Back to results
US 2018/0006938 A1Published application
Application Domain Security
AssigneeKnuEdge Incorporated
InventorsDouglas B. Meyer, Michael George Creamer
Life of this patent
Estimating the term…
Abstract
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for application domain security. One of the methods includes maintaining, for each ingress port of a plurality of ingress ports of each top-level router of each processing device in a system, information representing one or more valid destination device ids for packets arriving at the ingress port. If an extracted destination device id of a packet received at a first ingress port of a first top-level router of a first processing device is an invalid destination device id according to information associated with the first internal ingress port, the first top-level router modifies a path of the received packet.
Claims40
A computer-implemented method comprising:
- processing, by a plurality of processing devices, packets originating from a plurality of different applications executing on one or more of the processing devices, wherein each processing device has one or more integrated processing cores and an integrated top-level router, wherein each processing device is assigned to exactly one application of the plurality of different applications, and wherein all processing devices assigned to a particular application belong to a corresponding application domain;
- maintaining, for each ingress port of a plurality of ingress ports of each top-level router of each processing device of the plurality of processing devices, information representing one or more valid destination device ids for packets arriving at the ingress port;
- receiving, by a first ingress port of a first top-level router of a first processing device, a packet;
- extracting a destination device id from the received packet;
- determining that the extracted destination device id of the received packet is an invalid destination device id according to information associated with the first ingress port;
- and
- in response to the determination, modifying, by the first top-level router, a path of the received packet.
4 more elements
A computer-implemented method comprising:
- processing, by a plurality of processing devices, packets originating from a plurality of different applications executing on one or more of the processing devices, wherein each processing device has one or more integrated processing cores and an integrated top-level router, wherein each processing device is assigned to exactly one application of the plurality of different applications, and wherein all processing devices assigned to a particular application belong to a corresponding application domain;
- maintaining, for each external egress port of a plurality of external egress ports of each top-level router of each processing device of the plurality of processing devices, information representing one or more valid destination device ids for packets arriving at the external egress port;
- receiving, by a first external egress port of a first top-level er of a first processing device, a packet;
- extracting a destination device id from the received packet;
- determining that the extracted destination device id of the received packet is an invalid destination device id according to information associated with the first external egress port;
- and
- in response to the determination, modifying, by the first top-level router, a path of the received packet.
4 more elements
A system comprising:
- a plurality of processing devices, each processing device comprising one or more integrated processing cores and an integrated top-level router,
- wherein each processing device is configured to receive an assignment to exactly one application of a plurality of different applications,
- wherein each processing device of the plurality of processing devices is configured to perform operations comprising:
- maintaining, for each ingress port of a plurality of ingress ports of the top-level router of the processing device, information representing one or more valid destination device ids for packets arriving at the ingress port, wherein the information represents an assignment of the plurality of processing devices to a plurality of different application domains,
- receiving, by an ingress port of a top-level router of the processing device, a packet;
- extracting a destination device id from the received packet;
- determining that the extracted destination device id of the received packet is an invalid destination device id according to information associated with the ingress port;
- and
- in response to the determination, modifying a path of the received packet.
6 more elements
A system comprising:
- a plurality of processing devices, each processing device comprising one or more integrated processing cores and an integrated top-level router,
- wherein each processing device is configured to receive an assignment to exactly one application of a plurality of different applications,
- wherein each processing device of the plurality of processing devices is configured to perform operations comprising:
- maintaining, for each external egress port of a plurality of external egress ports of the processing device, information representing one or more valid destination device ids for packets arriving at the external egress port, wherein the information represents an assignment of the plurality of processing devices to a plurality of different application domains;
- receiving, by an external egress port of a top-level router of the processing device, a packet;
- extracting a destination device id from the received packet;
- determining that the extracted destination device id of the received packet is an invalid destination device id according to information associated with the external egress port;
- and
- in response to the determination, modifying a path of the received packet.
6 more elements
Dependencies are inferred from the claim text.