Patents by Inventor Teemu Koponen

Teemu Koponen has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).

  • Patent number: 12177078
    Abstract: Some embodiments provide a system that includes a set of network controllers for receiving definitions of first and second logical switching elements. The system includes several managed switching elements. The set of network controllers configure the several managed switching elements to implement the defined first and second logical switching elements. The system includes several network hosts that are each (1) communicatively coupled to one of the several managed switching elements and (2) associated with one of the first and second logical switching elements. Network data communicated between network hosts associated with the first logical switching element are isolated from network data communicated between network hosts associated with the second logical switching element.
    Type: Grant
    Filed: August 28, 2023
    Date of Patent: December 24, 2024
    Assignee: Nicira, Inc.
    Inventors: Martin Casado, Teemu Koponen, Pankaj Thakkar
  • Patent number: 12170696
    Abstract: Some embodiments provide a method gaining insight into applicability of policies that authorize access to at least one service through application programming interface (API) calls by a plurality of users. The method receives an authentication policy that defines multiple users of a system providing the service, and also receives an authorization policy that defines access to the service by the users. The method generates an authorization policy for defining access to the service by authenticated users by combining the first and second policies. The method receives a query regarding access to the service from a particular set of one or more users, and uses the third policy to provide a response to the query that describes access to the service for the particular user set.
    Type: Grant
    Filed: October 17, 2022
    Date of Patent: December 17, 2024
    Assignee: STYRA, INC.
    Inventors: Andrew Curtis, Mikol Graves, Bryan J. Fulton, Timothy L. Hinrichs, Marco Sanvido, Teemu Koponen
  • Patent number: 12141599
    Abstract: Some embodiments provide a system for implementing a logical network that includes a set of end machines, a first logical middlebox, and a second logical middlebox connected by a set of logical forwarding elements. The system includes a set of nodes. Each of several nodes includes (i) a virtual machine for implementing an end machine of the logical network, (ii) a managed switching element for implementing the set of logical forwarding elements of the logical network, and (iii) a middlebox element for implementing the first logical middlebox of the logical network. The system includes a physical middlebox appliance for implementing the second logical middlebox.
    Type: Grant
    Filed: July 7, 2023
    Date of Patent: November 12, 2024
    Assignee: Nicira, Inc.
    Inventors: Teemu Koponen, Ronghua Zhang, Pankaj Thakkar, Martin Casado
  • Patent number: 12135974
    Abstract: Some embodiments of the invention provide a method for generating custom system templates to define new system types. For a particular system type, the method defines at least a manifest file that specifies a set of properties of the particular system type. The method compresses the defined manifest file to create a custom system template package for the particular system type. The method uploads the custom system template package to an authorization service in order to instantiate a new system of the particular system type.
    Type: Grant
    Filed: September 28, 2022
    Date of Patent: November 5, 2024
    Assignee: STYRA, INC.
    Inventors: Stan Lagun, Timothy L. Hinrichs, Teemu Koponen
  • Publication number: 20240364591
    Abstract: A network control system for managing a plurality of switching elements that implement a plurality of logical datapath sets. The network control system includes first and second controllers for generating requests for modifications to first and second logical datapath sets. The first controller is further for determining whether to make modifications to the first logical datapath set. The second controller is further for determining whether to make modifications to the second logical datapath set. Each controller is further for receiving logical control plane data that specifies logical datapath sets and for converting the logical control plane data to physical control plane data for propagating to the switching elements.
    Type: Application
    Filed: June 28, 2024
    Publication date: October 31, 2024
    Inventors: W. Andrew Lambeth, Teemu Koponen, Martin Casado
  • Patent number: 12118102
    Abstract: Some embodiments provide a method for evaluating a policy for authorizing an API (Application Programming Interface) call to an application. Based on a first set of parameters available before receiving the API call, the method evaluates only a portion of the policy to produce a partially evaluated policy. The method stores the partially evaluated policy in a cache. The method then receives an API call to authorize, and determines whether the API call should be authorized by fully evaluating the policy, using the partially evaluated policy retrieved from the cache first storage, and a second set of parameters associated with the API call. The method responds to the API call with a policy decision based on the fully evaluated authorization policy.
    Type: Grant
    Filed: August 29, 2023
    Date of Patent: October 15, 2024
    Assignee: STYRA, INC.
    Inventors: Torin Sandall, Timothy L. Hinrichs, Teemu Koponen
  • Patent number: 12111787
    Abstract: A non-transitory machine readable medium storing a program that configures managed forwarding elements to establish tunnels between the managed forwarding elements is described. From a particular managed forwarding element, the program receives information regarding coupling of a network element to the first managed forwarding element. Upon receiving the information, the program generates a set of universal flow entries for configuring another managed forwarding element to establish a tunnel to the particular managed forwarding element.
    Type: Grant
    Filed: May 13, 2023
    Date of Patent: October 8, 2024
    Assignee: Nicira, Inc.
