Juniper Networks, Inc.

Amazon Technologies, Inc.

Nvidia Corporation

International Business Machines Corporation

Lumileds LLC

Wipro Limited

Lumileds Holding B.v.

Prashant Singh

Sreekanth Rupavatharam

Hariprasad Shanmugam

Erin MacNeil

Sairam Neelam

Meher Aditya Kumar Addepalli

Ravi S Nagayach

Tezaswi Raja

Daniel Bernardo Roitman

Sushant Bhatia

Michael Laughner

Darren Dunphy

Srinivas Jasti

Dharani Sankar Vijayakumar

Robert Laks

Kshitij Gupta

Hari Ohm Prasath Rajagopal

Sujan-Ehsan Wadud

Christopher Magee Greenwood

Stephen C Trier

Roey Rivnay

Santosh Pallagatti Kotrabasappa

William David Collins, Iii

Arijit Ganguly

Lionel Bitoun

Matthew Hamilton Battles

Anand Misra

Wen Yueh

Erin C MacNeil

Vikas Ganapati Hegde

Vijay Patel

Wei Zhuang

Bryan Thomas Quinn

Vinayak Bhargav Srinath

Deepak Bhatt

William Collins

Kalp Soni

Karen Zhang

Jess Louis Lacy

Nashad Ahmed Safa

Vijay Sandeep Damodar Adapala

Rohit Chhapolia

Systems and methods are provided for managing computing services for an application comprising a plurality of virtual computing components executing on one or more host computing devices, wherein a service virtual computing component is to perform application functionality, and wherein a system computing component is to perform system functionality including management of the application virtual computing component; determining the service virtual computing component is to execute using a first access credential to provide a first computing service to the application virtual computing component, and the service virtual computing component is to execute using a second access credential to provide a second computing service to the system computing component, wherein the first access credential is assigned a different set of computing resource access permissions than the second access credential.

Management of computing services for applications composed of service virtual computing components

Systems and methods are provided for assigning, to a host computing device of an on-demand code execution system comprising a plurality of host computing devices, a set of network addresses available for virtual computing components instantiated on the host computing device, wherein a prefix of each network address of the set of network addresses comprises a same host computing device-specific prefix, and wherein each network address of the set of network addresses is to be accessible from outside the on-demand code execution system; determining to configure a virtual computing component on the host computing device for execution of application code, wherein the virtual computing component is associated with an identifier; and assigning, to the virtual computing component, a network address of the set of network addresses, wherein the network address comprises the prefix and is based on the identifier.

On-demand code execution computing resource access management

Systems and methods are provided for allowing function-initiated traffic of an on-demand code execution system within a cloud provider network to be routed to a private path such based on opt-in settings. An opt-in request may be received indicating a desire of a function invoker to use a private path. Subsequent to the opt-in request, a function invocation request may be received to send communication to a service within the cloud provider network and external to the on-demand code execution system. Subsequent to the function invocation request, a virtual execution environment may be configured to execute the function with mapping of a network-based service to an IP address of a private endpoint. The function is then executed with its traffic sent to the private endpoint.

Architecture for selective use of private paths between cloud services

Systems and methods are described for facilitating network traffic between serverless function executions and isolated cloud resources within virtualized network environments. Virtualized network environments, by default, may be isolated such that external traffic is not permitted to enter the environment. Permissions for traffic that may enter the environment are often set on the basis of network addresses. In the context of serverless functions, such permissions may be difficult to establish because executions of serverless functions can occur on a dynamically selected environment without a fixed network address. The present disclosure provides for creation of user-defined connectors that facilitate routing of network traffic between executions of serverless functions and user virtualized network environments without requiring that routing occur on the bases of network addresses.

User-defined network connectors between serverless functions and isolated cloud resources

A serverless computing system executes user-submitted code in sandboxed environments such as virtual machines or containers. To support execution of parallel applications that require data transfer between instances of the application, the serverless computing system implements an ephemeral mesh network that allows instances of the parallel application to communicate with each other while executing in their respective sandboxes. In some embodiments, a controller or parent application may also connect to the ephemeral mesh network to coordinate execution of the parallel applications. In other embodiments, the parent application may be external to the serverless computing system. The serverless computing system may connect and disconnect sandboxed environments from the ephemeral mesh network as parallel applications start and stop executing, and may remove the network and terminate the parallel applications when the parent application stops executing.

Tightly coupled parallel applications on a serverless computing system

Systems and methods are provided for managing provision of network-stored data sets among instances of function code executing in an on-demand manner. Provision of the data sets may be managed such that the data sets are available efficiently and are able to be accessed within function invocations in a manner that is similar or identical to accessing locally-stored data sets. Moreover, the data sets may, when desired, be made available persistently across function invocations.

