Abstract: Architecture that creates and applies a virtual firewall profile for each network to which a multi-homed device is connected. In one implementation, the virtual profiles can be based on address ranges of the networks. This ensures seamless concurrent connectivity of the multi-homed device to multiple networks.

Abstract: Architecture that facilitates the virtual specification of a connection between physical endpoints. A network can be defined as an abstract connectivity model expressed in terms of the connectivity intent, rather than any specific technology. The connectivity model is translated into configuration settings, policies, firewall rules, etc., to implement the connectivity intent based on available physical networks and devices capabilities. The connectivity model defines the connectivity semantics of the network and controls the communication between the physical nodes in the physical network. The resultant virtual network may be a virtual overlay that is independent of the physical layer. Alternatively, the virtual overlay can also include elements and abstracts of the physical network(s). Moreover, automatic network security rules (e.g., Internet Protocol security-IPSec) can be derived from the connectivity model of the network.

Abstract: Architecture that provides Internet Protocol security (IPsec) certificate exchange based on certificate attributes. An IPsec endpoint can validate the security context of another IPsec endpoint certificate by referencing certificate attributes. By facilitating IPsec certificate exchange using certificate attributes rather than solely certificate roots, it is now possible to build multiple isolated network zones using a single certificate authority rather than requiring one certificate authority per zone. Moreover, the ability to use certificate attributes during the IPsec certificate exchange can be leveraged for more focused communications such as QoS (quality of service). Certificate attributes can be utilized to identify the security context of the endpoint. The IPsec certificate use can be locked down to a single IP or group of IPs.

Abstract: Architecture that facilitates communications between two network nodes of the different networks by providing a routing mechanism that uses alternative modalities driven entirely by policies that are authored and stored in a computing cloud and enforced on the client. This allows the selection of one network path over another path based on criteria such as, physical location of the hosts and service level agreements (SLAs) to be provided, for example. With respect for path selection, a packet can be routed through a datacenter closest to the hosts. With respect to SLAs, there may be different SLAs available to different clients. For clients with the highest bandwidth/uptime or other guarantees, a network path different from other types of clients can be selected. Additionally, connectivity can be allowed or disallowed based on other kinds of policy rules such as a virtual circle to which the hosts may belong.

Abstract: A method for detecting changes to a production location is provided. The method includes receiving a selection of a portion of the production location that is to be protected and identifying a larger portion of the production location that contains the selected portion of the production location. Upon identifying the larger portion, a routine is created for evaluating the identified larger portion of the production location for changes. That routine is performed in order to detect changes to the production location.

Abstract: A virtual machine comprises a unique identifier that is associated with one or more encryption keys. A management server encrypts the virtual machine's virtual hard disk(s) using the one or more associated encryption keys. The management server further provides the one or more encryption keys to a limited number of one or more servers in a system. Only those one or more servers that have been provided the one or more encryption keys can be used to load, access, and/or operate the virtual machine. The management server can thus differentiate which virtual machines can be operated on which servers by differentiating which servers can receive which encryption keys. In one implementation, a management server encrypts all virtual machines in the system, but encrypts virtual machines with sensitive data with a limited set of encryption keys, and further provides those encryption keys to a limited set of trusted servers.

Abstract: A computer-implemented system configured to describe the relationship between a first Namespace and a second Namespace is provided. The system includes a containment relationship identifying a direct relationship between a first object of the first Namespace and a second object of the first Namespace. Moreover, the system includes a junction relationship linking the second object of the first Namespace to a first object of the second Namespace. In one embodiment, the system is configured to facilitate the recovery of information based on the descriptions of the Namespaces that is maintained.

Abstract: A method for protecting protectable objects located at a production location is provided. A Namespace, representative of a plurality of protectable objects, is provided to a user for selection. A selection of at least a portion of the Namespace is received and that selected portion is mapped to at least one protectable object. A plan for protecting the mapped protectable object is created, and using that plan the protectable object is protected.

Abstract: Virtual machine migration is described. In embodiment(s), a virtual machine can be migrated from one host computer to another utilizing LUN (logic unit number) masking. A virtual drive of the virtual machine can be mapped to a LUN mask associates the LUN with a host computer. The LUN mask can be changed to unmask the LUN to a second computer to migrate the virtual machine from the host computer to the second computer.

Abstract: A method for protecting protectable objects located at a production location is provided. A Namespace, representative of a plurality of protectable objects, is provided to a user for selection. A selection of at least a portion of the Namespace is received and that selected portion is mapped to at least one protectable object. A plan for protecting the mapped protectable object is created, and using that plan the protectable object is protected.

Abstract: A method for detecting changes to a production location is provided. The method includes receiving a selection of a portion of the production location that is to be protected and identifying a larger portion of the production location that contains the selected portion of the production location. Upon identifying the larger portion, a routine is created for evaluating the identified larger portion of the production location for changes. That routine is performed in order to detect changes to the production location.