Abstract: A cloud infrastructure performs governance and security control for datacenters on a cloud platform. The system specifies one or more session policies for the plurality of datacenters. A session policy associated with a datacenter specifies a set of access conditions for accessing the entities of the datacenter, and may be generated based at least on the network information in the declarative specification for the datacenter, and network artifacts from provisioning the network resources for the datacenter. Responsive to receiving a request to access an entity of a datacenter from a user, the system obtains credentials for the user and attaches the session policies. Responsive to determining that the credentials are used to access the datacenter from a set of access conditions that match the set of access conditions in the attached session policy, the cloud platform grants access.

Abstract: Examples include a system and computer-implemented method to create a cloud native workload identity (CNWI) and assign the CNWI to an instance of a workload to be instantiated in a cloud computing environment of a cloud service provider (CSP); translate the CNWI into a cloud agnostic workload identity (CAWI) and assign the CAWI to the workload instance; and use the CAWI by the workload instance to communicate with other workloads in the same or a different CSP.

Abstract: Examples include a system and computer-implemented method to create a cloud native workload identity (CNWI) and assign the CNWI to an instance of a workload to be instantiated in a cloud computing environment of a cloud service provider (CSP); translate the CNWI into a cloud agnostic workload identity (CAWI) and assign the CAWI to the workload instance; and use the CAWI by the workload instance to communicate with other workloads in the same or a different CSP.

Abstract: In one embodiment, a method includes receiving an IP packet associated with a first virtual partition defined at a session exchange device. The first virtual partition is associated with a first IP address space. The method also includes receiving an IP packet associated with a second virtual partition defined at the session exchange device. The second virtual partition is associated with a second IP address space having a portion that corresponds with the first IP address space. The IP packet associated with the first virtual partition is modified such that the IP packet associated with the first virtual partition has an IP address value from a third IP address space different from the portion of the second IP address space.

Abstract: In one embodiment, a method includes associating a pluggable policy module with an application when executing at a session layer device within a session over Internet Protocol (SoIP) network. A policy service request can be received at the session layer device from an endpoint in communication with the session layer device. The method also includes defining a session control protocol signal based on a policy value sent to the application from the pluggable policy module. The policy value can be calculated at the pluggable policy module based on an input value associated with the policy service request.

Abstract: In one embodiment, a method includes receiving an IP packet associated with a first virtual partition defined at a session exchange device. The first virtual partition is associated with a first IP address space. The method also includes receiving an IP packet associated with a second virtual partition defined at the session exchange device. The second virtual partition is associated with a second IP address space having a portion that corresponds with the first IP address space. The IP packet associated with the first virtual partition is modified such that the IP packet associated with the first virtual partition has an IP address value from a third IP address space different from the portion of the second IP address space.

Abstract: In one embodiment, a method includes associating a pluggable policy module with an application when executing at a session layer device within a session over Internet Protocol (SoIP) network. A policy service request can be received at the session layer device from an endpoint in communication with the session layer device. The method also includes defining a session control protocol signal based on a policy value sent to the application from the pluggable policy module. The policy value can be calculated at the pluggable policy module based on an input value associated with the policy service request.