# US 2010/0169880 A1 · Virtual input-output connections for machine virtualization > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2010/0169880 A1 - Document ID: US20100169880A1 - Status: Published application - Kind: A1 - Application number: 12/344,235 - Filed: 2008-12-25 - Published: 2010-07-01 - Earliest claimed: 2008-12-25 - Assignees: Voltaire Ltd. - Inventors: Yaron Haviv; Albert Berlovitch - Web page: https://patentgrep.com/patent/US20100169880A1 ## CPC - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 12/4625: {Single bridge functionality, e.g. connection of two networks over a single bridge} - H04L 49/70: {Virtual switches} - H04L 63/101: {Access control lists [ACL]} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computing method includes specifying a virtual computer system including at least one virtual or physical compute node, which produces data packets having respective source attributes. At least one Virtual Input-Output Connection (VIOC) that is uniquely associated with the values of the source attributes is defined. A policy specifying an operation to be performed with regard to the VIOC is defined. The virtual computer system is implemented on a physical computer system, which includes at least one physical packet switching element. The physical packet switching element is configured to identify the data packets whose source attributes have the values that are associated with the VIOC and to perform the operation on the identified data packets, so as to enforce the policy on the VIOC. ## Claims ### Claim 1 A computing method, comprising: specifying a virtual computer system comprising at least one virtual or physical compute node, which produces data packets having respective source attributes; defining at least one Virtual Input-Output Connection (VIOC) that is uniquely associated with the values of the source attributes; defining a policy specifying an operation to be performed with regard to the VIOC; implementing the virtual computer system on a physical computer system that includes at least one physical packet switching element; and configuring the physical packet switching element to identify the data packets whose source attributes have the values that are associated with the VIOC and to perform the operation on the identified data packets, so as to enforce the policy on the VIOC. ### Claim 2 (depends on 1) The method according to claim 1, wherein specifying the virtual computing system comprises specifying a Virtual Network Interface Card (VNIC) for the compute node, and wherein defining the VIOC comprises associating the VIOC with the VNIC. ### Claim 3 (depends on 1) The method according to claim 1, wherein the source attributes comprise at least one attribute type selected from a group of types consisting of a source Media Access Control (MAC) address, a source Virtual Local Area Network (VLAN), a priority level and a source Internet Protocol (IP) address. ### Claim 4 (depends on 1) The method according to claim 1, wherein configuring the physical packet switching element comprises producing a definition, having a format that is recognizable by the physical packet switching element, of the values of the source attributes that are associated with the VIOC, and configuring the physical packet switching element using the definition. ### Claim 5 (depends on 4) The method according to claim 4, wherein the definition comprises an Access Control List (ACL). ### Claim 6 (depends on 1) The method according to claim 1, wherein configuring the physical packet switching element comprises detecting a change in one of the physical computer system and the virtual computer system, and re-configuring the physical packet switching element responsively to the detected change, so as to cause the physical packet switching element to continue enforcing the policy. ### Claim 7 (depends on 6) The method according to claim 6, wherein the at least one physical packet switching element comprises first and second physical packet switching elements, wherein configuring the physical packet switching element comprises initially configuring the first physical packet switching element to enforce the policy, and wherein re-configuring the physical packet switching element comprises, responsively to detecting the change, configuring the second physical packet switching element to enforce the policy. ### Claim 8 (depends on 1) The method according to claim 1, wherein the physical computer system comprises at least one physical computer comprising multiple physical ports, and wherein defining the VIOC comprises aggregating the multiple physical ports and associating the VIOC with the multiple aggregated physical ports. ### Claim 9 (depends on 1) The method according to claim 1, wherein the policy specifies access privileges with regard to the data packets that are associated with the VIOC. ### Claim 10 (depends on 1) The method according to claim 1, wherein the policy defines a Virtual Local Area Network (VLAN) for exchanging the data packets that are associated with the VIOC. ### Claim 11 (depends on 1) The method according to claim 1, wherein the policy defines an encryption operation to be applied with regard to the VIOC. ### Claim 12 (depends on 1) The method according to claim 1, wherein the policy defines an authentication operation to be applied with regard to the VIOC. ### Claim 13 (depends on 1) The method according to claim 1, wherein the policy defines a Quality-of-Service (QoS) property of the VIOC. ### Claim 14 (depends on 1) The method according to claim 1, wherein the policy requests monitoring of information related to the VIOC. ### Claim 15 (depends on 1) The method according to claim 1, wherein the policy defines a mirroring operation to be performed with regard to the VIOC. ### Claim 16 (depends on 1) The method according to claim 1, wherein the policy requests one of an activation and a deactivation of the VIOC. ### Claim 17 (depends on 1) The method according to claim 1, wherein defining the at least one VIOC comprises defining multiple VIOCs and grouping the multiple VIOCs to form a VIOC cluster, wherein defining the policy comprises defining a cluster policy to be applied to the multiple VIOCs in the