Cloud based cross domain system—virtual data diode

Patent metadata

Field	Value
Publication number	US-12095868-B2
Application number	US-202117534187-A
Country	US
Kind code	B2
Filing date	Nov 23, 2021
Priority date	Nov 23, 2021
Publication date	Sep 17, 2024
Grant date	Sep 17, 2024

Abstract

In some aspects, a network interface card (NIC) may receive, at a first node of a network interface card associated with a disconnected network, a message intended for the disconnected network and sent using a first communication protocol. The network interface card may send the message from the first node to a second node of the network interface card using a second communication protocol, the second communication protocol being configured for unidirectional communication. The network interface card may receive the message at the second node. The network interface card may send, from the second node, the message to a destination node of the disconnected network using a third communication protocol. Numerous other aspects are described.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving, at a first processing node of a network interface card associated with a virtual network, a message intended for the virtual network and sent using a two-way communication protocol, the network interface card comprising a network virtualization device configured to implement the virtual network which is running on top of a physical network;
converting, at the first processing node, the message from the two-way communication protocol to a one-way communication protocol;
sending the message from the first processing node to a second processing node of the network interface card using the one-way communication protocol;
receiving the message at the second processing node; and
sending, from the second processing node, the message to a destination resource of the virtual network.

2. The method of claim 1 , wherein the one-way communication protocol is user datagram protocol.

3. The method of claim 1 , wherein the network interface card comprises a smart network interface card.

4. The method of claim 1 , wherein the virtual network comprises a virtual cloud network.

5. The method of claim 1 , wherein the virtual network is configured to not be connected to a public network.

6. The method of claim 1 , wherein the message, after leaving the second processing node, passes through a filter chain before arriving at the destination resource.

7. The method of claim 1 , wherein a connection between the first processing node and the second processing node is established using a networking cable.

8. The method of claim 7 , wherein the connection established using the networking cable does not include a diode.

9. A non-transitory computer-readable storage medium storing a set of instructions, that, when executed by one or more processors of a computing device, cause the computing device to perform instructions comprising:
receiving, at a first processing node of a network interface card associated with a virtual network, a message intended for the virtual network and sent using a two-way communication protocol, the network interface card comprising a network virtualization device configured to implement the virtual network which is running on top of a physical network;
converting, at the first processing node, the message from the two-way communication protocol to a one-way communication protocol;
sending the message from the first processing node to a second processing node of the network interface card using the one-way communication protocol;
receiving the message at the second processing node; and
sending, from the second processing node, the message to a destination resource of the virtual network.

10. The non-transitory computer-readable storage medium of claim 9 , wherein the one-way communication protocol is user datagram protocol.

11. The non-transitory computer-readable storage medium of claim 9 , wherein the network interface card comprises a smart network interface card.

12. The non-transitory computer-readable storage medium of claim 9 , wherein the virtual network comprises a virtual cloud network.

13. The non-transitory computer-readable storage medium of claim 9 , wherein the virtual network is configured to not be connected to a public network.

14. The non-transitory computer-readable storage medium of claim 9 , wherein the message, after leaving the second processing node, passes through a filter chain before arriving at the destination resource.

15. The non-transitory computer-readable storage medium of claim 9 , wherein a connection between the first processing node and the second processing node is a networking cable.

16. A network interface card associated with a virtual network, comprising:
a first processing node;
a second processing node;
a memory storing computer-executable instructions; and
one or more processors configured to access the first processing node, the second processing node, and the memory, and configured to execute the computer-executable instructions to at least:
receive, at the first processing node, a message intended for the virtual network and sent using a two-way communication protocol, the network interface card comprising a network virtualization device configured to implement the virtual network which is running on top of a physical network;
convert, at the first processing node, the message from the two-way communication protocol to a one-way communication protocol;
send the message from the first processing node to the second processing node using the one-way communication protocol;
receive the message at the second processing node; and
send, from the second processing node, the message to a destination resource of the virtual network.

17. The network interface card of claim 16 , wherein the one-way communication protocol is user datagram protocol.

18. The network interface card of claim 16 , wherein the network interface card comprises a smart network interface card.

19. The network interface card of claim 16 , wherein the virtual network comprises a virtual cloud network.

20. The network interface card of claim 16 , wherein the message, after leaving the second processing node, passes through a filter chain before arriving at the destination resource.

21. The method of claim 1 ,
wherein the network interface card is configured to, upon having determined that the message is from an untrusted source, convert the message at the first processing node from the two-way communication protocol to the one-way communication protocol and to send the message from the first processing node to the second processing node using the one-way communication protocol, and
wherein the network interface card is configured to, upon having determined that the message is from a trusted source, send the message from the first processing node to the second processing node using the two-way communication protocol.

22. The method of claim 1 ,
wherein the message is received at the first processing node from a first source, and wherein converting the message from the two-way communication protocol to the one-way communication protocol is performed based on the message being received from the first source;
wherein the method further comprises:
receiving, at the first processing node of the network interface card associated with the virtual network, a second message intended for the virtual network and sent using the two-way communication protocol, wherein the second message is received at the second processing node from a second source, wherein the second source is different from the first source;
based on the second message being received from the second source, sending the second message from the first processing node to the second processing node of the network interface card using the two-way communication protocol;
receiving the second message at the second processing node; and
sending, from the second processing node, the second message to a second destination resource of the virtual network.

23. The method of claim 22 , further comprising:
determining, at the first processing node, that the second source is a trusted source; and
sending the second message from the first processing node to the second processing node of the network interface card using the two-way communication protocol responsive to determining that the second source is the trusted source.

24. The method of claim 22 , further comprising:
determ

Assignees

• Oracle Int Corp

Inventors

• Adogla Eden Grail
• Kuehnel Thomas Werner

Classifications

• H04L49/30

  Peripheral units, e.g. input or output ports · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L67/141 Primary

  Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) · CPC title