Equinix, Inc.

Imam Sheikh

Muhammad Durrani

Anand Ozarkar

Chen Xi

Oleg Berzin

Danjue Li

Juxiang Teng

James Kempf

Brian James Lillie

Ankur Sharma

Rafael Lean De Vera Ansay

Sreekanth Narayanan

Lance Weaver

Srinivasan Raghavan

Naresh Kumar

Doron Hendel

In general, this disclosure describes a cloud exchange (or 'cloud exchange') that offers a cloud-to-cloud interface (CCI) for interconnecting cloud services to tenants within public clouds. As described herein, the cloud exchange may be configured with a cloud-to-cloud interface that enables tenant applications of a public cloud to subscribe to and communicate with cloud services, using an end-to-end layer 3 path, in some cases without requiring a separate routing protocol session with a public edge device for the public cloud. In some examples, the public cloud provides a virtual layer 2 connection from a tenant within a public cloud to a routing instance of the cloud exchange, and the cloud exchange uses the routing instance to route service traffic between the tenant and the cloud services.

Cloud-to-cloud interface

In general, techniques are described for an encryption key namespace of a kernel, executed by a host computing device, the encryption key namespace having a configuration file that stores an association of a key identifier and a container identifier by which the host computing device can obtain a data encryption key to use for decrypting/encrypting data for the container identified by the container identifier. In this way, a user may associate a container (or container image) with a unique key identifier. By configuring this association in the encryption key namespace for the container, the container may be identified and automatically associated with a key identifier for the appropriate key for decrypting/encrypting data for the container. The host computing device may then obtain, from a key management service, the key using the key identifier.

Encryption key namespace for containerized workloads

Techniques for a secure device registration and software update using Decentralized Identifiers (DIDs). For example, a method includes sending, by a device and to a data store, a request for a software update published by a software publisher, wherein the request includes a verifiable credential for the device including a DID of the device; receiving, by the device and from the data store, a verifiable credential for the software update, wherein the verifiable credential includes a DID of the software publisher; determining, by the device, whether the software update is newer than software on the device; obtaining, by the device, the software update from the software publisher from a location specified by the verifiable credential; verifying, by the device, the software update based on the verifiable credential; and in response to verifying the software update based on the verifiable credential, installing, by the device, the software update.

Decentralized identifiers for securing device registration and software updates

In general, techniques are described for using zero-knowledge proofs and digital signatures to verify the authenticity of log records generated by multiple parties, at least in some cases without exposing personally identifiable information for the parties.

Tamper-resistant, multiparty logging and log authenticity verification

In general, techniques are described for proxying, with a locally-deployed computing device, service requests from one or more with customer devices to a remote data encryption and key management service and assuming, by the local computing device, the service functions of the remote service in the event of a remote service failure. For example, customer devices at a location may be configured to communicate service requests to the local computing device rather than to a remote service. The local computing device obtains one or more encryption keys or other security objects and stores the security objects to local storage. In response to determining a disruption in the remote service due to, e.g., network connectivity failure, the local computing device may assume the functionality of the remote service for a limited time by performing data encryption operations, responsive to requests received at the local computing device from the customer devices.

Local delegation of remote key management service

This disclosure describes techniques that include use of a distributed ledger to arrange for and/or initiate provisioning of network services, and also to validate payment for such network services. In one example, this disclosure describes a method that includes modifying, by a computing system, a distributed ledger maintained by a consensus network to implement a smart contract that is configured to generate, in response to receiving a request for network services, a provisioning request; receiving the provisioning request, by the computing system and from a computing device on the consensus network that is executing the smart contract, wherein the provisioning request includes information describing requested network services; and provisioning, by the computing system and based on the information describing the requested network services, network services.

Efficient network service provisioning

In one example, a method includes receiving, by a first network device via a routing protocol peering session with a peer router in a first autonomous system, a plurality of routing protocol routes to destination addresses, each routing protocol route specifying a network address prefix and an identifier of the autonomous system that originated the routing protocol route; receiving network address prefix ownership information from a distributed ledger storing a plurality of associations between respective network address prefixes and respective autonomous system identifiers of autonomous systems confirmed to own the respective network address prefixes; determining, based at least on the prefix ownership information, whether any of the plurality of routing protocol routes specifies an autonomous system identifier different than specified by the associations; and in response to determining that one of the routes specifies an autonomous system identifier different than specified by the plurality of associations, performing an action.

Routing protocol security using a distributed ledger

Techniques are described for a centralized, neutral system for Internet of Things (IoT) device activation and automatic onboarding on an end-to-end basis, and for establishing secure communication between IoT devices and the IoT platforms. For example, a method includes receiving an activation request message from an IoT device to activate the IoT device on an IoT core network of a plurality of IoT core networks, wherein the plurality of IoT core networks and a plurality of IoT edge devices are co-located within the co-location facilities, and wherein the plurality of IoT edge devices are connected to one or more IoT platforms; authenticating the IoT device for connection to the IoT core network; and in response to authenticating the IoT device, provisioning a connection between the IoT core network and the plurality of IoT edge devices to provide the IoT device access to the one or more IoT platforms.

Interconnection and activation for internet of things devices in multi-tenant data center facilities

This disclosure describes techniques for securely, efficiently, and/or effectively providing cryptographic operations and key management services. Systems in accordance with one or more aspects of the present disclosure may provide secure management of cryptographic keys as service to a plurality of data center users or customers that contract for services provided by a data center. In one example, this disclosure describes a data center comprising a plurality of cloud service provider ports, a plurality of customer ports, network infrastructure coupling the plurality of cloud service provider ports to the plurality of customer ports, and a computing system including at least one hardware security module.

Growing community of inventors

Redwood City, CA, United States of America

Imam Sheikh