VIOC cluster, and wherein configuring the physical packet switching element comprises configuring the physical packet switching element to apply the cluster policy to the data packets that are associated with any of the VIOCs in the VIOC cluster. ### Claim 18 A computing apparatus, comprising: an interface, which is operative to communicate with a physical computer system that includes at least one physical packet switching element; and a processor, which is coupled to accept a specification of a virtual computer system comprising at least one virtual or physical compute node, which produces data packets having respective source attributes, to accept a definition of at least one Virtual Input-Output Connection (VIOC) that is uniquely associated with the values of the source attributes, to accept a policy specifying an operation to be performed with regard to the VIOC, to implement the virtual computer system on the physical computer system, and to configure the physical packet switching element to identify the data packets whose source attributes have the values that are associated with the VIOC and to perform the operation on the identified data packets, so as to enforce the policy on the VIOC. ### Claim 19 (depends on 18) The apparatus according to claim 18, wherein the specification of the virtual computing system specifies a Virtual Network Interface Card (VNIC) for the compute node, and wherein the processor is coupled to associate the VIOC with the VNIC. ### Claim 20 (depends on 18) The apparatus according to claim 18, wherein the source attributes comprise at least one attribute type selected from a group of types consisting of a source Media Access Control (MAC) address, a source Virtual Local Area Network (VLAN), a priority level and a source Internet Protocol (IP) address. ### Claim 21 (depends on 18) The apparatus according to claim 18, wherein the processor is coupled to produce a definition, having a format that is recognizable by the physical packet switching element, of the values of the source attributes that are associated with the VIOC, and to configure the physical packet switching element using the definition. ### Claim 22 (depends on 21) The apparatus according to claim 21, wherein the definition comprises an Access Control List (ACL). ### Claim 23 (depends on 18) The apparatus according to claim 18, wherein the processor is coupled to detect a change in one of the physical computer system and the virtual computer system, and to re-configure the physical packet switching element responsively to the detected change so as to cause the physical packet switching element to continue enforcing the policy. ### Claim 24 (depends on 23) The apparatus according to claim 23, wherein the at least one physical packet switching element comprises first and second physical packet switching elements, and wherein the processor is coupled to initially configure the first physical packet switching element to enforce the policy, and, responsively to detecting the change, to configure the second physical packet switching element to enforce the policy. ### Claim 25 (depends on 18) The apparatus according to claim 18, wherein the physical computer system comprises at least one physical compute node comprising multiple physical ports, and wherein the definition of the VIOC aggregates the multiple physical ports and associates the VIOC with the multiple aggregated physical ports. ### Claim 26 (depends on 18) The apparatus according to claim 18, wherein the policy specifies access privileges with regard to the data packets that are associated with the VIOC. ### Claim 27 (depends on 18) The apparatus according to claim 18, wherein the policy defines a Virtual Local Area Network (VLAN) for exchanging the data packets that are associated with the VIOC. ### Claim 28 (depends on 18) The apparatus according to claim 18, wherein the policy defines an encryption operation to be applied with regard to the VIOC. ### Claim 29 (depends on 18) The apparatus according to claim 18, wherein the policy defines an authentication operation to be applied with regard to the VIOC. ### Claim 30 (depends on 18) The apparatus according to claim 18, wherein the policy defines a Quality-of-Service (QoS) property of the VIOC. ### Claim 31 (depends on 18) The apparatus according to claim 18, wherein the policy requests monitoring of information related to the VIOC. ### Claim 32 (depends on 18) The apparatus according to claim 18, wherein the policy defines a mirroring operation to be performed with regard to the VIOC. ### Claim 33 (depends on 18) The apparatus according to claim 18, wherein the policy requests one of an activation and a deactivation of the VIOC. ### Claim 34 (depends on 18) The apparatus according to claim 18, wherein the definition of the at least one VIOC defines multiple VIOCs and groups the multiple VIOCs to form a VIOC cluster, wherein the policy comprises a cluster policy to be applied to the multiple VIOCs in the VIOC cluster, and wherein the processor is coupled to configure the physical packet switching element to apply the cluster policy to the data packets that are associated with any of the VIOCs in the VIOC cluster. ### Claim 35 A computer software product, comprising a computer-readable medium in which program instructions are stored, which instructions, when read by a processor, cause the processor to communicate with a physical computer system that includes at least one physical packet switching element, to accept a specification of a virtual computer system comprising at least one virtual or physical compute node, which produces data packets having respective source attributes, to accept a definition of at least one Virtual Input-Output Connection (VIOC) that is uniquely associated with the values of the source attributes, to accept a policy specifying an operation to be performed with regard to the VIOC, to implement the virtual computer system on the physical computer system, and to configure the physical packet switching element to identify the data packets whose source attributes have the values that are associated with the VIOC and to perform the operation on the identified data packets, so as to enforce the policy on the VIOC.