System for dynamic provisioning of secure, scalable, and extensible networked computer environments

• US 7,027,412 B2
• Filed: 05/18/2001
• Issued: 04/11/2006
• Est. Priority Date: 11/10/2000
• Status: Expired due to Term

• Current Assignee: Veritas Technologies, LLC (Whitehouse Group Ltd.)
• Original Assignee: Veritas Operating Corporation (Gen Digital Inc.)
• Inventors: Miyamoto, Carleton, Bandhole, Jagadish, Lin, Chang, Blume, William
• Primary Examiner(s): Pham, Chi
• Assistant Examiner(s): Ly, Anh-Vu
• Application Number:
  US09/860,665
• Publication Number:
  US 20020057684A1
• Time in Patent Office: 1,789 Days
• Field of Search: 709217-221, 709/223, 709225-229, 370/392
• US Class Current: 370/255
• CPC Class Codes: H04L 12/1886 with traffic restrictions for efficiency improvement, e.g. involving subnets or subdomains
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A system and method for provisioning a virtual network is provided. Virtual networks can be automatically formed including switches in networks, such as local and private networks. Once the virtual networks are formed, virtual computing devices can be provisioned in place of physical computing devices that are connected to the switches. A system for provisioning a virtual network including a first virtual subnet and a second virtual subnet is provided. The system includes a first switch; a second switch; a first software process associated with first switch for provisioning the first virtual subnet; a second software process associated with the second switch for provisioning the second virtual subnet; and a communication link connecting the first switch and the second switch.

Claims

1. A system for provisioning first and second virtual networks, the system comprising:

a first switch comprising a first set of ports;

a second switch comprising a second set of ports;

a first software process associated with first switch configured to

provision a first virtual subnet using a first plurality of ports from the first set of ports,

de-provision the first virtual subnet upon expiration of a defined time, and

provision a third virtual subnet using a third plurality of ports from the first set of ports upon de-provisioning the first virtual subnet;

a second software process associated with the second switch configured to

provision a second virtual subnet using a second plurality of ports from the second set of ports,

de-provision the second virtual subnet upon expiration of the defined time, and

provision a fourth virtual subnet using a fourth plurality of ports from the second set of ports upon de-provisioning the second virtual subnet; and

a communication link connecting the first switch and the second switch wherein,

the first virtual network comprises the first virtual subnet and the second virtual subnet, and

the second virtual network comprises the third virtual subnet and the fourth virtual subnet.

2. The system of claim 1, further comprising:

one or more computing devices connected to the first plurality of ports; and

one or more computing devices connected to the second plurality of ports,

wherein the first virtual subnet forms a first broadcast domain including the one or more computing devices connected to the first plurality of ports and the second virtual subnet forms a second broadcast domain including the one or more computing devices connected to the second plurality of ports.

3. The system of claim 1, wherein the second software process is further configured to provision a fifth virtual subnet including the first switch, wherein the first virtual network includes the first, second, and the fifth virtual subnets.

4. The system of claim 3, further comprising:

one or more computing devices connected to the first plurality of ports;

one or more computing devices connected to the second plurality of ports; and

wherein,

the first virtual subnet forms a first broadcast domain including the one or more computing devices connected to the first plurality of ports,

the second virtual subnet forms a second broadcast domain including a first set of the one or more computing devices connected to the second plurality of ports, and

the third virtual subnet forms a third broadcast domain including a second set of the one or more computing devices connected to the second plurality of ports.

5. The system of claim 1, further comprising:

one or more computing devices connected to the third plurality of ports; and

one or more computing devices connected to the fourth plurality of ports,

wherein the third virtual subnet forms a third broadcast domain including the one or more computing devices connected to the third plurality of ports and the fourth virtual subnet forms a fourth broadcast domain including the one or more computing devices connected to the fourth plurality of ports.

