Abstract: A fleet manager within a cloud computing system utilizes a registration framework with one or more cloud infrastructure managers having corresponding infrastructure data plane nodes, which may be in use by different tenants. Instead of having the infrastructure managers communicate directly with its corresponding infrastructure data plane nodes via a management network or domain, the fleet manager communicates with infrastructure managers and relay commands, instructions, and other payloads to the infrastructure data plane nodes using a virtual machine (VM) communication backchannel.

Abstract: A hybrid cloud computing system having a private data center and a public cloud computing system is discussed. The private data center is managed by a first organization. The public cloud computing system is managed by a second organization, and the first organization is a tenant in the public cloud computing system. The hybrid cloud computing system is configured to generate a mapping that contextualizes virtual objects migrated between the private data center and the public cloud computing system based on the objects' location. Such a mapping is maintained to expose the true hybridity of the hybrid cloud rather than present two distinct views of a private data center (or private cloud) and a public cloud.

Abstract: Conditional address translation is performed in a multi-tenant cloud infrastructure to effectively support tenant-assigned addresses. For each tenant, the multi-tenant cloud infrastructure deploys both a private network used to communicate between the tenant and the cloud and a tenant-facing gateway to manage the private network. The multi-tenant cloud infrastructure also includes an externally-facing gateway used to communicate between the multi-tenant cloud and a public network. The tenant-facing gateways are configured to bypass address translation—providing consistent addressing across each private network irrespective of the physical location of resources linked by the private network. By contrast, the public-facing gateway is configured to translate source addresses in outgoing packets to addresses that are unique within the public network.

Abstract: A hybrid cloud computing system is managed by determining communication affinity between a cluster of virtual machines, where one virtual machine in the cluster executes in a virtualized computing system, and another virtual machine in the cluster executes in a cloud computing environment, and where the virtualized computing system is managed by a tenant that accesses the cloud computing environment. After determining a target location in the hybrid cloud computing system to host the cluster of virtual machines based on the determined communication affinity, at least one of the cluster of virtual machines is migrated to the target location.

Abstract: An example provides a method of creating an instance of a virtual machine in a cloud computing system that includes: accepting a network connection at a server resource in the cloud computing system from a first client resource in a first virtualized computing system to transfer a first virtual machine; receiving first signatures for guest files of the first virtual machine from the first client resource; checking the first signatures against a content library in the cloud computing system to identify first duplicate files of the guest files that match first base files stored in the content library, and to identify first unique files of the guest files; instructing the first client resource such that a response to the instructing will send the first unique files to the exclusion of the first duplicate files; and generating an instance of the first virtual machine in the cloud computing system having the first base files and the first unique files.

Abstract: One or more examples provide a method of transferring a virtual machine between a virtualized computing system and a cloud computing system that includes: establishing connection between a first resource in the virtualized computing system and a second resource in the cloud computing system to transfer files that implement the virtual machine from the first resource to the second resource; accessing, for transmission over the connection, data blocks on a storage device in the virtualized computing system that include the files; executing at least one compliance check on each of the data blocks using at least one compliance checker; and preventing each of the data blocks that fails a compliance check from being maintained in the cloud computing system.

Abstract: A centralized namespace controller allocates addresses in a distributed cloud infrastructure on-demand. Upon receiving a request to allocate addresses for a network to be provisioned by a cloud computing system included in the distributed cloud infrastructure, the centralized namespace controller allocates a network address that is unique within the distributed cloud infrastructure. Further, the centralized namespace controller allocates a range of virtual network interface cards (NIC) addresses that are unique within the network. The centralized namespace controller then allocates addresses from the range of virtual NIC addresses on an as-requested basis—when a virtual NIC is being created by the first cloud computing system on the network.

Abstract: A method is provide for managing a migration of a virtual machine from a private data center managed by a first organization to a public cloud computing system by a second organization and where the first organization is a tenant. The configurations of physical infrastructure of the private data center that underlies the virtual machine are determined, along with a corresponding match preference indicating a level of criticality for some corresponding configuration at the public cloud system. The configurations and match preferences generated as part of a migration package. The public cloud computing system instantiates a corresponding VM based on the determined configurations and corresponding match preferences.

Abstract: The disclosure herein describes an edge device of a network for distributed policy enforcement. During operation, the edge device receives an initial packet for an outgoing traffic flow, and identifies a policy being triggered by the initial packet. The edge device performs a reverse lookup to identify at least an intermediate node that is previously traversed by the initial packet and traffic parameters associated with the initial packet at the identified intermediate node. The edge device translates the policy based on the traffic parameters at the intermediate node, and forwards the translated policy to the intermediate node, thus facilitating the intermediate node in applying the policy to the traffic flow.

