first VLAN identifier associated with the first VM into the outgoing network data frame received from the first NIC driver, wherein the first VM is within a first VLAN, wherein the first VLAN identifier restricts transmission of the outgoing network data frame from the first NIC driver to the first VLAN associated with the first VLAN identifier, wherein the modifying occurs outside of the first VM, and wherein modifying the outgoing network data frame is transparent to the first VM;
transmitting the modified outgoing network data frame over a physical network, the transmitting being performed by one or more physical network interfaces connected to the computer system and the physical network;
receiving, at the VLAN coordinator, an incoming network data frame from the the physical network;
determining the incoming network data frame includes the first VLAN identifier,
removing, at the VLAN coordinator, the first VLAN identifier from the received incoming network data frame;
and
conveying the received incoming network data frame to the first VM through the first NIC driver.

5 more elements

A non-transitory computer-readable storage medium including instructions, that when executed by a processor, cause a virtual local area network (VLAN) coordinator to perform the steps of:

receiving an outgoing network data frame from a first network interface card (NIC) driver loaded into the first VM;
modifying the outgoing network data frame by writing a first VLAN identifier associated with the first VM into the outgoing network data frame received from the first NIC driver, wherein the first VM is within a first VLAN, wherein the first VLAN identifier restricts transmission of the outgoing network data frame from the first NIC driver to the first VLAN associated with the first VLAN identifier, wherein the modifying occurs outside of the first VM, and wherein modifying the outgoing network data frame is transparent to the first VM;
transmitting the modified outgoing network data frame over a physical network;
receiving an incoming network data frame from the physical network;
determining the incoming network data frame includes the first VLAN identifier,
removing the first VLAN identifier from the received incoming network data frame;
and
conveying the received incoming network data frame to the first VM through the first NIC driver.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/011,631Filed 3 Sep 2020 · continuation
Priority: 17 Nov 2004
Published: US 2021/0208921 A18 Jul 2021
Granted: 6 Feb 2024
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

G06F 9/45558
Hypervisors; Virtual machine monitors: hypervisor-specific management and integration aspects
H04L 67/10
Protocols: in which an application is distributed across nodes in the network
G06F 2009/45587
Hypervisor-specific management and integration aspects: isolation or security of virtual machine instances
G06F 2009/45595
Hypervisor-specific management and integration aspects: network integration; Enabling network access in virtual machine instances

Family

Application10/991,638Parent of this continuation · filed 17 Nov 2004
Application14/231,661Parent of this continuation · filed 31 Mar 2014
US 9,043,792 B1Parent of this continuation · filed 26 May 2015
US 2021/0208921 A1Pre-grant publication · published 8 Jul 2021
US 10,768,958 B2Parent of this continuation
US 2015/0277953 A1Published application
US 2017/0255482 A9Published application
US 11,893,406 B2This patent

From the US filing history. Foreign family members aren’t listed.