Google Inc.

Cisco Technology, Inc.

Radware, Ltd.

Manoj Sharma

Maurilio Cometto

Ilya Beyer

Debojyoti Dutta

Gururaj Pangal

Marc Solanas Tarre

Choudhury Sarada Prasanna Nanda

Sriganesh Kini

Mohammad Y Hajjat

Kai Zhang

Yathiraj B Udupi

Ralf Rantzau

Johnu George

Aparupa Das Gupta

Mate Ferenczy

Atul Goel

Xinyuan Huang

Mahesh Kumar

Amit Agarwal

Seth Mason

Rahul Ramakrishna

Ratnarekha Singamsetty

Máté Ferenczy

Praveen Shekokar

Badari Narayana

Diganta Paladhi

In one embodiment, a system includes a plurality of first host machines implementing a public-cloud computing environment, wherein at least one of the first host machines comprises at least one public-cloud virtual machine (VM) that performs network address translation; and a plurality of second host machines implementing a private-cloud computing environment, wherein at least one of the second host machines comprises one or more private-cloud virtual machines, wherein the public-cloud VM is configured to receive, via a network tunnel from the private-cloud VM, one or more first packets to be sent to a public Internet Protocol (IP) address of a public network host, translate, using a NAT mapping, a source address of each first packet from a private IP address of the private-cloud VM to an IP address of the public-cloud VM, and send the first packet to the IP address of the public-cloud VM.

Virtual private cloud network switching

In one embodiment, a system includes first host machines implementing a public-cloud computing environment, wherein at least one of the first host machines includes a resource manager that provides a public-cloud resource interface through which one or more public-cloud clients interact with one or more virtual machines, and second host machines implementing a private-cloud computing environment, wherein at least one of the second host machines includes one or more private-cloud virtual machines, wherein at least one of the first host machines further includes a private-cloud VM resource provider through which the resource manager interacts with the private-cloud virtual machines, wherein the VM resource provider translates requests to perform virtual machine operations from a public-cloud-resource interface to a private-cloud virtual machine interface, and the private-cloud virtual machines perform the requested virtual machine operations in response to receiving the translated requests from the VM resource provider.

Resource manager integration in cloud computing environments

The present disclosure describes an architecture and design of Unauthorized-Blocking-Role (UAB). UAB is a mechanism which prevents higher privileged users of cloud-hosted software from performing unauthorized activities on protected objects, such as management objects. UAB works by periodically monitoring the permissions of customer users on key management objects in an object hierarchy in management software. If a customer user is detected to have privileges higher than the user should have on those objects, UAB applies restrictive role-based access controls (RBACs) on the user. Similarly, UAB also monitors protected principals and protected roles to ensure that their privileges are not modified by a customer user.

System and method for safely supporting customer security policies in a third-party-as-a-service solution

In one embodiment, a system includes a computing device providing a computing environment including a number of user accounts, where each of the user accounts is assigned specified privileges to execute particular commands or programs, receiving a request to temporarily escalate privileges for one of the user accounts during a specified duration, where the request includes an identifier of the user account, requested privileges, and the specified duration, granting the requested privileges for the specified duration in conjunction with specific restrictions on one or more prohibited activities that are normally permitted for user accounts with the requested privileges, monitoring, during the specified duration, for any indication that the user account has attempted a prohibited activity, detecting an indication that the user account attempted one of the prohibited activities, and initiating an automated remediation corresponding to the indication.

Escalating user privileges in cloud computing environments

Network architecture for cloud computing environments

In one embodiment, a system includes first host machines implementing a public-cloud computing environment, wherein at least one of the first host machines comprises a resource manager that provides a public-cloud resource interface through which one or more public-cloud clients interact with one or more virtual machines, and second host machines implementing a private-cloud computing environment, wherein at least one of the second host machines comprises one or more private-cloud virtual machines, wherein at least one of the first host machines further comprises a private-cloud VM resource provider through which the resource manager interacts with the private-cloud virtual machines, wherein the VM resource provider translates requests to perform virtual machine operations from a public-cloud-resource interface to a private-cloud virtual machine interface, and the private-cloud virtual machines perform the requested virtual machine operations in response to receiving the translated requests from the VM resource provider.

In one embodiment, a method includes a method for provisioning private-cloud server nodes by receiving a request to provision a specified number of server nodes for a private cloud, wherein the request is associated with a user, identifying a plurality of server nodes including (a) the specified number of hypervisor server nodes from a first pool that includes prepared hypervisor server nodes, each of which includes a previously-installed hypervisor, and (b) a management server node from a second pool that includes prepared management server nodes, each of which includes a previously-installed hypervisor and one or more previously-installed management components, configuring the identified server nodes to use a network associated with the user, creating a private cloud that includes the identified server nodes, and providing, to the user, permission to access the identified server nodes.

Fast provisioning in cloud computing environments

A method for ranking detected anomalies is disclosed. The method includes generating a graph based on a plurality of rules, wherein the graph comprises nodes representing metrics identified in the rules, edges connecting nodes where metrics associated with connected nodes are identified in a given rule, and edge weights of the edges each representing a severity level assigned to the given rule. The method further includes ranking nodes of the graph based on the edge weights. The method further includes ranking detected anomalies based on the ranking of the nodes corresponding to the metrics associated with the detected anomalies.

Intelligent anomaly identification and alerting system based on smart ranking of anomalies

In one embodiment, a method includes a method for provisioning private-cloud server nodes by receiving a request to provision a specified number of server nodes for a private cloud, wherein the request is associated with a user, identifying a plurality of server nodes including (a) the specified number of hypervisor server nodes from a first pool that comprises prepared hypervisor server nodes, each of which comprises a previously-installed hypervisor, and (b) a management server node from a second pool that comprises prepared management server nodes, each of which comprises a previously-installed hypervisor and one or more previously-installed management components, configuring the identified server nodes to use a network associated with the user, creating a private cloud that includes the identified server nodes, and providing, to the user, permission to access the identified server nodes.

Approaches are disclosed for distributing messages across multiple data centers where the data centers do not store messages using a same message queue protocol. In some embodiment, a network element translates messages from a message queue protocol (e.g., Kestrel, RABBITMQ, APACHE Kafka, and ACTIVEMQ) to an application layer messaging protocol (e.g., XMPP, MQTT, WebSocket protocol, or other application layer messaging protocols). In other embodiments, a network element translates messages from an application layer messaging protocol to a message queue protocol. Using the new approaches disclosed herein, data centers communicate using, at least in part, application layer messaging protocols to disconnect the message queue protocols used by the data centers and enable sharing messages between messages queues in the data centers. Consequently, the data centers can share messages regardless of whether the underlying message queue protocols used by the data centers (and the network devices therein) are compatible with one another.

Multi-datacenter message queue

There is disclosed in an example a computer-implemented method of providing automated log analysis, including: receiving a log stream comprising a plurality of transaction log entries, the log entries comprising a time stamp, a component identification (ID), and a name value pair identifying a transaction; creating an index comprising mapping a key ID to a name value pair of a log entry; and selecting from the index a key ID having a relatively large number of repetitions. There is also disclosed an apparatus and computer-readable medium for performing the method.

Growing community of inventors

Sunnyvale, CA, United States of America

Manoj Sharma