6. A system for provisioning a first virtual network including a first virtual subnet and a second virtual network including a second virtual subnet, the system comprising:

a first switch comprising a first set of ports;

a first software process associated with the first switch;

a second switch comprising a second set of ports;

a second software process associated with the second switch; and

a network connection that connects the first switch and the second switch,

wherein the first software process is configured to communicate with the second software process through the network connection to

provision the first virtual subnet out of a first subset of the first set of ports and a second subset of the second set of ports,

de-provision the first virtual subnet after a defined period of time, and

provision the second virtual subnet out of a third subset of the first set of ports and a fourth subset of the second set of ports;

further comprising;

a first private network including the first switch, the first private network comprising

a first gateway, and

a first administrative boundary;

a second private network including the second switch, the second private network comprising

a second gateway, and

a second administrative boundary;

wherein the first and second software processes communicate through the first gateway, the first administrative boundary, the second gateway, and second administrative boundary.

7. The system of claim 6, further comprising:

a first computing device connected to a first port in the first set of ports; and

a second computing device connected to a second port in the second set of ports,

wherein the first virtual subnet forms a first broadcast domain of the first and second computing devices.

8. The system of claim 6, wherein the first switch and the second switch are part of a local network, wherein the network connection is a high bandwidth connection.

9. The system of claim 6, further comprising a private network comprising:

a first local network including the first switch;

a second local network including the second switch;

wherein the network connection includes a low bandwidth connection between the first and second networks.

10. The system of claim 6, further comprising:

a first firewall associated with the first private network; and

a second firewall associated with the second private network, wherein, the first and second software processes communicate with the first and second firewalls to provision the first and second virtual subnets.

11. The system of claim 6, further comprising:

a first access control mechanism associated with the first private network; and

a second access control mechanism associated with the second private network, wherein the first and second software processes communicate with the first and second access control mechanisms to provision the first and second virtual subnets.

12. The system of claim 11, wherein the access control mechanism is implemented using a VPN switch.

13. The system of claim 6, wherein the network connection includes a wireless connection.

14. A system for provisioning a “

dynamic computing environment”

(DCE), the DCE comprising one or more virtual computing devices and one or more virtual subnets that connect the one or more virtual computing devices, the system comprising;

first and second switches connected through a network connection, wherein

the first switch comprises a first set of ports, and

the second switch comprises a second set of ports;

one or more physical computing devices each connected to a corresponding port of the first or second sets of ports; and

a first software process associated with the first switch and a second software process associated with the second switch, wherein the first and second software processes are configured to

provision the one or more virtual subnets from the first and second sets of ports, wherein

the one or more virtual subnets comprise the one or more virtual computing devices for the one or more physical computing devices,

provision a first virtual network from a first subset of the one or more virtual subnets,

de-provision the first virtual network upon expiration of a defined period of time, and

provision a second virtual network from a second subset of the one or more virtual subnets upon de-provisioning the first virtual network.

15. The system of claim 14, wherein the network connection is a high bandwidth connection between the first and second switches.

16. The system of claim 14, further comprising one or more local networks including the first and second switches, wherein the network connection includes a low bandwidth connection between the one or more local networks.

17. The system of claim 16, further comprising one or more private networks including the one or more local networks, wherein the one or more private networks include one or more administrative boundaries.

18. The system of claim 17, wherein the one or more administrative boundaries comprise one or more firewalls, wherein the one or more software processes associated with the one or more switches negotiate with the one or more firewalls to provision the one or more virtual subnets.

19. The system of claim 18, wherein

the one or more administrative boundaries comprise one or more access control mechanisms, wherein

the software processes associated with the switches negotiate with the one or more access control mechanisms to provision the one or more virtual subnets.

20. The system of claim 19, wherein the access control mechanism is implemented using a VPN switch.

21. The system of claim 14, wherein the network connection includes a wireless connection.

22. A method for creating a first virtual network and a second virtual network, the method comprising:

provisioning a first virtual subnet out of a first set of ports in a first switch;

provisioning a second virtual subnet out of a second set of ports in a second switch;

provisioning the first virtual network comprising the first virtual subnet and the second virtual subnet; and

upon expiration of a defined time,

de-provisioning the first virtual network, the first virtual subnet and the second virtual subnet,

provisioning a third virtual subnet out of the first set of ports in the first switch,

provisioning a fourth virtual subnet out of the second set of ports in the second switch, and

provisioning the second virtual network comprising the third virtual subnet and the fourth virtual subnet.

