Abstract: Securely storing assets in a cloud computer storage service. Preparation to store assets for a user may comprise determining a location to store the assets, generating a write access signature, and sending the determined location and the signature to the user. A request is received from the user to store the assets. Such a request includes the assets, the location, and the signature. In response to receiving the request, a determination is made regarding the write access signature whether the request should be honored. When the request is honored, the assets are stored in the determined location and the write access signature is invalidated. Upon subsequent user requests to access the assets, short-term read access signatures are generated and provided to the user. The assets are written once per generated write access signature and reads are to be performed close in time to when short-term read access signatures are requested.

Abstract: In a data network congestion control in a virtualized environment is enforced in packet flows to and from virtual machines in a host. A hypervisor and network interface hardware in the host are trusted components. Enforcement comprises estimating congestion states in the data network attributable to respective packet flows, recognizing a new packet that belongs to one of the data packet flows, and using one or more of the trusted components and to make a determination based on the congestion states that the new packet belongs to a congestion-producing packet flow. A congestion-control policy is applied by one or more of the trusted components to the new packet responsively to the determination.

Abstract: A method for communication in a packet data network that includes at least first and second subnets interconnected by multiple routers and having respective first and second subnet managers. The method includes assigning respective local identifiers to ports for addressing of data link traffic within each subnet, such that the first subnet manager assigns the local identifiers in the first subnet, and the second subnet manager assigns the local identifiers in the second subnet. The routers are configured by transmitting and receiving control traffic between the subnet managers and the routers. Data packets are transmitted between network nodes in the first and second subnets via one or more of the configured routers under control of the subnet managers.

Abstract: In a data network congestion control in a virtualized environment is enforced in packet flows to and from virtual machines in a host. A hypervisor and network interface hardware in the host are trusted components. Enforcement comprises estimating congestion states in the data network attributable to respective packet flows, recognizing a new packet that belongs to one of the data packet flows, and using one or more of the trusted components and to make a determination based on the congestion states that the new packet belongs to a congestion-producing packet flow. A congestion-control policy is applied by one or more of the trusted components to the new packet responsively to the determination.

Abstract: A method for communication in a packet data network that includes at least first and second subnets interconnected by multiple routers and having respective first and second subnet managers. The method includes assigning respective local identifiers to ports for addressing of data link traffic within each subnet, such that the first subnet manager assigns the local identifiers in the first subnet, and the second subnet manager assigns the local identifiers in the second subnet. The routers are configured by transmitting and receiving control traffic between the subnet managers and the routers. Data packets are transmitted between network nodes in the first and second subnets via one or more of the configured routers under control of the subnet managers.

Abstract: A method includes receiving by a first inter network interface (INI) a control message from an entity in a first network, the first INI being located at a border between the first network and networks external to the first network. The first INI translates the control message from a first format used internally in the first network to a second format used to communicate between the first INI and a second INI located at a border between a second network and networks exterior to the second network. The first INI then transmits the translated control message to the second INI. The method can also include translating, by the second INI, the received control message from the second format to a third format used internally in the second network, and forwarding the received and translated control message to an entity in the second network.

Abstract: A method includes receiving by a first inter network interface (INI) a control message from an entity in a first network, the first INI being located at a border between the first network and networks external to the first network. The first INI translates the control message from a first format used internally in the first network to a second format used to communicate between the first INI and a second INI located at a border between a second network and networks exterior to the second network. The first INI then transmits the translated control message to the second INI. The method can also include translating, by the second INI, the received control message from the second format to a third format used internally in the second network, and forwarding the received and translated control message to an entity in the second network.