Performing services on data messages associated with endpoint machines

Patent metadata

Field	Value
Publication number	US-10862773-B2
Application number	US-201815881639-A
Country	US
Kind code	B2
Filing date	Jan 26, 2018
Priority date	Jan 26, 2018
Publication date	Dec 8, 2020
Grant date	Dec 8, 2020

Abstract

Some embodiments of the invention provide a method for performing services on an endpoint machine in a datacenter. On the endpoint machine, the method installs a guest introspection (GI) agent and a service engine. In some embodiments, the GI agent and the service engine are part of one monitor agent that is installed on the endpoint machine. The method then registers with a set of one or more notification services on the endpoint machine, the GI agent to receive notifications regarding new data message flow events on the endpoint machine. Through the notifications, the GI agent captures contextual data items regarding new data message flows, and stores the captured contextual data items. The service engine then performs a service for the data message flow based on the captured contextual data.

First claim

The invention claimed is:

1. A method of performing services on a virtual machine in a datacenter, the method comprising:
on the virtual machine, installing a guest introspection (GI) agent and a service engine;
with a set of one or more notification services on the virtual machine, registering the GI agent to receive notifications regarding new data message flows on the virtual machine;
after receiving at the GI agent a notification regarding a new data message flow started on the virtual machine, obtaining a set of contextual data items regarding the new data message flow, and storing the set of contextual data items; and
using the set of contextual data items at the service engine to perform a service operation on the new data message flow,
wherein the service engine performs the service based on a set of service rules each of which comprises a rule identifier and a service action,
wherein the rule identifier of each service rule in a subset of one or more service rules is defined by reference to at least one contextual data item.

2. The method of claim 1 , wherein the service engine performs the service on a first data message in the new data message flow based at least on the set of contextual data item, and stores the result of the service on the first data message in a connection cache in order to re-use the stored result for subsequent data messages in the data message flow.

3. The method of claim 1 , wherein through said notifications, the GI agent identifies a process executing on the virtual machine, captures a set of contextual data items regarding the identified process, stores the set of captured contextual data items, and specifies the stored set of contextual data items for the new data message flow for the service engine to use when the service engine receives the new data message flow associated with said process.

4. The method of claim 3 , wherein the GI agent receives notifications and captured contextual data when processes have launched for execution on the virtual machine.

5. The method of claim 3 further comprising registering the service engine to receive notifications regarding new data message flows on the virtual machine.

6. The method of claim 1 further comprising providing notification from the GI agent to the service engine regarding the new data message flow.

7. The method of claim 1 further comprising providing service rules to the virtual machine from a server that belongs to a set of servers that manages performance of services in a datacenter.

8. The method of claim 7 , wherein the server set manages services on different types of endpoint machines in the datacenter including bare metal computers, virtual machines executing on hypervisors executing on host computers, and containers executing on host computers.

9. The method of claim 1 , wherein installing the GI agent and service engine comprises installing a monitor agent that includes the GI agent and the service engine.

10. A non-transitory machine readable medium comprising sets of instructions for execution by at least one hardware processing unit of a computer to perform services on container executing on the computer in a datacenter, wherein a guest introspection (GI) agent and a service engine are installed on the container machine, the sets of instructions for:
with a set of one or more notification services on the container machine, registering the GI agent to receive notifications regarding new data message flows on the container;
after receiving at the GI agent a notification regarding a new data message flow started on the container, obtaining a set of contextual data items regarding the new data message flow, and storing the set of contextual data items; and
using the set of contextual data items at the service engine to perform a service operation on the new data message flow,
wherein the service engine performs the service based on a set of service rules each of which comprises a rule identifier and a service action,
wherein the rule identifier of each service rule in a subset of one or more service rules is defined by reference to at least one contextual data item.

11. The non-transitory machine readable medium of claim 10 , wherein through said notifications, the GI agent identifies a process executing on the container, captures a set of contextual data items regarding the identified process, stores the set of captured contextual data items, and specifies the stored set of contextual data items for the new data message flow for the service engine to use when the service engine receives the new data message flow associated with said process.

12. The non-transitory machine readable medium of claim 11 , wherein the sets of instructions further comprises sets of instructions for:
registering the service engine to receive notifications regarding new data message flows on the container;
receiving a notification regarding the new data message flow at the service engine; and
retrieving the stored set of contextual data for the new data message flow in order to perform the service operation on the new data message flow.

13. The non-transitory machine readable medium of claim 10 , wherein the set of contextual attributes include other attributes than layer 2, layer 3 and layer 4 header values of the data message flow.

14. The non-transitory machine readable medium of claim 10 , wherein the service operation of the service engine is a middlebox service operation.

15. The non-transitory machine readable medium of claim 10 , wherein the sets of instructions further comprises a set of instructions for providing notification from the GI agent to the service engine regarding the new data message flow.

Assignees

• Nicira Inc

Inventors

• Chanda Arijit
• Krishnamurthy Rajiv
• Poon Arnold K
• Chen Tori

Classifications

• H04L41/40

  using virtualisation of network functions or resources, e.g. SDN or NFV entities · CPC title

• H04L41/0895

  Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements · CPC title

• H04L67/568

  Storing data temporarily at an intermediate stage, e.g. caching · CPC title

• H04L41/0806

  for initial configuration or provisioning, e.g. plug-and-play · CPC title

• H04L41/046 Primary

  comprising network management agents or mobile agents therefor · CPC title