Granted Patent B2

US 12,587,451 · App. 17/944,226 · Granted Mar 24, 2026

Inventors: Erol Aygar (Maynard, MA); Margaret Natasha Drew (San Francisco, CA); Mark Peek (Anacortes, WA); Daniel Beveridge (Valrico, FL); Raunak Ravindra Singwi (Pune, IN); Nilanjan Daw (Bangalore, IN); Pranay Pareek (Sunnyvale, CA); Sairam Veeraswamy (Coimbatore, IN); Amarnath Raghunathan (San Jose, CA)

Assignee: Velocloud Networks, LLC

H04L41/40H04L41/0894H04L41/342H04L43/08

Abstract

Claims (39)

1 . A computer-implemented method, comprising:

receiving, by a software defined wide area network (SD-WAN) edge device and from a remote manager, resource quotas dictating a limit on resources of the SD-WAN edge device for allocating to a compute service to be enabled at the SD-WAN edge device;

performing, by the SD-WAN edge device, pre-deployment checks including confirming availability of the resources for the compute service at the SD-WAN device satisfying the resource quotas beyond resources dedicated to core services of the SD-WAN device, wherein the pre-deployment checks comprise determining that a buffer size for SD-WAN network function virtualization (NFV) at the SD-WAN edge device is larger than a memory limit specified in the resource quotas;

in response to confirming the availability of resources satisfying the resource quotas, setting up, by the SD-WAN edge device, one or more security constructs to isolate SD-WAN network functions (NFs) at the SD-WAN edge device from the compute service at the SD-WAN edge device, the one or more security constructs to enable the compute service to deploy one or more containerized workloads in isolation from the core services;

attaching, by the SD-WAN edge device, the compute service to a SD-WAN to enable availability of the one or more containerized workloads on the SD-WAN; and

sending, by the SD-WAN edge device and to the remote manager, an acknowledgement that the compute service is enabled at the SD-WAN edge device;

after sending the acknowledgement to the remote manager, updating, by the SD-WAN edge device, one or more firewall policies at the SD-WAN edge device based on one or more firewall policy updates from the remote manager.

2 . The computer-implemented method according to claim 1 , wherein the resource quotas are received via a heartbeat mechanism between the remote manager and the SD-WAN edge device, and wherein the heartbeat mechanism comprises message sharing between the remote manager and the SD-WAN edge device at a predefined frequency.

3 . The computer-implemented method according to claim 1 , wherein the one or more security constructs comprise at least one of one or more transport layer security (TLS) certificates, one or more TLS keys, a plurality of firewall settings, a plurality of network address translation (NAS) parameters, a plurality of internet protocol (IP) values, a plurality of egress parameters, a plurality of ingress parameters, or a plurality of definitions for authorization and authentication data flows.

4 . The computer-implemented method according to claim 1 , wherein before attaching the compute service to the SD-WAN network, the method further comprises:

setting up, by the SD-WAN edge device, a container orchestration platform based compute infrastructure to handle life cycle management of the compute service.

5 . The computer-implemented method according to claim 1 , wherein after updating the one or more firewall policies at the SD-WAN edge device, the method further comprises:

monitoring, by the SD-WAN edge device, health of the compute service based on telemetry data collected by a management daemon (MGD) at the SD-WAN edge device.

6 . A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations, the operations comprise:

receiving, by a software defined wide area network (SD-WAN) edge device and from a remote manager, resource quotas dictating a limit on resources of the SD-WAN edge device for allocating to a compute service to be enabled at the SD-WAN edge device;

performing, by the SD-WAN edge device, pre-deployment checks including confirming availability of the resources for the compute service at the SD-WAN device satisfying the resource quotas beyond resources dedicated to core services of the SD-WAN device, wherein the pre-deployment checks comprise determining that a buffer size for SD-WAN network function virtualization (NFV) at the SD-WAN edge device is larger than a memory limit specified in the resource quotas;

in response to confirming the availability of resources satisfying the resource quotas, setting up, by the SD-WAN edge device, one or more security constructs to isolate SD-WAN network functions (NFs) at the SD-WAN edge device from the compute service at the SD-WAN edge device, the one or more security constructs to enable the compute service to deploy one or more containerized workloads in isolation from the core services;

attaching, by the SD-WAN edge device, the compute service to a SD-WAN to enable availability of the one or more containerized workloads on the SD-WAN; and

sending, by the SD-WAN edge device and to the remote manager, an acknowledgement that the compute service is enabled at the SD-WAN edge device;

after sending the acknowledgement to the remote manager, updating, by the SD-WAN edge device, one or more firewall policies at the SD-WAN edge device based on one or more firewall policy updates from the remote manager.