23. The method of claim 22, further comprising:

forming a first broadcast domain including the first virtual subnet; and

forming a second broadcast domain including the second virtual subnet, wherein

the first broadcast domain and the second broadcast domain are isolated from each other.

24. The method of claim 22, further comprising:

provisioning a first set of virtual computing devices from a first set of physical computing devices connected to the first set of ports; and

associating the first set of virtual computing devices with the first virtual subnet.

25. The method of claim 22, further comprising:

provisioning a second set of virtual computing devices from a second set of physical computing devices connected to the second set of ports; and

associating the second set of virtual computing devices with the second virtual subnet.

26. The method of claim 22, wherein

said provisioning of the first virtual network is performed in response to receiving a first request to provision the first virtual network.

27. The method of claim 26 wherein the first request comprises a first definition of resources to be allocated to the first virtual network.

28. The method of claim 27 wherein the first request further comprises:

the defined time; and

a second definition of resources to be allocated to the second virtual network.

29. A method for creating a first and second virtual network, the method comprising:

receiving a first request to create the first virtual network;

in response to the first request,

provisioning a first virtual subnet out of a first set of ports in a first switch,

provisioning a second virtual subnet out of a second set of ports in the first switch, and

provisioning the first virtual network comprising the first virtual subnet and the second virtual subnet;

receiving a second request to create the second virtual network; and

in response to the second request,

de-provisioning the first virtual network, the first virtual subnet, and the second virtual subnet,

provisioning a third virtual subnet out of a third set of ports in the first switch,

provisioning a fourth virtual subnet out of a fourth set of ports in the first switch, and

provisioning the second virtual network comprising the third virtual subnet and the fourth virtual subnet.

30. The method of claim 29, further comprising:

forming a first broadcast domain including the first virtual subnet; and

forming a second broadcast domain including the second virtual subnet, wherein

the first broadcast domain and the second broadcast domain are isolated from each other.

31. The method of claim 29, further comprising:

provisioning a first set of virtual computing devices from a set of physical computing devices connected to the first set of ports; and

associating the first set of virtual computing devices with the first virtual subnet.

32. The method of claim 29, further comprising:

provisioning a second set of virtual computing devices from a second set of physical computing devices connected to the second set of ports; and

associating the second set of virtual computing devices with the second virtual subnet.

33. A method for creating a first and second virtual network, the method comprising:

receiving a first request to create the first virtual network;

in response to the first request,

causing a first software process associated with a first switch to communicate with a second software process associated with a second switch to provision a first virtual subnet out of a first set of ports in the first switch and a second set of ports in the second switch, and

provisioning the first virtual network comprising the first virtual subnet;

receiving a second request to create a second virtual network; and

in response to the second request,

causing the first and second software processes to de-provision the first virtual network and the first virtual subnet,

causing the first software process to communicate with the second software process to provision a second virtual subnet out of a third set of ports on the first switch and a fourth set of ports on the second switch, and

provisioning the second virtual network comprising the second virtual subnet.

34. The method of claim 33, further comprising forming a first broadcast domain including the first virtual subnet.

35. The method of claim 33, further comprising:

causing the first and the second software processes to provision a first set of virtual computing devices from a set of physical computing devices connected to the first and second sets of ports; and

causing the first and second software processes to associate the first set of virtual computing devices with the first virtual subnet.

36. The method of claim 33, wherein causing the first software process associated with the first switch to communicate with the second software process associated with the second switch comprises:

communicating through a first gateway associated with a first private network including the first switch and a second gateway associated with a second part of a second private network including the second switch.

37. The method of claim 36, wherein causing the first software process associated with the first switch to communicate with the second software process associated with the second switch comprises:

communicating by negotiating with a first firewall associated with the first private network and a second firewall associated with the first private network.

38. The method of claim 36, wherein causing the first software process associated with the first switch to communicate with the second software process associated with the second switch comprises:

communicating by negotiating with a first remote access control mechanism associated with the first private network and a second remote access control mechanism that associated with the second private network.

39. The method of claim 38 further comprising:

using a first VPN switch to implement the first remote access mechanism; and

using a second VPN switch to implement the second remote access mechanism.