Scalable policy management in an edge virtual bridging (EVB) environment

• US 10,534,627 B2
• Filed: 05/31/2018
• Issued: 01/14/2020
• Est. Priority Date: 03/18/2013
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Abidi, Vasmi M., Radhakrishnan, Chandramouli
• Primary Examiner(s): Kamran, Mehran
• Application Number:
  US15/994,973
• Publication Number:
  US 20180276017A1
• Time in Patent Office: 593 Days
• Field of Search: 718 1
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 12/6418 Hybrid transport
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

A device includes a memory that is configured to store instructions. The device includes a processor configured to execute the instructions to: validate a message including virtual machine (VM) information using a value of a virtual station interface (VSI) type identification (ID) to perform a lookup of a fetched VSI database. The VM information for the VM includes VSI type ID and virtual local area network (VLAN) ID. The processor further generates a first table for multiple different VM types with at least a portion of information from the VSI database, retrieves an address of the VM from the first table for the multiple different VM types based on using VSI type ID and network ID, retrieves rules associated with the retrieved address of the VM and the VSI type ID from a second table including VM information, and applies the associated rules for the VM.

Claims

1. An apparatus comprising:

a memory configured to store instructions; and

a processor configured to execute the instructions to;

validate a message including virtual machine (VM) information using a value of a virtual station interface (VSI) type identification (ID) to perform a lookup of a fetched VSI database, wherein the VM information for the VM comprises VSI type ID and virtual local area network (VLAN) ID;

generate a first table for multiple different VM types with at least a portion of information from the VSI database;

retrieve an address of the VM from the first table for the multiple different VM types based on using VSI type ID and network ID;

retrieve rules associated with the retrieved address of the VM and the VSI type ID from a second table including VM information; and

apply the associated rules for the VM.

2. The apparatus of claim 1, wherein the VSI database comprises one or more rules for different VSI types and access rules.

3. The apparatus of claim 2, wherein the first table comprises multiple VSI type IDs each associated with a source address and a VLAN address.

4. The apparatus of claim 3, wherein the second table comprises multiple VSI type IDs associated with one or more access rules.

5. The apparatus of claim 4, wherein the second table further comprises transmission rate information and receiving rate information.

6. The apparatus of claim 1, wherein the switch fetches the information from the VSI database from a server in an edge virtual bridging (EVB) system.

7. The apparatus of claim 1, wherein the processor is further configured to execute the instructions to:

generate the second table including the VM information and using information from the VSI database for the multiple different VM types.

8. The apparatus of claim 4, wherein hardware resources for the access rules are proportional to a size of the second table.

9. The apparatus of claim 1, wherein the processor is further configured to execute the instructions to:

add newly created VSI type IDs to the second table along with associated access rules.

10. The apparatus of claim 1, wherein the processor is further configured to execute the instructions to:

retrieve VSI type ID from the first table by performing a table look up (TLU) on the first table using the VSI type ID and VLAN ID as input, and output a source MAC address for the VM;

perform a TLU on the second table using output from the TLU on the first table including the source MAC address and the VSI type ID for the VM as input; and

output the associated rules for the VM.

11. A system comprising:

a memory storing instructions; and

a switch including a processor configured to execute the instructions to;

validate a message including virtual machine (VM) information using a value to perform a lookup of a fetched virtual station interface (VSI) database, wherein the VM information for the VM comprises VSI type identification (ID) and network ID;

generate a first table including the VM information and using information from the VSI database for multiple different VM types;

retrieve an address of the VM from a second table based on using VSI type ID and network ID;

retrieve rules associated with the retrieved address of the VM and the VSI type ID from the first table including VM information; and

apply the associated rules for the VM.

12. The system of claim 11, wherein the value comprises a VSI type ID, and the second table includes addresses for the multiple different VM types.

13. The system of claim 12, wherein the VSI database comprises one or more rules for different VSI types and access rules, and the second table comprises multiple VSI type IDs each associated with a source address and a VLAN address.

14. The system of claim 13, wherein the first table comprises multiple VSI type IDs associated with one or more access rules.

15. The system of claim 14, wherein the first table further comprises transmission rate information and receiving rate information.

16. The system of claim 11, wherein the switch fetches the information from the VSI database from a server in an edge virtual bridging (EVB) system.

17. The system of claim 11, wherein the processor is further configured to execute the instructions to:

generate the second table for multiple different VM types with at least a portion of the information from the VSI database.

18. The system of claim 14, wherein hardware resources for the access rules are proportional to a size of the first table.

19. The system of claim 11, wherein the processor is further configured to execute the instructions to:

add newly created VSI type IDs to the first table along with associated access rules.

20. The system of claim 11, wherein the processor is further configured to execute the instructions to:

retrieve VSI type ID from the second table by performing a table look up (TLU) on the second table using the VSI type ID and VLAN ID as input, and output a source MAC address for the VM;

perform a TLU on the first table using output from the TLU on the second table including the source MAC address and the VSI type ID for the VM as input; and

output the associated rules for the VM.