Vmware, Inc.

Yotam Harchol

Ittai Abraham

Asaf Kariv

Sujata Banerjee

Mark Peek

Arjun Singhvi

Pontus Rydin

The disclosure provides an approach for enabling network functions to be executed in serverless computing environments. One embodiment employs a per-packet architecture, in which the trigger for launching a serverless computing instance is receipt of a packet. In such a case, each received packet is packaged into a request to invoke network function(s) required to process the packet, and a serverless computing environment in turn executes the requested network function(s) as serverless computing instance(s) that process the packet and return a response. Another embodiment employs a per-flow architecture in which the trigger for launching a serverless computing instance is receipt of a packet belonging to a new traffic flow. In such a case, a coordinator identifies (or receives notification of) a received packet that belongs to a new sub-flow and launches a serverless computing instance to process packets of the sub-flow that are redirected to the serverless computing instance.

Network functions support for serverless and granular computing environments

The current document is directed to distributed-secure-storage systems, and processes carried out within the distributed-secure-storage systems, that provide for secure storage and retrieval of secrets within distributed computer systems, including private encryption keys used for client authentication during establishment of secure communications channels. The secret-storage systems partition an input secret into multiple secret shares and distribute the secret shares among multiple secret-share-storing node subsystems, without persistently storing the secret itself. An agent within a client device subsequently requests a secret share corresponding to a secret, or a share of data derived from the secret share, from each of the multiple secret-share-storing nodes. Each secret-share-storing node transmits the requested secret share or derived-data share to the agent, which reconstructs the secret from all or a portion of the secret shares or a data value from all or a portion of the derived-data shares transmitted to the agent.

Methods and systems that efficiently and securely store encryption keys

The current document is directed to distributed-secure-storage systems, and processes carried out within the distributed-secure-storage systems, that provide for secure storage and retrieval of confidential and critical data, referred to as 'secrets,' within distributed computer systems. The secret-storage systems partition an input secret into multiple secret shares and distribute the secret shares among multiple secret-share-storing node subsystems, without persistently storing the secret itself. An agent within a client device subsequently requests a secret share corresponding to a secret, or a share of data derived from the secret share, from each of the multiple secret-share-storing nodes. The multiple secret-share-storing nodes additionally cooperate to periodically alter the stored secret shares corresponding to a secret in a way that allows agents to recover the original secret, or derived data, from all or a portion of the altered secret shares or derived-data shares.

Growing community of inventors

Berkeley, CA, United States of America

Yotam Harchol