# US 2014/0157357 A1 · Systems, devices, and methods for traffic management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0157357 A1
- Document ID: US20140157357A1
- Status: Published application
- Kind: A1
- Application number: 14/124,299
- Filed: 2011-08-15
- Published: 2014-06-05
- Earliest claimed: 2011-08-15
- Assignees: Hewlett Packard Enterprise Development LP
- Inventors: John E. Nolan; Jim A. Baumgartner; Robert L. Faulk, JR.
- Web page: https://patentgrep.com/patent/US20140157357A1

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- H04L 47/20: Traffic policing
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Systems, devices, and methods for traffic management are provided. An example of a method for traffic management includes receiving a number of policies for data traffic redirection 230 in a data network 100 and authorizing a subset of the number of policies based upon matching a plurality of authorization rules 350 saved in the data network 100, for example, in a management tool 120 and/or a network device 123.

## Claims

### Claim 1

A method for data traffic management, comprising:
receiving a number of policies for data traffic redirection in a data network; and
authorizing a subset of the number of policies based upon matching a plurality of authorization rules saved in the data network.

### Claim 2 (depends on 1)

The method of claim 1, wherein the method includes protecting data traffic from being redirected to an improper server or an improper virtual machine of a plurality of servers or virtual machines.

### Claim 3 (depends on 1)

The method of claim 1, wherein the method includes receiving the number of policies from a virtual machine manager or a virtual management application and determining whether the virtual machine manager or the virtual management application is authorized to redirect particular data traffic.

### Claim 4 (depends on 1)

The method of claim 1, wherein receiving the number of policies comprises receiving the number of policies by a management tool or network device of the data network.

### Claim 5 (depends on 1)

The method of claim 1, wherein receiving the number of policies for data traffic redirection comprises receiving directions for reconfiguring a number of switches that direct data traffic to a specified server or a specified virtual machine of a plurality of servers or virtual machines.

### Claim 6 (depends on 1)

The method of claim 1, wherein authorizing the subset of the number of policies comprises permitting enablement of the subset based upon matching the plurality of authorization rules and denying enablement of policies that do not match the plurality of authorization rules.

### Claim 7 (depends on 1)

The method of claim 1, wherein authorizing the subset of the number of policies comprises comparing a plurality of redirection rules of the number of policies to the plurality of authorization rules to perform the matching, wherein the redirection rules and authorization rules are selected from a group that comprises:
identification of a virtual machine manager or a virtual management application from which a particular policy is received;
a description of the data traffic to be redirected; and
a description of a destination of the data traffic to be redirected.

### Claim 8

A data traffic management device, comprising:
a data network interface;
a subsystem to receive a number of policies for data traffic redirection, wherein the subsystem is coupled to the data network interface; and
a processing resource of a management tool coupled to the subsystem and the data network interface to authorize a subset of the number of policies based upon a match of a plurality of authorization rules saved in the management tool, wherein to authorize comprises to permit enablement of the subset based upon the match of the plurality of authorization rules and to deny enablement of policies that do not match the plurality of authorization rules.

### Claim 9 (depends on 8)

The device of claim 8, wherein the processing resource authorizes the subset by comparison of a plurality of redirection rules of each of the number of received policies to the plurality of authorization rules to determine whether the plurality of redirection rules matches the plurality of authorization rules.

### Claim 10 (depends on 9)

The device of claim 9, wherein the device stores a number of traffic redirection tables that each save a number of redirection policies each having a plurality of redirection rules selected from a group that comprises:
identification of a virtual machine manager or a virtual management application from which a particular policy is received;
a description of the data traffic to be redirected; and
a description of a destination of the data traffic to be redirected.

### Claim 11 (depends on 10)

The device of claim 10, wherein the number of traffic redirection tables each comprise received policies that match a first plurality of authorization rules and/or do not include received policies that match a second plurality of authorization rules.

### Claim 12 (depends on 9)

The device of claim 9, wherein the management tool stores a number of redirection authorization tables that each save a plurality of authorization rules, for data traffic redirection policies, selected from a group that comprises:
identification of a virtual machine manager or a virtual management application from which a number of particular policy redirection rules are permitted;
a description of permitted data traffic to be redirected; and
a description of a number of permitted destinations for redirection of the data traffic.

### Claim 13

A data traffic management system, comprising:
a communication interconnect;
a network device to receive a number of policies for data traffic redirection coupled to the communication interconnect; and
a management tool to authorize a subset of the number of policies for data traffic redirection by a number of switches conditioned on a match with a plurality of saved authorization rules.

### Claim 14 (depends on 13)

The system of claim 13, wherein the number of switches are configured to direct the data traffic to a particular application of a specified server or a specified virtual machine of a plurality of servers or virtual machines.

### Claim 15 (depends on 14)

The system of claim 14, wherein the management tool is configured to authorize the number of switches to redirect the data traffic to the particular application of the specified server or the specified virtual machine conditioned on a match of a plurality of redirection rules for a particular data traffic redirection with the plurality of saved authorization rules.