Enhanced management of communication rules over multiple computing networks

Patent metadata

Field	Value
Publication number	US-11588739-B2
Application number	US-201715820075-A
Country	US
Kind code	B2
Filing date	Nov 21, 2017
Priority date	Nov 21, 2017
Publication date	Feb 21, 2023
Grant date	Feb 21, 2023

Abstract

Described herein are systems, methods, and software to enhance the implementation of communication rules in a computing network. In one example, a method of operating a communication settings system maintains communication rules for a plurality of networks, wherein the communication rules define forwarding actions for ingress and egress packets to and from applications in the plurality of computing networks. The service further identifies a configuration request from a computing network with applications executing in the computing network, identifies a subset of the communication rules based on the plurality of applications, and provides the subset of the communication rules to the computing network.

First claim

What is claimed is:

1. A method of managing communication rules for a computing network, the method comprising:
maintaining communication rules from a plurality of computing networks, wherein the communication rules define forwarding actions for ingress and egress packets to and from virtual nodes in the plurality of computing networks based on information about applications on the virtual nodes, wherein each communication rule is associated with at least one application of the applications to apply a forwarding action of the forwarding actions to ingress and/or egress packets associated with the at least one application;
identifying a configuration request from a computing network, wherein the configuration request indicates information about a plurality of applications executing in the computing network;
identifying a subset of the communication rules associated with the information about the plurality of applications; and
providing the subset of the communication rules to the computing network.

2. The method of claim 1 , wherein identifying the configuration request from the computing network comprises receiving the configuration request from a management system associated with the computing network.

3. The method of claim 1 , wherein the virtual nodes comprise virtual machines and/or containers.

4. The method of claim 1 , wherein each of the communication rules define a source, a destination, and a forwarding action.

5. The method of claim 4 , wherein at least one of the source or the destination comprises at least one application group.

6. The method of claim 1 , wherein providing the subset of the communication rules to the computing network comprises initiating an implementation of the communication rules in the computing network.

7. The method of claim 1 , wherein providing the subset of the communication rules to the computing network comprises transferring the subset of the communication rules to a management system of the computing system for selection by an administrator of the computing network.

8. The method of claim 7 further comprising prioritizing the subset of the communication rules based on a quantity of computing networks that have implemented each communication rule in the subset of the communication rules, and wherein transferring the subset of the communication rules to the management system comprises transferring the prioritized subset of the communication rules to the management system.

9. The method of claim 1 , wherein identifying the subset of the communication rules associated with the information about the plurality of applications comprises:
identifying a subset of the computing networks that meet similarity criteria to the computing network based on the information about the plurality of applications; and
identifying the subset of the communication rules from the subset of the computing networks based on the information about the plurality of applications.

10. The method of claim 9 , wherein the similarity criteria comprise application types and network size.

11. A computing apparatus comprising:
one or more non-transitory computer readable storage media;
a processing system operatively coupled to the one or more non-transitory computer readable media;
program instructions stored on the one or more non-transitory computer readable storage media to manage communication rules for a plurality of computing networks that, when read and executed by the processing system, direct the processing system to at least:
maintain communication rules from a plurality of computing networks, wherein the communication rules define forwarding actions for ingress and egress packets to and from virtual nodes in the plurality of computing networks based on information about applications on the virtual nodes, wherein each communication rule is associated with at least one application of the applications to apply a forwarding action of the forwarding actions to ingress and/or egress packets associated with the at least one application;
identify a configuration request from a computing network, wherein the configuration request indicates information about a plurality of applications executing in the computing network;
identify a subset of the communication rules associated with the information about the plurality of applications;
provide the subset of the communication rules to the computing network.

12. The computing apparatus of claim 11 , wherein identifying the configuration request from the computing network comprises receiving the configuration request from a management system associated with the computing network.

13. The computing apparatus of claim 11 , wherein the virtual nodes comprise virtual machines and/or containers.

14. The computing apparatus of claim 11 , wherein each of the communication rules define a source, a destination, and a forwarding action.

15. The computing apparatus of claim 14 , wherein at least one of the source or the destination comprises at least one application group.

16. The computing apparatus of claim 11 , wherein providing the subset of the communication rules to the computing network comprises transferring the subset of the communication rules to a management system of the computing system for selection by an administrator of the computing network.

17. The computing apparatus of claim 16 , wherein the program instructions further direct the processing system to prioritize the subset of the communication rules based on a quantity of computing networks that have implemented each communication rule in the subset of the communication rules and wherein transferring the subset of the communication rules to the management system comprises transferring the prioritized subset of the communication rules to the management system.

18. The computing apparatus of claim 11 , wherein identifying the subset of the communication rules associated with the information about the plurality of applications comprises:
identifying a subset of the computing networks that meet similarity criteria to the computing network based on the information about the plurality of applications; and
identifying the subset of the communication rules from the subset of the computing networks based on the information about the plurality of applications.

19. The computing apparatus of claim 18 , wherein the similarity criteria comprise application types and network size.

20. The method of claim 1 , wherein the information about the applications on the virtual nodes comprises identifiers for the applications, versions of the applications, or licensing information associated with the applications.

Assignees

• Nicira Inc

Inventors

• Chanda Arijit
• Krishnamurthy Rajiv

Classifications

• H04L49/355 Primary

  Application aware switches, e.g. for HTTP · CPC title

• H04L47/20 Primary

  Traffic policing · CPC title

• H04L49/309

  Header conversion, routing tables or routing tags · CPC title

• H04L49/70

  Virtual switches · CPC title

• H04L49/35

  Switches specially adapted for specific applications · CPC title