Back to results
US 12,598,133 B2Granted
Packet flow control in a header of a packet
AssigneeOracle International Corporation
InventorsShane Baker, Santosh Narayan Shilimkar, Jagwinder Singh Brar
Life of this patent
Estimating the term…
Abstract
Techniques for controlling packet flows are described. In an example, a packet is sent on a virtual network. The packet's header includes scoping data that indicates a network boundary within which the packet is permitted and/or prohibited to flow. A network virtualization device of a substrate network receives the packet. The network virtualization device determines the scoping data from the header and, based on network configuration information, determines the forward flow of the packet. If the forward flow falls within a permitted network boundary indicated by the scoping data, the network virtualization device sends the packet forward. Otherwise, the packet is dropped.
Claims20
A network virtualization device comprising:
- one or more processors,
- and one or more computer-readable storage media storing instructions that, upon execution by the one or more processors, configure the network virtualization device to:
- store a packet flow rule for use in controlling routing of packages generated by a compute instance associated with the network virtualization device, wherein the packet flow rule indicates a network boundary that delineates permitted destinations for packages generated by the compute instance from prohibited destinations for the packages generated by the compute instance;
- receive a permitted compute instance packet generated by the compute instance, wherein the permitted compute instance packet comprises data that indicates an intended destination for the permitted compute instance packet that is one of the permitted destinations defined by the packet flow rule;
- generate data indicating that the intended destination of the permitted compute instance packet is one of the permitted destinations for the permitted compute instance packet per the packet flow rule;
- add the data to the permitted compute instance packet;
- send the permitted compute instance packet with the data to a second network virtualization device for delivery to the intended destination for the permitted compute instance packet;
- receive a prohibited compute instance packet generated by the compute instance, wherein the prohibited compute instance packet comprises data that indicates an intended destination for the prohibited compute instance packet that is not one of the permitted destinations defined by the packet flow rule;
- and
- drop the prohibited compute instance packet.
7 more elements
A method implemented by a network virtualization device, the method comprising:
- storing a packet flow rule for use in routing of packets generated by a compute instance associated with the network virtualization device, wherein the packet flow rule indicates a network boundary that delineates permitted destinations for packages generated by the compute instance from prohibited destinations for the packages generated by the compute instance;
- receiving a permitted compute instance packet generated by the compute instance, wherein the permitted compute instance packet comprises data that indicates an intended destination for the permitted compute instance packet that is one of the permitted destinations defined by the packet flow rule;
- generating data indicating that the intended destination of the permitted compute instance packet is one of the permitted destinations for the permitted compute instance packet per the packet flow rule;
- adding the data to the permitted compute instance packet;
- sending the permitted compute instance packet with the data to a second network virtualization device for delivery to the intended destination for the permitted compute instance packet;
- receiving a prohibited compute instance packet generated by the compute instance, wherein the prohibited compute instance packet comprises data that indicates an intended destination for the prohibited compute instance packet that is not one of the permitted destinations defined by the packet flow rule;
- and
- dropping the prohibited compute instance packet.
5 more elements
One or more non-transitory computer-readable media storing instructions that, upon execution on a network virtualization device, cause the network virtualization device to perform operations comprising:
- storing a packet flow rule for use in routing of packets generated by a compute instance associated with the network virtualization device, wherein the packet flow rule indicates a network boundary that delineates permitted destinations for packages generated by the compute instance from prohibited destinations for the packages generated by the compute instance;
- receiving a permitted compute instance packet generated by the compute instance, wherein the permitted compute instance packet comprises data that indicates an intended destination for the permitted compute instance packet that is one of the permitted destinations defined by the packet flow rule;
- generating data indicating that the intended destination of the permitted compute instance packet is one of the permitted destinations for the permitted compute instance packet per the packet flow rule;
- adding the data to the permitted compute instance packet;
- sending the permitted compute instance packet with the data to a second network virtualization device for delivery to the intended destination for the permitted compute instance packet;
- receiving a prohibited compute instance packet generated by the compute instance, wherein the prohibited compute instance packet comprises data that indicates an intended destination for the prohibited compute instance packet that is not one of the permitted destinations defined by the packet flow rule;
- and
- dropping the prohibited compute instance packet.
5 more elements
Dependencies are inferred from the claim text.