SANDBOXING FOR MULTI-TENANCY
    3.
    发明申请
    SANDBOXING FOR MULTI-TENANCY 审中-公开
    多伦多沙发

    公开(公告)号:US20130160115A1

    公开(公告)日:2013-06-20

    申请号:US13330682

    申请日:2011-12-20

    IPC分类号: G06F11/00

    摘要: Systems and methods according to various embodiments disclose a worker process manager adapted to spawn one or more worker processes on a server and to load an application on each of the worker processes. The worker process manager is adapted to isolate the one or more worker processes from each other and to control resource usage by the worker processes. A resource manager is adapted to detect applications that overuse system resources. The worker process manager is adapted to isolate worker processes and to control resource usage using one or more of the following techniques: least-privilege execution, messaging isolation, credentials isolation, data isolation, network isolation, fair share resource usage, and managed runtime security. Heuristic algorithms are used to detect applications that frequently overuse system resources that are unchargeable and that cause system unresponsiveness.

    摘要翻译: 根据各种实施例的系统和方法公开了适于在服务器上产生一个或多个工作进程并且在每个工作进程上加载应用程序的工作进程管理器。 工作进程管理器适于将一个或多个工作进程彼此隔离并且控制工作进程的资源使用。 资源管理器适用于检测过度使用系统资源的应用程序。 工作进程管理器适用于使用以下一种或多种技术来隔离工作进程并控制资源使用:最小权限执行,消息传递隔离,凭据隔离,数据隔离,网络隔离,公平共享资源使用以及受管理的运行时安全性 。 启发式算法用于检测经常过度使用不可充电的系统资源并导致系统无响应的应用程序。

    Multi-tenant, high-density container service for hosting stateful and stateless middleware components
    4.
    发明授权
    Multi-tenant, high-density container service for hosting stateful and stateless middleware components 有权
    多租户,高密度容器服务,用于托管状态和无状态的中间件组件

    公开(公告)号:US08468548B2

    公开(公告)日:2013-06-18

    申请号:US12972411

    申请日:2010-12-17

    IPC分类号: G06F13/00

    CPC分类号: G06F9/5061

    摘要: A container service is capable of hosting large numbers of middleware components for multiple tenants. A central container manager controls a plurality of compute nodes. The central container manager receives middleware components from external devices or services and assigns the components to containers on one or more designated compute nodes. Each compute node has a container management agent and one or more containers. The container management agents activate and manage the appropriate number of containers to run the assigned middleware components. The container management agent assigns each container on its compute node a limited set of privileges to control access to shared resources. The central container manager and each node's container management agent monitor container load levels and dynamically adjust the placement of the middleware components to maintain balanced operation. The compute nodes are grouped into clusters based upon the type of middleware components hosted on each compute node.

    摘要翻译: 容器服务能够为多个租户托管大量的中间件组件。 中央容器管理器控制多个计算节点。 中央容器管理器从外部设备或服务器接收中间件组件,并将组件分配给一个或多个指定的计算节点上的容器。 每个计算节点都有一个容器管理代理和一个或多个容器。 容器管理代理激活并管理适当数量的容器以运行分配的中间件组件。 容器管理代理在其计算节点上分配有限的一组权限以控制对共享资源的访问。 中央集装箱管理员和每个节点的集装箱管理代理监控集装箱装载水平,动态调整中间件组件的位置,保持平衡运行。 基于每个计算节点上托管的中间件组件的类型,将计算节点分组为集群。

    MULTI-TENANT, HIGH-DENSITY CONTAINER SERVICE FOR HOSTING STATEFUL AND STATELESS MIDDLEWARE COMPONENTS
    6.
    发明申请
    MULTI-TENANT, HIGH-DENSITY CONTAINER SERVICE FOR HOSTING STATEFUL AND STATELESS MIDDLEWARE COMPONENTS 有权
    多重承诺,高密度集装箱服务,用于托管状态和状态中间件组件

    公开(公告)号:US20120159523A1

    公开(公告)日:2012-06-21

    申请号:US12972411

    申请日:2010-12-17

    IPC分类号: G06F9/46

    CPC分类号: G06F9/5061

    摘要: A container service is capable of hosting large numbers of middleware components for multiple tenants. A central container manager controls a plurality of compute nodes. The central container manager receives middleware components from external devices or services and assigns the components to containers on one or more designated compute nodes. Each compute node has a container management agent and one or more containers. The container management agents activate and manage the appropriate number of containers to run the assigned middleware components. The container management agent assigns each container on its compute node a limited set of privileges to control access to shared resources. The central container manager and each node's container management agent monitor container load levels and dynamically adjust the placement of the middleware components to maintain balanced operation. The compute nodes are grouped into clusters based upon the type of middleware components hosted on each compute node.

