# US 2014/0196121 A1 · Federation among services for supporting virtual-network overlays > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0196121 A1 - Document ID: US20140196121A1 - Status: Published application - Kind: A1 - Application number: 14/202,966 - Filed: 2014-03-10 - Published: 2014-07-10 - Earliest claimed: 2010-06-25 - Assignees: Microsoft Corporation - Applicants: Microsoft Corporation - Inventors: HASAN ALKHATIB; GEOFFREY OUTHRED; DEEPAK BANSAL; ANATOLIY PANASYUK; DHARSHAN RANGEGOWDA - Web page: https://patentgrep.com/patent/US20140196121A1 ## CPC - G06F 21/31: User authentication - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 9/3247: {involving digital signatures} - H04L 61/2535: {Multiple local networks, e.g. resolving potential IP address conflicts} - H04L 61/2546: Arrangements for avoiding unnecessary translation - H04L 61/5046: Resolving address allocation conflicts; Testing of addresses (testing when self-assigning an address H04L61/5092) - H04L 63/0815: {providing single-sign-on or federations} - H04L 63/104: {Grouping of entities} - H04L 2209/60: Digital content management, e.g. content distribution - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Computerized methods, systems, and computer-readable media for promoting cooperation between a first and second virtual network overlay (“overlay”) are provided. The first overlay is governed by a first authority domain and includes members assigned virtual IP addresses from a first address range. The second overlay is governed by a second authority domain, which is associated with a second federation mechanism, for negotiating on behalf of the second overlay. The second federation mechanism is capable of negotiating with, or soliciting delegation of authority from, a first federation mechanism that is associated with the first authority domain. When negotiations are successful or authority is delegated, the second federation mechanism establishes a communication link between the second overlay and the first overlay or joins a member of the second overlay to the first overlay. Joining involves allocating a guest IP address from the first address range to the member. ## Claims ### Claim 1 A computer-implemented method suitable for use on one or more computing device having a processor and a memory to perform a method for allowing a first overlay governed by a first authority domain to negotiate with a second overlay governed by second authority domain in order to avoid addressing ambiguity, the method comprising: providing the first overlay that includes members assigned virtual IP addresses from a first address range, wherein a first federation mechanism is associated with the first authority domain and is provisioned to negotiate on behalf of the first overlay; providing the second overlay that includes members assigned virtual IP addresses from a second address range, wherein a second federation mechanism is associated with the second authority domain and is provisioned to negotiate on behalf of the second overlay; invoking a negotiation between the first federation mechanism and the second federation mechanism, wherein the negotiation includes an address-resolution process that establishes a communication link; and negotiating to gain authority over the communication link. ### Claim 2 (depends on 1) The one or more computer-readable media of claim 1, wherein the first overlay represents a virtual network overlay within a cloud computing network that has a plurality of members joined thereto, and wherein the plurality of members include endpoints of a service application that interact via peer-to-peer semantics. ### Claim 3 (depends on 1) The one or more computer-readable media of claim 1, wherein the second overlay represents a virtual network overlay within a private enterprise network that has a plurality of members joined thereto, and wherein the plurality of members include endpoints of a service application that interact via peer-to-peer semantics. ### Claim 4 (depends on 1) The one or more computer-readable media of claim 1, wherein the communication link enables direct communication via peer-to-peer semantics between members of the first overlay and members of the second overlay without relying on a translation mechanism. ### Claim 5 (depends on 1) The one or more computer-readable media of claim 1, wherein data packets sent from an origination endpoint of the first overlay are structured with headers that carry a source IP address in virtual space that point to a target endpoint, and wherein the data packets reach the target endpoint of the second overlay without translation applied. ### Claim 6 (depends on 5) The one or more computer-readable media of claim 5, wherein data packets returned from the target endpoint of the second overlay are structured with headers that carry a destination IP address in virtual space that point to the original endpoint, and wherein the data packets reach the origination endpoint of the first overlay without translation applied. ### Claim 7 (depends on 1) The one or more computer-readable media of claim 1, wherein the address negotiation process comprises: (a) determining a version of internet protocol (IP) to employ when routing communications between the first overlay and the second overlay; (b) when it is determined to employ IP version 6 (IPv6) addressing, establishing a communication link that is absent a translation mechanism; (c) when it is determined to employ IP version 4 (IPv4) addressing, determining whether a portion of the first address range and a portion of the second address range overlap; (d) when it is determined that no overlap exists between the first address range and the second address range, establishing the communication link that is absent the translation mechanism; and (e) when it is determined that the first address range and the second address range overlap, establishing