Abstract: Methods, systems, and computer programs are presented for creating a secure network fabric and for adding trusted devices to an existing secure network fabric. One method includes an operation for setting a switch into a provisioning mode where the switch does not enforce secure communications. While the switch is in provisioning mode, the method performs operations including establishing a connection from the switch to a provisioning controller, sending a certificate signing request (CSR) from the switch to the provisioning controller, and receiving, from the provisioning controller, a security certificate generated by a certificate authority. The method further includes an operation for entering a lockdown mode by the switch after receiving the security certificate, where the switch, while in lockdown mode, secures communications utilizing the security certificate.

Abstract: Methods, systems, and computer programs are presented for creating a secure network fabric and for adding trusted devices to an existing secure network fabric. One method includes an operation for setting a switch into a provisioning mode where the switch does not enforce secure communications. While the switch is in provisioning mode, the method performs operations including establishing a connection from the switch to a provisioning controller, sending a certificate signing request (CSR) from the switch to the provisioning controller, and receiving, from the provisioning controller, a security certificate generated by a certificate authority. The method further includes an operation for entering a lockdown mode by the switch after receiving the security certificate, where the switch, while in lockdown mode, secures communications utilizing the security certificate.

Abstract: First and second controllers implemented on computing equipment may be used to control switches in a network. The switches may forward network packets between end hosts. The second controller may identify first and second redundant partitions of switches in the network that are each coupled to all of the end hosts. The first controller may instruct the first partition to install software while the second partition forwards network traffic and may instruct the second partition to install software while the first partition forwards network traffic. The first controller may install the software while the second controller is active and the second controller may install the software while the first controller is active. In this way, the switches and controllers may be provided with an uninterrupted software upgrade and packets may be forwarded between end hosts during the software upgrade without introducing packet loss or other noticeable reductions in network performance.

Abstract: First and second controllers implemented on computing equipment may be used to control switches in a network. The switches may forward network packets between end hosts. The second controller may identify first and second redundant partitions of switches in the network that are each coupled to all of the end hosts. The first controller may instruct the first partition to install software while the second partition forwards network traffic and may instruct the second partition to install software while the first partition forwards network traffic. The first controller may install the software while the second controller is active and the second controller may install the software while the first controller is active. In this way, the switches and controllers may be provided with an uninterrupted software upgrade and packets may be forwarded between end hosts during the software upgrade without introducing packet loss or other noticeable reductions in network performance.

Abstract: A bridge fault extractor. A computer-implemented method for performing fault extraction from an integrated circuit layout in a two-net analysis mode includes determining maximum critical areas from the layout for a maximum defect size of a set of defect sizes to be analyzed wherein each maximum critical area corresponds to a net-name pair. The maximum critical areas are then locally merged by net-name pair to determine an area of a union of maximum critical areas for each net-name pair. Critical areas for defect sizes smaller than the maximum defect size are determined from the maximum critical areas and locally merged by net-name pair to determine an area of a union of critical areas for each net-name pair for each smaller defect size. In a multi-net analysis mode, overlap rectangles are determined by net-name pair. The overlap rectangles are then used to calculate critical areas for two-net and multi-net bridges for each defect size in a set of defect sizes to be analyzed.

Abstract: A bridge fault extractor. A computer-implemented method for performing fault extraction from an integrated circuit layout includes determining maximum critical areas from the layout for a maximum defect size of a set of defect sizes to be analyzed wherein each maximum critical area corresponds to a net-name pair. The maximum critical areas are then locally merged by net-name pair to determine an area of a union of maximum critical areas for each net-name pair. Critical areas for defect sizes smaller than the maximum defect size are determined from the maximum critical areas and locally merged by net-name pair to determine an area of a union of critical areas for each net-name pair for each smaller defect size.