Oracle International Corporation

Other

Amazon Technologies, Inc.

Thomas James Andrews

Girish Nagaraja

Jinsu Choi

Martin John Sleeman

Troy Ari Levin

Richard Benjamin Stockton

Thomas Ray Bakita

Arsalan Ahmad

Sreedhar Katti

Richard S Greenberg

Mauruthi Geetha Mohan

Jason Anthony Slepicka

Tony Long

Ayman Mohammed Aly Hassan Elmenshawy

A M Helali Mortuza Bhuiyan

Karthik Venkatesh

Sanjeeb Kumar Sahoo

Anthony Long

Philip James Ramsey

Jakub Karol Wojciak

Kenneth Choi Kil

Pritesh Kiritkumar Patel

Krishna Sai Veera Reddy

Mina Michel Gorgy Anes

Yingyu Yang

Bakhtiyar Uddin

A system grants access for a computing entity to execute a requested operation upon a target resource based on a set of one or more access policies associated with a different computing entity. The access control service receives a surrogate access request from a first computing entity. The surrogate access request represents a request for the first computing entity to execute a requested operation upon a target resource based on a set of one or more access policies corresponding to a principal associated with a second computing entity. The system obtains a set of one or more access policies respectively, including a set of one or more authorized operations associated with the principal, and determines whether the requested operation corresponds to at least one authorized operation. Responsive to determining that the requested operation corresponds to at least one authorized operation, the system authorizes execution of the requested operation.

Issuing surrogate credentials for accessing target resources

Techniques for enforcing an egress policy at a target service are described. In an example, traffic is generated for a customer tenancy, where the traffic is generated by a multi-tenancy service. The traffic can be destined to the target service. The traffic can be tagged by the multi-tenancy service with information indicating that the traffic is egressing therefrom on behalf of the customer tenancy. The customer tenancy can be associated with the egress policy. The target service can determine the egress policy based on the information tagged to the traffic and can enforce the egress policy on the traffic that the target service is receiving.

Egress traffic policy enforcement at target service on traffic from service tenancy

A system executes an authorization process for initiating a session with a computing entity. Executing the authorization process includes determining an identity associated with the computing entity, identifying a current set of access policies associated with the identity, and determining, based on the current set of access policies, a first set of actions that the computing entity is authorized to perform. While executing the session, the system executes a first action in accordance with the current set of access policies. Subsequent to executing the first action, the set of access policies is modified. The system detects an occurrence of a trigger condition, and in response, re-executes the authorization process for the session, including determining, based on the modified set of access policies, a second set of actions the computing entity is authorized to perform that differs from the first set of actions.

Re-executing an authorization process to determine an updated set of authorized actions that may be initiated by a computing entity during a session

Techniques for enforcing an egress policy at a target service are described. In an example, traffic is generated for a customer, where the traffic is generated by a customer network of the customer, such as a customer tenancy or an on-premise network. The traffic can be destined to the target service. The traffic can be tagged by the customer network (e.g., by a gateway of the customer network). The customer network can be associated with the egress policy. The target service can determine the egress policy based on the information tagged to the traffic and can enforce the egress policy on the traffic that the target service is receiving.

Egress traffic policy enforcement at target service on traffic from customer network

Techniques for enforcing an egress policy at a target service are described. In an example, traffic is generated for a customer, where the traffic is generated by a customer network of the customer, such as a customer tenancy or an on-premise network, or by a multi-tenancy service on behalf of the customer. The traffic can be destined to the target service. The traffic can be tagged by the customer network (e.g., by a gateway of the customer network) or by the multi-tenancy service. The customer network can be associated with the egress policy. The target service can determine the egress policy based on the information tagged to the traffic and can enforce the egress policy on the traffic that the target service is receiving.

Egress traffic policy enforcement at target service

Techniques described herein relate to authorization between integrated cloud products. An example includes receiving, by a computing device and from a first resource, a first request for permission to access a certificate to verify a requestor's identity. The computing device can transmit a second request to a second resource to authorize permitting access to the certificate. The computing device can receive a response from the second resource comprising an authorization to permit access to the certificate. The computing device can grant permission to the first resource to access the certificate, wherein the first resource is configured to verify the requestor's identity based on accessing the certificate. The computing device can receive a third request from the first resource to generate an association object between the first resource and the certificate. The computing device can generate the association object, wherein the association object associates the first resource and the certificate.

Authorization between integrated cloud products using association

A system is disclosed that includes capabilities by which a nested sub-resource residing in a service tenancy can access a customer-owned resource residing in a customer tenancy without the use of a cross-tenant policy. The disclosed system provides the ability for a nested sub-resource residing in a service tenancy to obtain the resource principal identity of a higher-level resource residing in the customer tenancy and use the identity of the higher-level resource to access a customer-owned resource residing in the customer tenancy. Using the resource principal identity of its higher-level resource, the sub-resource can access a customer-owned resource that resides in a customer tenancy in a seamless way without having to write a cross-tenancy policy statement that provides permission to the sub-resource to access the customer-owned resource.

Nested resource identity management for cloud resources

This disclosure describes techniques implemented partly by a service provider network for distributed storage of event data in data storage according to a data-storage schema in order to reduce the amount of computing resources required to store and access the event data. The techniques may include generating event identifiers (IDs) for actions performed by users to manage cloud-based services. Rather than indexing event IDs by writing the event IDs to a database, the techniques described herein include storing event IDs in different file folders in storage according to a storage schema where the different file folders are assigned to store event IDs having different prefix portions. In this way, event IDs may be stored, or grouped, in different file folders according to prefix portions of the event IDs to reduce the amount of reads and writes required for the event IDs.

Distributed storage of data identifiers

A gun safe is configured to be mounted underneath a portion of an item of furniture and to be deployable from a storage position underneath the portion of the item of furniture into a readily-accessible position adjacent the item of furniture. The gun safe includes a lockable container sized to receive a weapon therein and an articulating mount configured to secure the lockable container underneath the portion of the item of furniture in the storage position. The articulating mount includes a fixed element configured to be fixed underneath the portion of the item of furniture and an articulating element attached between the fixed element and the lockable container, the articulating element being configured to facilitate movement of the lockable container from the storage position outward and upward to a deployed position adjacent the item of furniture.

Gun safe

A method of treating contaminants in soil and/or groundwater including adding a source of an oxidizing agent and an aqueous solution of a metal catalyst having a pH of from about 5 to 8 to the in situ environment in amounts capable of producing reactive species sufficient to oxidize at least one of the contaminants.

Growing community of inventors

Seattle, WA, United States of America

Thomas James Andrews