Abstract: The disclosure herein describes an edge device of a network for distributed policy enforcement. During operation, the edge device receives an initial packet for an outgoing traffic flow, and identifies a policy being triggered by the initial packet. The edge device performs a reverse lookup to identify at least an intermediate node that is previously traversed by the initial packet and traffic parameters associated with the initial packet at the identified intermediate node. The edge device translates the policy based on the traffic parameters at the intermediate node, and forwards the translated policy to the intermediate node, thus facilitating the intermediate node in applying the policy to the traffic flow.

Abstract: Some embodiments provide a network system that includes several host machines for hosting virtual machines, divided into several different domains. The network system includes several local domain management servers. A first local domain management server of a first domain is for (i) initiating creation of a set of distributed virtual switch ports associated with a particular logical network identifier on a host machine within its domain and (ii) attaching a first virtual machine on the host machine to a created port associated with the particular logical network identifier in order for the first virtual machine to send traffic over the logical network. The network system includes a second level management server for coordinating the use of logical network identifiers between multiple different logical domain management servers in order for the first virtual machine to communicate via the logical network with a second virtual machine in a second domain.

Abstract: A method is provided to control the flow of packets within a system that includes one or more computer networks comprising: policy rules are provided that set forth attribute dependent conditions for communications among machines on the one or more networks; machine attributes and corresponding machine identifiers are obtained for respective machines on the networks; and policy rules are transformed to firewall rules that include machine identifiers of machines having attributes from among the obtained machine attributes that satisfy the attribute dependent policy rules.

Abstract: A switch for a network. The switch includes an input port mechanism which receives traffic of connections from the network. Each connection has a priority. The switch includes an output port mechanism which sends traffic of connections to the network. The switch includes a controller which serves connections and which monitors the connections received by the input port mechanism and sent by the output port mechanism and releases connections according to a connection's priority when a predetermined condition exists in the switch. The controller is connected to the input port mechanism and the output port mechanism. Each connection requests a specific bandwidth from the controller. A method for switching connections. The method includes the steps of monitoring traffic of connections received by a switch. Then there is the step of releasing connections from the switch according to the connection's priority when a predetermined condition in the switch exists.

Abstract: A scheduling apparatus includes a server for providing service to entities. The apparatus includes a mechanism for determining whether an entity that is to receive service at a future time from the server will be in conformance with a predetermined criteria at the future time when the entity is to receive service from the server. The apparatus includes a scheduler mechanism for scheduling when entities are to receive service from the server unless the determining mechanism determines the entity is not in conformance. A method for scheduling entities in an ATM network. The method includes the steps of receiving a session of an entity in a memory of an ATM switch connected to the ATM network. Then there is the step of scheduling the session for service by a server of the ATM switch. Next there is the step of determining with a determining mechanism whether the session will be conforming in terms of compliance to traffic contract of the ATM network in the future.

Abstract: An apparatus for switching cells from entities in a network. The apparatus includes an input mechanism for receiving all cells by the apparatus from the network. The apparatus includes a memory mechanism for storing all cells received by the input mechanism that are to be stored in the apparatus. The memory mechanism is connected to the input port mechanism. The memory mechanism has an occupancy for cells. The apparatus includes an output mechanism for sending cells from the apparatus to the network. The apparatus includes a server for providing service to the cells at a service rate. The server is connected to the memory mechanism and the output mechanism. The apparatus includes a scheduler for providing service to the cells in the memory mechanism. The scheduler is connected to the server and the memory mechanism. A method for switching cells. An ATM switch which stamps Explicit Rate to ABR VCs for controlling ABR traffic flow on a given link of the ATM switch.

Abstract: An apparatus for serving ATM packets, each packet having cells. The apparatus includes a server which provides service to a cell. The apparatus includes a scheduler mechanism which determines which cell is to receive service from the server. The scheduler mechanism is connected to the server. The apparatus includes a shared memory mechanism having a first region for storing cells of a first packet of a first connection and at least a second region for storing cells of a second packet of a second connection. Each region has a dynamic size determined by demands of the corresponding connection. An apparatus for serving ATM packets, each packet having cells. The apparatus includes a server which provides service to a cell. The apparatus includes a scheduler mechanism which determines which cell is to receive service from the server. The scheduler is connected to the server.

Abstract: A scheduler for controlling when entities are operated upon by the server. The scheduler includes N entities, where N is an integer greater than or equal to 2. Each entity has a rate at which it is to receive service from the server. The scheduler includes a memory having finishing times f.sub.i of the N entities, where f.sub.i corresponds to the time the i'th entity is to be operated upon by the server. The scheduler includes a virtual clock that keeps track of virtual time so the finishing times f.sub.i can be identified. The scheduler includes a controller which chooses entities to be operated upon by the server as a function of the finishing times. The controller slows virtual time to provide service to the entities. The controller is connected to the virtual clock and the memory. A scheduler for controlling when entities are operated upon the server. The scheduler includes N entities, where N is an integer greater than or equal to 2.