PARTICIPATING IN CLOUD AS TOTALLY STUBBY EDGE

• US 20090319688A1
• Filed: 06/24/2008
• Published: 12/24/2009
• Est. Priority Date: 06/24/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Greenberg, Albert, Mason, Kevin, Jensen, Jeffrey Paul, Lahiri, Parantap, Pike, Robert
• Granted Patent: US 7,987,289 B2
• Time in Patent Office: Days
• US Class Current: 709/242
• CPC Class Codes: G06F 15/16 Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs coordinating program control therefor G06F9/52; in regulating and control system G05B
• CPC Class Codes: G06F 3/0607 by facilitating the process of upgrading existing storage systems, e.g. for improving compatibility between host and storage device
• CPC Class Codes: G06F 3/0632 by initialisation or re-initialisation of storage systems
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: G06F 9/5072 Grid computing
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 47/78 Architectures of resource allocation
• CPC Class Codes: H04L 47/781 Centralised allocation of resources
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A Totally Stubby Edge (TSE) participates in a cloud under the condition that the TSE may select paths for frames that the TSE introduces to the cloud, but may not transit frames between nodes in the cloud. The edge submits, to an administrator of the cloud, a request to join the cloud. If the administrator allows the request, then the edge is given access to the address tables that define the structure of the cloud, and may insert itself into the structure. The edge may use the address tables to select paths for frames that the edge introduces to the cloud. Normally path decisions are made by devices that the administrator trusts and controls. However, since the TSE selects paths for its own frames but does not transit frames between other nodes in the cloud, the TSE may select paths even if it is untrusted by the administrator.

Claims

1. One or more computer-readable storage media that store executable instructions to perform a method of participating in a network cloud, the method comprising:

sending a request to join said network cloud;

after said request has been approved, receiving, by a device, a parameter that governs said device'"'"'s participation in said network cloud;

based on a map of said network cloud, selecting a path to a first node in said network cloud, said path specifying a next hop that is either said first node or a second node in said network cloud from which said first node is directly or indirectly reachable;

inserting, into a frame that comprises data that has not been received by said device from any node in said network cloud, a tag that describes said path; and

sending said frame to said next hop.

2. The one or more computer-readable storage media of claim 1, wherein said map is maintained by an administrator of said network cloud, said administrator not providing access to said map to untrusted nodes that participate in said network cloud, except to untrusted nodes whose participation in said network cloud is conditioned on not transiting data between nodes in said network cloud.

3. The one or more computer-readable storage media of claim 1, wherein the method further comprises:

providing, to an administrator of said network cloud, authentication information of said device.

4. The one or more computer-readable storage media of claim 1, wherein said network cloud is a layer-2 (L2) cloud.

5. The one or more computer-readable storage media of claim 1, wherein the method further comprises:

creating an address table based on said map.

6. The one or more computer-readable storage media of claim 1, wherein said parameter specifies a limit on paths that said device may use, and wherein said path is selected to observe said limit.

7. The one or more computer-readable storage media of claim 1, wherein participation of said device in said network cloud is associated with a port, and wherein said sending of said frame comprises:

sending said frame on said port.

8. The one or more computer-readable storage media of claim 1, wherein said device is a physical device.

9. The one or more computer-readable storage media of claim 1, wherein said device is a virtual device that is implemented, under control of a hypervisor, on a machine on which said hypervisor operates, said machine having a Media Access Control (MAC) address, participation of said device in said cloud being conditioned on data sent by said device being associated with said MAC address.

10. A method of admitting a device to participate in a network cloud, the method comprising:

receiving, from said device, which is not trusted by an administrator of said network cloud, a request to participate in said network cloud;

determining, based on authentication information provided by said device, that said device is permitted to participate in said network cloud;

providing, to said device, a parameter that governs said device'"'"'s participation in said network cloud;

receiving, from said device, a frame comprising a tag that specifies a path on which said frame is to be sent;

verifying that said tag complies with said parameter; and

sending said frame to a first node in said network cloud in accordance with said path.

11. The method of claim 10, further comprising:

verifying whether said frame has been sent from a particular Media Access Control (MAC) address; and

taking a remedial action in an event that said frame has not been sent from said MAC address.

12. The method of claim 10, further comprising:

verifying whether said frame has been sent from a particular port; and

taking a remedial action in an event that said frame has not been sent from said port.

13. The method of claim 10, wherein said device requests to participate in a particular group within said network cloud, and wherein the method further comprises:

determining whether said device is permitted to participate in said group, wherein said parameter specifies whether said device is permitted to participate in said group.

14. The method of claim 10, further comprising:

transiting said frame to a second node, said transiting being performed by a node other than said device.

15. The method of claim 10, wherein said network cloud is at a first network layer, and wherein the method further comprises:

providing, by said first node, data in said frame to a second network layer to allow said data in said frame to be consumed.

16. An apparatus comprising:

a network interface associated with a Media Access Control (MAC) address;

a hypervisor;

a virtual machine that is implemented by said hypervisor, and that participates in a network cloud as an edge device by inserting a tag into a frame, said tag specifying a path on which said frame is to be sent to a node in said network cloud, said path being based on a map maintained by an administrator of said network cloud, participation of said virtual machine in said network cloud being governed by a condition that said virtual machine not transit data that said virtual machine receives from nodes in said network cloud.

17. The apparatus of claim 16, wherein said network cloud is an L2 cloud.

18. The apparatus of claim 16, wherein said administrator provides a parameter to said virtual machine that govern said virtual machine'"'"'s participation in said network cloud, said parameter specifying a limit on paths that said virtual machine may specify in said tag.

19. The apparatus of claim 16, wherein participation of said edge device in said network cloud is associated with a port, and wherein said edge device sends said frame into said network cloud through said port.

20. The apparatus of claim 16, wherein said edge device provides, to said administrator, a hash or signature that is usable to authenticate said edge device.