a network address translation (NAT) link that attempts to resolve IPv4 address conflicts between the first overlay and the second overlay. ### Claim 8 (depends on 7) The one or more computer-readable media of claim 7, wherein establishing the NAT link comprises: establishing the communication link between the first overlay and the second overlay; and injecting a translation device into the communication link that functions as an interface for converting overlapping IP addresses. ### Claim 9 (depends on 1) The one or more computer-readable media of claim 1, wherein negotiating to gain authority over the communication link comprises: sending a request from the first federation mechanism to the second federation mechanism, wherein the request conveys a proposed policy; and receiving a response from the second federation mechanism. ### Claim 10 (depends on 9) The one or more computer-readable media of claim 9, wherein the received response includes addendums to the proposed policy, and wherein negotiating to gain authority over the communication link further comprises: replying to the response with an acceptance of the addendums; and receiving an indication that the second federation mechanism confers delegating authority of the communication link to the first federation mechanism. ### Claim 11 (depends on 9) The one or more computer-readable media of claim 9, wherein the received response includes acceptance to the proposed policy, and wherein negotiating to gain authority over the communication link further comprises: receiving a delegation of authority from the second federation mechanism to the first federation mechanism; and transferring authority from the first federation mechanism to an administrator of the first overlay to provision and to enforce the proposed policy upon the communication link. ### Claim 12 (depends on 1) The one or more computer-readable media of claim 1, wherein the method further comprises delegating authority over the communication link from the second federation mechanism to the first federation mechanism. ### Claim 13 (depends on 12) The one or more computer-readable media of claim 12, wherein delegating authority over the communication link comprises: sending a solicitation to gain delegation of authority to the second federation mechanism; and receiving a confirmation from the second federation mechanism agreeing to delegate authority of the communication link to the first federation mechanism. ### Claim 14 A system for performing a method of coordinating between a first authority domain and a second authority domain, the system comprising: a subject member under the purview of the second authority domain, wherein the subject member is joined to a second overlay governed by the second authority domain; a first overlay governed by the first authority domain, wherein the first overlay includes members assigned virtual IP addresses from a first address range; a second federation mechanism that requests the subject member join the first overlay, wherein the second federation mechanism is associated with the second authority domain; and a first federation mechanism that is associated with the first authority domain, wherein the first federation mechanism, upon detecting the request, allocates a guest IP address from the first address range and confirms joinder of the subject member by sending the guest IP address to the second federation mechanism. ### Claim 15 (depends on 14) The system of claim 14, wherein the second federation mechanism assigns the guest IP address to the subject member. ### Claim 16 (depends on 15) The system of claim 15, wherein, upon being assigned the guest IP address, the subject member launches a virtual network interface controller (NIC) provisioned with the guest IP addresses and registers as a guest with the first overlay, wherein the virtual NIC allows the subject member to interoperate with the members of the first overlay via peer-to-peer semantics. ### Claim 17 (depends on 14) The system of claim 14, wherein the second federation mechanism invokes a negotiation with the first federation mechanism on behalf of the subject member, and wherein the negotiation results in a predetermination that the subject member is verified to join the first overlay upon request. ### Claim 18 (depends on 14) The system of claim 14, wherein the first federation mechanism solicits the second federation mechanism for a verification of trust for the subject member, and wherein the second federation mechanism responds to the solicitation with a security token. ### Claim 19 (depends on 18) The system of claim 18, wherein the subject member presents the security token to the first overlay when attempting to participate within the first overlay, and wherein, upon validating the electronics signature of the security token against a key, the first overlay cryptographically verifies the subject member. ### Claim 20 A computer-implemented method suitable for use on one or more computing devices having a processor and a memory to perform a method for joining a subject endpoint under the purview of a second domain authority to a first overlay governed by a first domain authority, the method comprising: negotiating with a first federation mechanism on behalf of the subject endpoint, wherein the negotiation results in a predetermination that the subject endpoint is authorized to join the first overlay; requesting that the subject endpoint be admitted to the first overlay, wherein the first overlay includes members assigned virtual IP addresses from an address range; receiving a guest IP address allocated from the address range; receiving a security token, wherein the guest IP address in conjunction with the security token allow the subject endpoint to interoperate with the members of the first overlay using peer-to-peer semantics; and writing to a storage location a key that validates the security token.