On-demand code execution with layered data management

Silicon test structures are described that enable separate measurement of n-channel metal-oxide semiconductor (NMOS) and p-channel metal-oxide semiconductor (PMOS) transistor delays. NMOS and PMOS specific non-inverting stages may be used to construct a multi-stage ring oscillator. Each of the non-inverting stages generates either a rising or falling primary transition that is determined by either NMOS or PMOS transistors, respectively. The opposing transition for a particular non-inverting stage is triggered by propagation of the primary transition to a subsequent non-inverting stage (producing a 'reset' pulse). A frequency of the ring oscillator is determined by the primary transition and one transistor type (NMOS or PMOS). Specifically, the frequency is determined by the propagation delay of the primary transition through the entire ring oscillator.

Silicon test structures for separate measurement of NMOS and PMOS transistor delays

Systems and methods are provided for managing provision of—and access to—data sets among instances of function code executing in an on-demand manner. An API is provided by which functions can store data sets to be shared with other functions, and by which functions can access data sets shared by other functions.

On-demand code execution data management

A ring oscillator circuit with a frequency that is sensitive to the timing of a clock-to-Q (clk2Q) propagation delay of one or more flip-flops utilized in the ring oscillator. The clock2Q is the delay between the clock signal arriving at the clock pin on the flop and the Q output reflecting the state of the input data signal to the flop. Clk2q delay measurements are made based on measurement of the ring oscillator frequency, leading to more accurate estimates of clk2Q for different types of flip-flops and flip-flop combinations, which may in turn enable improvements in circuit layouts, performance, and area.

Circuit structures to measure flip-flop timing characteristics

A disclosed method may include (1) receiving a packet at a tunnel driver in kernel space on a routing engine of a network device, (2) identifying, at the tunnel driver, metadata of the packet that indicates whether at least one firewall filter had already been correctly applied to the packet before the packet arrived at the tunnel driver, (3) determining, based at least in part on the metadata of the packet, that the firewall filter had not been correctly applied to the packet before the packet arrived at the tunnel driver, and then in response to determining that the firewall filter had not been correctly applied to the packet, (4) invoking at least one firewall filter hook that applies at least one firewall rule on the packet before the packet is allowed to exit kernel space on the routing engine. Various other apparatuses, systems, and methods are also disclosed.

Apparatus, system, and method for applying firewall rules at dynamic offsets within packets in kernel space

The disclosed apparatus may include (1) flagging, at a packet filter within a network device, a packet to be discarded instead of passed to a processing unit within the network device, (2) determining that the packet is part of a set of related packets that includes at least one additional packet destined at least intermediately for the network device, (3) identifying, by monitoring incoming packets received at the packet filter, the additional packet within the set of related packets, and then (4) discarding, due to the additional packet being included within the set of related packets, the additional packet instead of passing the additional packet to the processing unit. Various other apparatuses, systems, and methods are also disclosed.

Apparatus, system, and method for efficiently filtering packets at network devices

A disclosed method may include (1) determining that a packet traversing a network device has been selected for conditional tracing by (A) comparing a characteristic of the packet against a firewall rule that calls for all packets exhibiting the characteristic to be conditionally debugged while traversing the network device and (B) determining, based at least in part on the comparison, that the firewall rule applies to the packet due at least in part to the packet exhibiting the characteristic, (2) tracing a journey of the packet within the network device in response to the determination by collecting information about the packet's journey through a network stack of the network device, and then (3) performing at least one action on the network device based at least in part on the information collected about the packet's journey through the network stack. Various other systems, methods, and computer-readable media are also disclosed.

Systems and methods for debugging network stacks based on evidence collected from selective tracing

A network device may obtain policer configuration information. The network device may determine, based on the policer configuration information, a traffic rate limit associated with a traffic protocol type. The network device may obtain, based on the traffic protocol type, networking data associated with the traffic protocol type. The network device may determine, based on the networking data, an expected traffic rate associated with the traffic protocol type. The network device may update, based on the expected traffic rate, the traffic rate limit. The network device may cause traffic associated with the traffic protocol type to be policed based on the updated traffic rate limit.

Updating a traffic rate limit for policing traffic

A network device may detect, from an application associated with a user space of the network device, a request to configure a firewall provided by a kernel of the network device with a rule. The network device may intercept the request to configure the firewall before the firewall is configured with the rule. The network device, based on intercepting the request to configure the firewall, may analyze the rule to determine whether the rule modifies a critical functionality of the firewall. The network device may reject the request to configure the firewall based on determining that the rule modifies the critical functionality of the firewall.

Critical firewall functionality management

Devices and techniques are disclosed herein which include a first LED device layer, a second LED device layer, and an adhesive bondline disposed between the first LED device layer and the second LED device layer. The adhesive bondline includes a bondline thickness, a plurality of spacers disposed within the adhesive bondline, and a silicone matrix. The plurality of spacers may have a diameter or a shortest axis between 0.5 and 10 micrometers and the coefficient of variation is 10% or less. The plurality of spacers may be include SiO, alumina, soda lime glass, may be inorganic, or polymeric.

Precise bondline control between LED components

Growing community of inventors

Santa Clara, CA, United States of America

Prashant Singh