Hypervisor restart handling mechanism using random session numbers

Patent metadata

Field	Value
Publication number	US-10649803-B2
Application number	US-201815938763-A
Country	US
Kind code	B2
Filing date	Mar 28, 2018
Priority date	Mar 28, 2018
Publication date	May 12, 2020
Grant date	May 12, 2020

Abstract

Certain embodiments described herein are generally directed to handling a hypervisor restart event in a distributed network system. Embodiments include receiving, by a central controller, a session identifier from a first hypervisor. Embodiments further include comparing, by the central controller, the session identifier to a stored session identifier associated with the first hypervisor. Embodiments further include determining, by the central controller based on the session identifier not matching the stored session identifier associated with the first hypervisor, that the first hypervisor has restarted. Embodiments further include updating, by the central controller, the stored session identifier associated with the first hypervisor to match the session identifier. Embodiments further include identifying, by the central controller, a second hypervisor that is associated with the first hypervisor. Embodiments further include sending, by the central controller, a notification to the second hypervisor that the first hypervisor has restarted.

First claim

We claim:

1. A method for handling a hypervisor restart event in a distributed network system, the method comprising:
receiving, by a central controller, a session identifier from a first hypervisor;
comparing, by the central controller, the session identifier to a stored session identifier associated with the first hypervisor;
determining, by the central controller based on the session identifier not matching the stored session identifier associated with the first hypervisor, that the first hypervisor has restarted;
updating, by the central controller, the stored session identifier associated with the first hypervisor to match the session identifier;
identifying, by the central controller, a second hypervisor that is associated with the first hypervisor;
sending, by the central controller, a notification to the second hypervisor that the first hypervisor has restarted.

2. The method of claim 1 , wherein identifying the second hypervisor that is associated with the first hypervisor comprises: determining that the first hypervisor shares a security policy with the second hypervisor.

3. The method of claim 2 , wherein the second hypervisor, upon receiving the notification, removes an old security association with the first hypervisor and establishes a new security association with the first hypervisor.

4. The method of claim 2 , wherein the security policy comprises a distributed networking encryption (DNE) policy.

5. The method of claim 1 , further comprising:
receiving, by the first hypervisor and from the central controller, a control message comprising a second session identifier in a header of the control message;
comparing, by the first hypervisor, the second session identifier to the session identifier, wherein the session identifier is stored by the first hypervisor;
determining, by the first hypervisor based on the comparing, that the second session identifier does not match the session identifier;
discarding, by the first hypervisor, the control message based on the second session identifier not matching the session identifier.

6. The method of claim 5 , further comprising:
sending, by the first hypervisor and to the central controller, a notification of the session identifier.

7. The method of claim 1 , wherein prior to receiving, by the central controller, the session identifier, the method further comprises:
determining, by the first hypervisor, that the first hypervisor has restarted;
generating, by the first hypervisor, the session identifier;
sending, by the first hypervisor, the session identifier to the central controller.

8. A computer system comprising: one or more processors; and a non-transitory computer-readable medium storing instructions that, when executed, cause the one or more processors to perform a method for handling a hypervisor restart event in a distributed network system, the method comprising:
receiving, by a central controller, a session identifier from a first hypervisor;
comparing, by the central controller, the session identifier to a stored session identifier associated with the first hypervisor;
determining, by the central controller based on the session identifier not matching the stored session identifier associated with the first hypervisor, that the first hypervisor has restarted;
updating, by the central controller, the stored session identifier associated with the first hypervisor to match the session identifier;
identifying, by the central controller, a second hypervisor that is associated with the first hypervisor;
sending, by the central controller, a notification to the second hypervisor that the first hypervisor has restarted.

9. The system of claim 8 , wherein identifying the second hypervisor that is associated with the first hypervisor comprises: determining that the first hypervisor shares a security policy with the second hypervisor.

10. The system of claim 9 , wherein the second hypervisor, upon receiving the notification, removes an old security association with the first hypervisor and establishes a new security association with the first hypervisor.

11. The system of claim 9 , wherein the security policy comprises a distributed networking encryption (DNE) policy.

12. The system of claim 8 , wherein the method further comprises:
receiving, by the first hypervisor and from the central controller, a control message comprising a second session identifier in a header of the control message;
comparing, by the first hypervisor, the second session identifier to the session identifier, wherein the session identifier is stored by the first hypervisor;
determining, by the first hypervisor based on the comparing, that the second session identifier does not match the session identifier;
discarding, by the first hypervisor, the control message based on the second session identifier not matching the session identifier.

13. The system of claim 12 , wherein the method further comprises:
sending, by the first hypervisor and to the central controller, a notification of the session identifier.

14. The system of claim 8 , wherein prior to receiving, by the central controller, the session identifier, the method further comprises:
determining, by the first hypervisor, that the first hypervisor has restarted;
generating, by the first hypervisor, the session identifier;
sending, by the first hypervisor, the session identifier to the central controller.

15. A non-transitory computer readable medium comprising instructions to be executed in a computer system, wherein the instructions when executed in the computer system perform a method for handling a hypervisor restart event in a distributed network system, the method comprising:
receiving, by a central controller, a session identifier from a first hypervisor;
comparing, by the central controller, the session identifier to a stored session identifier associated with the first hypervisor;
determining, by the central controller based on the session identifier not matching the stored session identifier associated with the first hypervisor, that the first hypervisor has restarted;
updating, by the central controller, the stored session identifier associated with the first hypervisor to match the session identifier;
identifying, by the central controller, a second hypervisor that is associated with the first hypervisor;
sending, by the central controller, a notification to the second hypervisor that the first hypervisor has restarted.

16. The non-transitory computer readable medium of claim 15 , wherein identifying the second hypervisor that is associated with the first hypervisor comprises: determining that the first hypervisor shares a security policy with the second hypervisor.

17. The non-transitory computer readable medium of claim 16 , wherein the second hypervisor, upon receiving the notification, removes an old security association with the first hypervisor and establishes a new security association with the first hypervisor.

18. The non-transitory computer readable medium of claim 16 , wherein the security policy comprises a distributed networking encryption (DNE) policy.

19. The non-transitory computer readable medium of claim 15 , wherein the method further comprises:
receiving, by the first hypervisor and from the central controller, a control message comprising a second session identifier in a header of the control message;
comparing, by the first hypervisor, the second session identifier to the session identifier, wherein the session identifier is stored by the first hypervisor;
determining, b

Assignees

• Nicira Inc

Inventors

• Qian Bin
• Chopra Amit
• Wang Dexiang
• Li Chen
• Pan Feng
• Shen Jianjun
• Saxena Aayush
• Ping Yang

Classifications

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title

• G06F9/45533

  Hypervisors; Virtual machine monitors · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F21/575

  Secure boot · CPC title