Back to results
US 9,525,564 B2Granted
Secure virtual network platform for enterprise hybrid cloud computing environments
AssigneeZentera Systems, Inc.
InventorJaushin Lee
Life of this patent
Estimating the term…
Abstract
A secure virtual network platform connects two or more different or separate network domains. When a data packet is received at an end point in one network domain, a determination is made as to whether the data packet should be forwarded outside the virtual network platform, or transmitted via the virtual network to a destination in another network domain connected by the virtual network platform.
Claims21
A method comprising:
- providing a virtual network switch coupled between a first network domain and a second network domain, wherein the virtual network switch is separate from the first and second network domains, and the second network domain is separate from the first network domain;
- providing a controller coupled to the virtual network switch, the first network domain, and the second network domain;
- receiving at a first end point in the first network domain a request to make a connection to a second end point in the second network domain;
- determining if the connection should be provided through a virtual network connecting the first network domain with the second network domain;
- if the connection should be provided through the virtual network, establishing a virtual network connection between the first end point and the second end point to transmit a payload from the first network domain to the second network domain, wherein the establishing comprises:
- initiating by the first end point, as allowed by the controller, first traffic from the first network domain to the virtual network switch, the first traffic being allowed through a first firewall of the first network domain because the first traffic is outbound from the first network domain to the virtual network switch, the first traffic thereby being first outbound traffic;
- initiating by the second end point, as allowed by the controller, second traffic from the second network domain to the virtual network switch, the second traffic being allowed through a second firewall of the second network domain because the second traffic is outbound from the second network domain to the virtual network switch, the second traffic thereby being second outbound traffic;
- and
- placing by the virtual network switch the payload from the first outbound traffic established by the first end point into a reply to the second outbound traffic established by the second end point residing in the second network domain;
- and
- if the connection should not be provided through the virtual network, passing the request outside the virtual network.
8 more elements
A method comprising:
- providing a virtual network switch coupled between a first network domain and a second network domain, wherein the virtual network switch is separate from the first and second network domains, and the second network domain is separate from the first network domain;
- providing a controller coupled to the virtual network switch, the first network domain, and the second network domain;
- storing a list identifying one or more specific application programs that are allowed to use a virtual network connecting the first network domain with the second network domain;
- receiving at a first end point in the first network domain a request from a client component of an application program to make a connection to a server component of the application program, the server component of the application program being at a second end point in the second network domain;
- determining from the list if the application program is one of the one or more specific application programs that are allowed to use the virtual network;
- if allowed, establishing for the application program a virtual network connection between the first end point and the second end point to transmit a payload from the first network domain to the second network domain, wherein the establishing comprises:
- initiating by the first end point, as allowed by the controller, first traffic from the first network domain to the virtual network switch, the first traffic thereby being first outbound traffic from the first network domain;
- initiating by the second end point, as allowed by the controller, second traffic from the second network domain to the virtual network switch, the second traffic thereby being second outbound traffic from the second network domain;
- and
- placing the payload of the first outbound traffic coming from the first network domain into a reply to the second outbound traffic from the second network domain;
- and
- if not allowed, not establishing the virtual network connection.
9 more elements
A method comprising:
- providing a virtual network switch coupled to a first network domain and a second network domain, wherein the virtual network switch is separate from the first and second network domains, and the second network domain is separate from the first network domain;
- providing a controller coupled to the virtual network switch, the first network domain, and the second network domain;
- storing at a first end point in the first network domain a static routing table comprising a list of virtual destination Internet Protocol (IP) addresses;
- receiving at the first end point a request from a client to connect to a destination;
- scanning the static routing table to determine whether an IP address of the destination is listed in the static routing table;
- if the IP address is not listed, passing the request to a TCP/IP network that is local to the first network domain;
- if the IP address is listed, seeking permission to use a virtual network connecting the first network domain to the second network domain, the destination being in the second network domain;
- and
- upon a determination that use of the virtual network is permitted, establishing for the client a virtual network connection between the first end point and the destination to transmit a payload of the client from the first network domain to the second network domain, wherein the establishing comprises:
- initiating by the first end point, as allowed by the controller, first traffic from the first network domain to the virtual network switch, the first traffic thereby being first outbound traffic from the first network domain;
- initiating by the destination, as allowed by the controller, second traffic from the second network domain to the virtual network switch, the second traffic thereby being second outbound traffic from the second network domain;
- and
- placing the payload from the first network domain into a reply to the second outbound traffic from the second network domain.
10 more elements
Dependencies are inferred from the claim text.