    Inventors: Pankaj Thakkar, Teemu Koponen
  • Patent number: 12107866
    Abstract: Some embodiments provide a method for authorizing application programming interface (API) calls on a host computer in a local cluster of computers. The method is performed in some embodiments by an API-authorizing agent executing on the host computer in the local computer cluster. From a remote cluster of computers, the method receives (1) a set of API-authorizing policies to evaluate in order to determine whether API calls to an application executing on the host computer are authorized, and (2) a set of parameters needed for evaluating the policies. With the remote cluster of computers, the method registers for notifications regarding updates to the set of parameters. The method then receives notifications, from the remote cluster, regarding an update to the set of parameters, and modifies the set of parameters based on the update.
    Type: Grant
    Filed: June 19, 2023
    Date of Patent: October 1, 2024
    Assignee: STYRA, INC.
    Inventors: Timothy L. Hinrichs, Teemu Koponen, Torin Sandall
  • Patent number: 12093719
    Abstract: Some embodiments provide a method for configuring a logical middlebox in a hosting system that includes a set of nodes. The logical middlebox is part of a logical network that includes a set of logical forwarding elements that connect a set of end machines. The method receives a set of configuration data for the logical middlebox. The method uses a stored set of tables describing physical locations of the end machines to identify a set of nodes at which to implement the logical middlebox. The method provides the logical middlebox configuration for distribution to the identified nodes.
    Type: Grant
    Filed: February 27, 2023
    Date of Patent: September 17, 2024
    Assignee: Nicira, Inc.
    Inventors: Ronghua Zhang, Teemu Koponen, Pankaj Thakkar, Amar Padmanabhan, Martin Casado
  • Publication number: 20240259265
    Abstract: For a network control system that receives, from a user, logical datapath sets that logically express desired forwarding behaviors that are to be implemented by a set of managed switching elements, a controller for managing several managed switching elements that forward data in a network that includes the managed switching elements is described. The controller includes a set of modules for detecting a change in one or more managed switching elements and for updating logical datapath set based on the detected change. The logical datapath set is for subsequent translation into a set of physical forwarding behaviors of the managed switching elements.
    Type: Application
    Filed: April 11, 2024
    Publication date: August 1, 2024
    Inventors: Martin Casado, Teemu Koponen, W. Andrew Lambeth, Pankaj Thakkar
  • Patent number: 12028215
    Abstract: A method for managing a managed forwarding element (MFE) that forwards data in a network. A network controller publishes, to the MFE, a first set of data for configuring the MFE to perform a set of forwarding operations. The network controller collects, from the MFE, a second set of data regarding current operational state of the MFE. The network controller identifies a difference between a desired operational state of the MFE maintained by the network controller and the collected current operational state of the MFE. Based on the identified difference, the network controller publishes a new third set of data for configuring the MFE to adjust the current operational state of the MFE to the desired state.
    Type: Grant
    Filed: December 26, 2022
    Date of Patent: July 2, 2024
    Assignee: Nicira, Inc.
    Inventors: W. Andrew Lambeth, Teemu Koponen, Martin Casado
  • Patent number: 12021832
    Abstract: Some embodiments provide a local controller on a set of host computers that reduce the volume of data that is communicated between the server set and the set of host computers. The local controller executing on a particular host computer, in some embodiments, receives a portion of the namespace including only the policies (e.g., opcode) that are relevant to API-authorization processing for the applications executing on the particular host computer provided by a local agent executing on the computer to authorize the API requests based on policies and parameters. The local controller analyzes the received policies (e.g., policy opcodes) and identifies the parameters (e.g. operands), or parameter types, needed for API-authorization processing (e.g., evaluating the policy opcode upon receiving a particular API request) by the local agent. In some embodiments, the local controller performs this analysis for each updated set of policies (e.g., policy opcodes).
    Type: Grant
    Filed: February 13, 2023
    Date of Patent: June 25, 2024
    Assignee: STYRA, INC.
    Inventors: Teemu Koponen, Timothy L. Hinrichs, Torin Sandall, Stan Lagun
  • Patent number: 12020086
    Abstract: Some embodiments of the invention provide a system for defining, distributing and enforcing policies for authorizing API (Application Programming Interface) calls to applications executing on one or more sets of associated machines (e.g., virtual machines, containers, computers, etc.) in one or more datacenters. This system has a set of one or more servers that acts as a logically centralized resource for defining and storing policies and parameters for evaluating these policies. The server set in some embodiments also enforces these API-authorizing policies. Conjunctively, or alternatively, the server set in some embodiments distributes the defined policies and parameters to policy-enforcing local agents that execute near the applications that process the API calls.
    Type: Grant
    Filed: April 19, 2021
    Date of Patent: June 25, 2024
    Assignee: STYRA, INC.