7 . The non-transitory, computer-readable medium according to claim 6 , wherein the resource quotas are received via a heartbeat mechanism between the remote manager and the SD-WAN edge device, and wherein the heartbeat mechanism comprises message sharing between the remote manager and the SD-WAN edge device at a predefined frequency.

8 . The non-transitory, computer-readable medium according to claim 6 , wherein the one or more security constructs comprise at least one of one or more transport layer security (TLS) certificates, one or more TLS keys, a plurality of firewall settings, a plurality of network address translation (NAS) parameters, a plurality of internet protocol (IP) values, a plurality of egress parameters, a plurality of ingress parameters, or a plurality of definitions for authorization and authentication data flows.

9 . The non-transitory, computer-readable medium according to claim 6 , wherein before attaching the compute service to the SD-WAN network, the operations further comprise:

setting up, by the SD-WAN edge device, a container orchestration platform based compute infrastructure to handle life cycle management of the compute service.

10 . The non-transitory, computer-readable medium according to claim 6 , wherein after updating the one or more firewall policies at the SD-WAN edge device, the operations further comprise:

monitoring, by the SD-WAN edge device, health of the compute service based on telemetry data collected by a management daemon (MGD) at the SD-WAN edge device.

11 . A computer-implemented system, comprising:

one or more computers; and

one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations, the one or more operations comprise:

receiving, by a software defined wide area network (SD-WAN) edge device and from a remote manager, resource quotas dictating a limit on resources of the SD-WAN edge device for allocating to a compute service to be enabled at the SD-WAN edge device;

performing, by the SD-WAN edge device, pre-deployment checks including confirming availability of the resources for the compute service at the SD-WAN device satisfying the resource quotas beyond resources dedicated to core services of the SD-WAN device, wherein the pre-deployment checks comprise determining that a buffer size for SD-WAN network function virtualization (NFV) at the SD-WAN edge device is larger than a memory limit specified in the resource quotas;

in response to confirming the availability of resources satisfying the resource quotas, setting up, by the SD-WAN edge device, one or more security constructs to isolate SD-WAN network functions (NFs) at the SD-WAN edge device from the compute service at the SD-WAN edge device, the one or more security constructs to enable the compute service to deploy one or more containerized workloads in isolation from the core services;

attaching, by the SD-WAN edge device, the compute service to a SD-WAN to enable availability of the one or more containerized workloads on the SD-WAN; and

sending, by the SD-WAN edge device and to the remote manager, an acknowledgement that the compute service is enabled at the SD-WAN edge device;

after sending the acknowledgement to the remote manager, updating, by the SD-WAN edge device, one or more firewall policies at the SD-WAN edge device based on one or more firewall policy updates from the remote manager.

12 . The computer-implemented system according to claim 11 , wherein the resource quotas are received via a heartbeat mechanism between the remote manager and the SD-WAN edge device, and wherein the heartbeat mechanism comprises message sharing between the remote manager and the SD-WAN edge device at a predefined frequency.

13 . The computer-implemented system according to claim 11 , wherein the one or more security constructs comprise at least one of one or more transport layer security (TLS) certificates, one or more TLS keys, a plurality of firewall settings, a plurality of network address translation (NAS) parameters, a plurality of internet protocol (IP) values, a plurality of egress parameters, a plurality of ingress parameters, or a plurality of definitions for authorization and authentication data flows.

14 . The computer-implemented system according to claim 11 , wherein before attaching the compute service to the SD-WAN network, the one or more operations further comprise:

setting up, by the SD-WAN edge device, a container orchestration platform based compute infrastructure to handle life cycle management of the compute service.

Assignments (3)

Continuity (1)

References Cited (70)