Location-aware service request handling

Patent metadata

Field	Value
Publication number	US-11595388-B2
Application number	US-202117533139-A
Country	US
Kind code	B2
Filing date	Nov 23, 2021
Priority date	Jun 27, 2019
Publication date	Feb 28, 2023
Grant date	Feb 28, 2023

Abstract

Example methods and systems are provided for location-aware service request handling. The method may comprise: generating and sending location information associated with virtualized computing instance to a service node or a management entity for transmission to the service node. The location information may identify logical element(s) to which the virtualized computing instance is connected. The method may further comprise: in response to detecting, from the virtualized computing instance, a service request for a service from the service node, generating a modified service request by modifying the service request to include the location information associated with the virtualized computing instance; and sending the modified service request towards the service node.

First claim

We claim:

1. A method for a service node to perform verification of service requests in a software-defined networking (SDN) environment, the method comprising:
receiving, by the service node, first location information associated with a virtualized computing instance, wherein the first location information uniquely identifies one or more logical elements to which the virtualized computing instance is connected;
storing, by the service node, the first location information;
detecting, by the service node, a service request that indicates the virtualized computing instance as a source of the request and that includes second location information;
determining, by the service node, whether the second location information in the service request matches the stored first location information; and
verifying, by the service node, authenticity of the service request, in response to determination that the second location information matches the stored first location information.

2. The method of claim 1 , further comprising:
dropping, by the service node, the service request, in response to a failure to verify the authenticity of the service request due to a mismatch between the second location information and the stored first location information.

3. The method of claim 1 , wherein the service node comprises a dynamic host configuration protocol (DHCP) server, and wherein the service request comprises a DHCP request.

4. The method of claim 1 , wherein the service node comprises a domain name system (DNS) server, and wherein the service request comprises a DNS request.

5. The method of claim 1 , further comprising:
in response to verifying the authenticity of the service request due to the second location information matching the stored first location information, applying, by the service node, a policy associated with the second location information to identify an address; and
sending, by the service node, the identified address in a reply to the service request.

6. The method of claim 1 , wherein the second location information identifies a logical switch port and a logical switch to which the virtualized computing instance is connected, and wherein the service request detected by the service node is a modified service request that results from insertion of the second location information into an original service request sent by the virtualized computing instance.

7. The method of claim 1 , wherein for security, the first location information is managed and distributed by a network manager instead of the virtualized computing instance, and wherein receiving the first location information includes, receiving, by the service node, the first location information from the network manager.

8. A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a service node, cause the processor to perform verification of service requests in a software-defined networking (SDN) environment, wherein the method comprises:
receiving, by the service node, first location information associated with a virtualized computing instance, wherein the first location information uniquely identifies one or more logical elements to which the virtualized computing instance is connected;
storing, by the service node, the first location information;
detecting, by the service node, a service request that indicates the virtualized computing instance as a source of the request and that includes second location information;
determining, by the service node, whether the second location information in the service request matches the stored first location information; and
verifying, by the service node, authenticity of the service request, in response to determination that the second location information matches the stored first location information.

9. The non-transitory computer-readable storage medium of claim 8 , wherein the method further comprises:
dropping, by the service node, the service request, in response to a failure to verify the authenticity of the service request due to a mismatch between the second location information and the stored first location information.

10. The non-transitory computer-readable storage medium of claim 8 , wherein the service node comprises a dynamic host configuration protocol (DHCP) server, and wherein the service request comprises a DHCP request.

11. The non-transitory computer-readable storage medium of claim 8 , wherein the service node comprises a domain name system (DNS) server, and wherein the service request comprises a DNS request.

12. The non-transitory computer-readable storage medium of claim 8 , wherein the method further comprises:
in response to verifying the authenticity of the service request due to the second location information matching the stored first location information, applying, by the service node, a policy associated with the second location information to identify an address; and
sending, by the service node, the identified address in a reply to the service request.

13. The non-transitory computer-readable storage medium of claim 8 , wherein the second location information identifies a logical switch port and a logical switch to which the virtualized computing instance is connected, and wherein the service request detected by the service node is a modified service request that results from insertion of the second location information into an original service request sent by the virtualized computing instance.

14. The non-transitory computer-readable storage medium of claim 8 , wherein for security, the first location information is managed and distributed by a network manager instead of the virtualized computing instance, and wherein receiving the first location information includes, receiving, by the service node, the first location information from the network manager.

15. A service node, comprising:
one or more processors; and
a non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by the one or more processors, cause the one or more processors to perform operations to verify service requests in a software-defined networking (SDN) environment, wherein the operations include:
receive first location information associated with a virtualized computing instance, wherein the first location information uniquely identifies one or more logical elements to which the virtualized computing instance is connected;
store the first location information;
detect a service request that indicates the virtualized computing instance as a source of the request and that includes second location information;
determine whether the second location information in the service request matches the stored first location information; and
verify authenticity of the service request, in response to determination that the second location information matches the stored first location information.

16. The service node of claim 15 , wherein the instructions further include:
drop the service request, in response to a failure to verify the authenticity of the service request due to a mismatch between the second location information and the stored first location information.

17. The service node of claim 15 , wherein the service node comprises a dynamic host configuration protocol (DHCP) server, and wherein the service request comprises a DHCP request.

18. The service node of claim 15 , wherein the service node comprises a domain name system (DNS) server, and wherein the service request comprises a DNS request.

Assignees

• Vmware Inc

Inventors

• Luo Ye
• Wu Qi
• Han Donghai

Classifications

• H04L41/0897

  by horizontal or vertical scaling of resources, or by migrating entities, e.g. virtual resources or entities · CPC title

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L41/0895

  Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L41/0816 Primary

  the condition being an adaptation, e.g. in response to network events · CPC title