    摘要翻译: 容器服务能够为多个租户托管大量的中间件组件。 中央容器管理器控制多个计算节点。 中央容器管理器从外部设备或服务器接收中间件组件,并将组件分配给一个或多个指定的计算节点上的容器。 每个计算节点都有一个容器管理代理和一个或多个容器。 容器管理代理激活并管理适当数量的容器以运行分配的中间件组件。 容器管理代理在其计算节点上分配有限的一组权限以控制对共享资源的访问。 中央集装箱管理员和每个节点的集装箱管理代理监控集装箱装载水平,动态调整中间件组件的位置,保持平衡运行。 基于每个计算节点上托管的中间件组件的类型,将计算节点分组为集群。

    Context-specific network resource addressing model for distributed services
    8.
    发明授权
    Context-specific network resource addressing model for distributed services 有权
    分布式服务的上下文特定网络资源寻址模型

    公开(公告)号:US08321503B2

    公开(公告)日:2012-11-27

    申请号:US12822744

    申请日:2010-06-24

    IPC分类号: G06F15/16

    摘要: A back-end locator service can be utilized to identify a specific computing device, from among multiple computing devices in a domain, that is the most appropriate computing device to handle a particular type of request for data or other resources. The data or resources hosted by the domain can be divided among multiple computing devices. The domain can expose a network-based application program interface where successive requests by a client computing device become more specific as to the data or resources requested. Responses from the computing devices in the domain can, at some point in time, be informed by the back-end locator service and can comprise location-specific resource identifiers. The client computing device can utilize such location specific resource identifiers to direct further communications to the appropriate, specific computing device without having to incur redirection inefficiencies.

    摘要翻译: 可以利用后端定位器服务来识别来自域中的多个计算设备中的特定计算设备,其是处理数据或其他资源的特定类型的请求的最合适的计算设备。 由域托管的数据或资源可以分为多个计算设备。 该域可以暴露基于网络的应用程序接口,其中客户端计算设备的连续请求对于所请求的数据或资源变得更具体。 在某些时间点,来自域中的计算设备的响应可以由后端定位器服务通知,并且可以包括位置特定的资源标识符。 客户端计算设备可以利用这种位置特定的资源标识符来引导进一步的通信到适当的特定的计算设备,而不必引起重定向的低效率。

    PROGRAMMING MODEL FOR SYNCHRONIZING BROWSER CACHES ACROSS DEVICES AND WEB SERVICES
    9.
    发明申请
    PROGRAMMING MODEL FOR SYNCHRONIZING BROWSER CACHES ACROSS DEVICES AND WEB SERVICES 有权
    通过设备和WEB服务同步浏览器缓存的编程模型

    公开(公告)号:US20100235321A1

    公开(公告)日:2010-09-16

    申请号:US12402366

    申请日:2009-03-11

    IPC分类号: G06F17/30

    摘要: A computer user may use a computing environment comprising a set of computers that respectively feature a web browser having a browser cache containing many types of data objects, including application resources and user-generated data files. However, the contents of a browser cache significantly contribute to the computing environment of a computer, and the computing environments presented by each computer may diverge, providing an inconsistent computing environment. Instead, the contents of browser caches of the computers comprising the computing environment may be synchronized across computers. Additionally, the browser cache may be synchronized with the other data objects of a computing environment (such as relevant portions of the filesystem); the synchronizing may be implemented as an out-of-browser process executing independently of the applications, and even when the browser is not executing; and the synchronization may be exposed through a programmatic access with which web applications may interact.

    摘要翻译: 计算机用户可以使用包括一组计算机的计算环境,所述计算机组分别具有包括应用资源和用户生成的数据文件的包含许多类型的数据对象的浏览器高速缓存的web浏览器。 然而,浏览器缓存的内容显着地有助于计算机的计算环境,并且由每台计算机呈现的计算环境可能会分歧,从而提供不一致的计算环境。 相反,包括计算环境的计算机的浏览器高速缓存的内容可以跨计算机同步。 此外,浏览器高速缓存可以与计算环境的其他数据对象(诸如文件系统的相关部分)同步; 同步可以被实现为独立于应用程序执行的浏览器外程序,甚至当浏览器不执行时; 并且可以通过与web应用程序可以交互的编程访问来暴露同步。

    DECLARATIVE PROGRAMMING MODEL FOR MODELING AND EXECUTION OF TRIGGERS FOR RESOURCE ORIENTED SYSTEM
    10.
    发明申请
    DECLARATIVE PROGRAMMING MODEL FOR MODELING AND EXECUTION OF TRIGGERS FOR RESOURCE ORIENTED SYSTEM 有权
    用于面向资源系统的触发器建模和执行的声明编程模型

    公开(公告)号:US20100094926A1

    公开(公告)日:2010-04-15

    申请号:US12250637

    申请日:2008-10-14

    IPC分类号: G06F15/16

    摘要: Data sets of various types may be accessible through a host according to a protocol, such as a RESTful HTTP interface. Various domains may involve domain-specific processes to be executed as pre-triggers or post-triggers of various protocol requests (e.g., an HTTP GET request specifying a Read operation on an access-restricted data set may involve an authorization operations set that verifies the access privileges of the requester.) A host of the data set may be configured to receive a resource script expressing the operations set in a script language, to store the resource script, and to associated it with at least one data set and at least one verb of the protocol. Upon later receiving a protocol request specifying the verb and the resource, the host may then execute the resource script (as a pre-trigger and/or as a post-trigger) in accordance with the business logic of the domain.

    摘要翻译: 各种类型的数据集可以通过主机根据诸如RESTful HTTP接口的协议来访问。 各种领域可以涉及要作为各种协议请求的预触发或后触发来执行的特定于域的进程(例如,指定访问受限数据集上的读取操作的HTTP GET请求可能涉及验证 请求者的访问权限。)数据集的主机可以被配置为接收表示以脚本语言设置的操作的资源脚本,以存储资源脚本,并且将其与至少一个数据集和至少一个数据集相关联 协议的动词。 随后,当接收到指定动词和资源的协议请求时,主机可以根据域的业务逻辑执行资源脚本(作为预触发和/或作为后触发)。