MANAGEMENT OF ADDRESSES IN VIRTUAL MACHINES

• US 20150128245A1
• Filed: 11/07/2013
• Published: 05/07/2015
• Est. Priority Date: 11/07/2013
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Brown, Deanna L.Q., Crowell, Susan F., Nikolai, Jason A., Thorstensen, Andrew T.
• Granted Patent: US 9,634,948 B2
• Time in Patent Office: Days
• US Class Current: 726/12
• CPC Class Codes: G06F 15/173 using an interconnection network, e.g. matrix, shuffle, pyramid, star, snowflake
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 45/72 Routing based on the source address
• CPC Class Codes: H04L 47/323 Discarding or blocking control packets, e.g. ACK packets
• CPC Class Codes: H04L 49/00 Packet switching elements
• CPC Class Codes: H04L 49/70 Virtual switches
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 61/5053 Lease time; Renewal aspects
• CPC Class Codes: H04L 61/5061 Pools of addresses
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 69/30 Definitions, standards or architectural aspects of layered protocol stacks

Abstract

Methods for managing an address on a switching device, managing an address on a network switch, and screening addresses in a cloud computing environment are provided. One embodiment is directed towards a computer-implemented method for managing an address on a switching device that is communicatively coupled to a plurality of virtual machines. The method includes accessing an address pool that includes an assigned address for each virtual machine from the plurality of virtual machines. The method includes determining, on the switching device, a used address for the virtual machine from the plurality of virtual machines. The method includes determining whether the used address is matching the assigned address for each virtual machine. The method also includes routing traffic from the virtual machine to a hypervisor in response to the used address matching the assigned address.

Claims

1-16. -16. (canceled)

17. A computing system for screening addresses in a cloud computing environment, comprising:

an address pool that includes an assigned address for each virtual machine from a plurality of virtual machines;

a switching device operating on one or more computing processors and communicatively coupled to the plurality of virtual machines, the switching device configured to;

access the address pool for the assigned address of a virtual machine from the plurality of virtual machines,

determine an address used for a first virtual machine from the plurality of virtual machines,

determine whether the address used is matching the assigned address for any virtual machine, and

block traffic to the first virtual machine from a cloud-computing network in response to the address used for the first virtual machine differing from the assigned address.

18. The computing system of claim 17, wherein the switching device is further configured to:

notify a system administrator from the plurality of virtual machines that the traffic from the first virtual machine is blocked.

19. The computing system of claim 17, wherein the switching device includes an s-tag capable bridge of an IEEE™

802.1 Qbh-enabled network switch communicatively coupled with the address pool.

20. The computing system of claim 17, wherein the assigned address in the address pool is created by a cloud controller.