    Inventors: Timothy L. Hinrichs, Teemu Koponen, Andrew Curtis, Torin Sandall, Octavian Florescu
  • Patent number: 12003543
    Abstract: Some embodiments of the invention provide a method of modifying and validating API requests received at an API server. At a mutating admission controller of the API server, the method intercepts an API request received at the API server. The method invokes a mutating webhook to query a policy agent that includes a set of policies for modifying API requests to determine whether the API request requires modifications. When the policy agent determines that the API request requires modifications based on an identified policy from the set of policies, the method performs the modifications and forwards the modified API request for validation by the API server. After the API server has validated the API request, the method intercepts the API request at a validating admission controller and invokes a validating webhook to query the policy agent to determine whether the API request is valid.
    Type: Grant
    Filed: April 23, 2021
    Date of Patent: June 4, 2024
    Assignee: STYRA, INC.
    Inventors: Sayed Asad Ali, Andrew Curtis, Marco Sanvido, Timothy L. Hinrichs, Teemu Koponen
  • Patent number: 11979280
    Abstract: For a network control system that receives, from a user, logical datapath sets that logically express desired forwarding behaviors that are to be implemented by a set of managed switching elements, a controller for managing several managed switching elements that forward data in a network that includes the managed switching elements is described. The controller includes a set of modules for detecting a change in one or more managed switching elements and for updating logical datapath set based on the detected change. The logical datapath set is for subsequent translation into a set of physical forwarding behaviors of the managed switching elements.
    Type: Grant
    Filed: September 30, 2018
    Date of Patent: May 7, 2024
    Assignee: Nicira, Inc.
    Inventors: Martin Casado, Teemu Koponen, W. Andrew Lambeth, Pankaj Thakkar
  • Patent number: 11929943
    Abstract: A novel design of a gateway that handles traffic in and out of a network by using a datapath daemon is provided. The datapath daemon is a run-to-completion process that performs various data-plane packet-processing operations at the edge of the network. The datapath daemon dispatches packets to other processes or processing threads outside of the daemon by utilizing a user space network stack.
    Type: Grant
    Filed: August 16, 2021
    Date of Patent: March 12, 2024
    Assignee: Nicira, Inc.
    Inventors: Ronghua Zhang, Yong Wang, Teemu Koponen, Jia Yu, Xinhua Hong
  • Publication number: 20240078097
    Abstract: Some embodiments of the invention provide a method for defining code-based policies. The method generates a policy-builder first view of a policy for display in a graphical user interface (GUI) by processing a syntax tree that is generated from a code second view of the policy. The method receives, through the policy-builder first view, a modification to a portion of the policy. To reflect the modification, the method updates a portion of the syntax tree that corresponds to the portion of the policy that is affected by the modification. Based on the updating of the syntax tree, the method updates the code second view by modifying a portion of the code second view that corresponds to the updated portion of the syntax tree.
    Type: Application
    Filed: November 10, 2023
    Publication date: March 7, 2024
    Inventors: Mikol Graves, Peter J. Shepherd, Magnus Hei-Yu Ma, Timothy L. Hinrichs, Teemu Koponen
  • Publication number: 20240039791
    Abstract: Some embodiments provide a system that includes a set of network controllers for receiving definitions of first and second logical switching elements. The system includes several managed switching elements. The set of network controllers configure the several managed switching elements to implement the defined first and second logical switching elements. The system includes several network hosts that are each (1) communicatively coupled to one of the several managed switching elements and (2) associated with one of the first and second logical switching elements. Network data communicated between network hosts associated with the first logical switching element are isolated from network data communicated between network hosts associated with the second logical switching element.
    Type: Application
    Filed: August 28, 2023
    Publication date: February 1, 2024
    Inventors: Martin Casado, Teemu Koponen, Pankaj Thakkar
  • Patent number: 11876679
    Abstract: A control system including several controllers for managing several switching elements. A first controller registers a second controller for receiving a notification when a data tuple changes in a network information base (NIB) storage of the first controller that stores data for managing a set of switching elements. The first controller changes the data tuple in the NIB. The first controller sends the notification to the second controller of the change to the data tuple in the NIB. The first and second controllers operate on two different computing devices. Each controller receives logical control plane data for specifying logical datapath sets and converts the logical control plane data to physical control plane data for enabling the switching elements to implement the logical datapath sets.
    Type: Grant
    Filed: December 11, 2021
    Date of Patent: January 16, 2024
    Assignee: Nicira, Inc.
    Inventors: Teemu Koponen, Martin Casado, Jeremy Stribling, Natasha Gude
  • Publication number: 20240004728
    Abstract: Some embodiments provide a method for authorizing application programming interface (API) calls on a host computer in a local cluster of computers. The method is performed in some embodiments by an API-authorizing agent executing on the host computer in the local computer cluster. From a remote cluster of computers, the method receives (1) a set of API-authorizing policies to evaluate in order to determine whether API calls to an application executing on the host computer are authorized, and (2) a set of parameters needed for evaluating the policies. With the remote cluster of computers, the method registers for notifications regarding updates to the set of parameters. The method then receives notifications, from the remote cluster, regarding an update to the set of parameters, and modifies the set of parameters based on the update.
    Type: Application
    Filed: June 19, 2023
    Publication date: January 4, 2024
    Inventors: Timothy L. Hinrichs, Teemu Koponen, Torin Sandall