Authorization orchestration for distributed systems

    公开(公告)号:US11356273B1

    公开(公告)日:2022-06-07

    申请号:US16364079

    申请日:2019-03-25

    Abstract: A workflow orchestration system obtains a plurality of documents for execution of a workflow on a plurality of different sub-systems. A document from the plurality of documents indicates an action to be executed by a corresponding sub-system and comprises an authorization for execution of the action by the corresponding sub-system. The authorization specified in the document can be verified by the corresponding sub-system. Based on the obtained plurality of documents, the workflow orchestration system determines whether these documents provide sufficient authorizations for execution of the workflow. If so, the workflow orchestration system executes the workflow by transmitting the documents to the corresponding sub-systems for execution of the actions specified therein.

    Multi-account entity based access control

    公开(公告)号:US10992657B1

    公开(公告)日:2021-04-27

    申请号:US15967168

    申请日:2018-04-30

    Abstract: A plurality of attributes associated with a user of an account making a request is determined based on the received request. One or more operations to grant the user access to the one or more resources of the second account are determined based on the attributes. Access is provided to one or more resources of the second account according to the one or more operations to fulfill the request.

    Congestion avoidance in multipath routed flows using virtual output queue statistics

    公开(公告)号:US10819640B1

    公开(公告)日:2020-10-27

    申请号:US16118310

    申请日:2018-08-30

    Inventor: Bijendra Singh

    Abstract: Disclosed are techniques regarding interfaces, each configured to output network packets. The techniques can regard a memory for storing multipath groups, virtual output queues, and a histogram table for storing statistical information associated with network packets to be output by interfaces. The techniques can include generating a shared-interface list including a member that represents a union of interfaces of at least some of the multipath groups, wherein the multipath groups of the member share at least one of the interfaces. The techniques can include associating the histogram table with the member. The techniques can include collecting the statistical information pertaining to network packets indicated by information stored in one of the virtual output queues, populating the histogram table with the statistical information, and determining that one of the interfaces is congested based on the statistical information.

    Filtering control plane decision requests for forwarding network packets

    公开(公告)号:US10587514B1

    公开(公告)日:2020-03-10

    申请号:US14977468

    申请日:2015-12-21

    Abstract: Packet processing pipelines may implement filtering of control plane decisions. When network packets are received various types of decision-making and processing is performed. In order to complete processing for the network packet, some decisions may need to be determined by a control plane for the packet processing pipeline, such as a general processor. Requests for control plane decisions for received network packets may be filtered prior to sending the requests to the control plane based on whether the same control plane decisions have been requested for previously received network packets. For control plane decisions with outstanding control plane decision requests, an additional control plane decision request for the network packet may be blocked, whereas control plane decisions with no outstanding control plane decision requests may be allowed.

    Uniform route distribution for a forwarding table

    公开(公告)号:US10547547B1

    公开(公告)日:2020-01-28

    申请号:US16015846

    申请日:2018-06-22

    Inventor: Bijendra Singh

    Abstract: Disclosed are techniques for determining lookup value(s) for each of a plurality of network packets. The lookup value can be used to locate a forwarding table storage location(s) for populating or retrieving forwarding information from forwarding table(s). An entropy value of the lookup values can indicate a greater degree of disorder than an entropy value for addresses of the network packets.

    Multipath tunneling to a service offered at several datacenters

    公开(公告)号:US10326830B1

    公开(公告)日:2019-06-18

    申请号:US15256304

    申请日:2016-09-02

    Inventor: Bijendra Singh

    Abstract: Techniques are disclosed herein regarding interfaces and multipath groups each associated with some of the interfaces to a datacenter. The techniques can include forwarding a network packet to be processed by a service, the service offered on each datacenter such that the network packet can be processed interchangeably at each datacenter. The techniques can also include, selecting one of the multipath groups for outputting of the network packet to the datacenter corresponding to the selected multipath group for processing by the service, the selecting based upon a cost to process the network packet at a respective one of the datacenters corresponding to each of the multipath groups. The techniques can further include, upon determining that the selected multipath group corresponds to a datacenter with an intervening second domain between the device and the corresponding datacenter, encapsulating the network packet for tunneling the network packet through the second domain.

    Pipelined evaluations for algorithmic forwarding route lookup

    公开(公告)号:US10135734B1

    公开(公告)日:2018-11-20

    申请号:US14981664

    申请日:2015-12-28

    Abstract: Packet processors or other devices with packet processing pipelines may implement pipelined evaluations of algorithmic forwarding route lookups. As network packets are received, a destination address for the network packets may be divided into different possible prefix lengths and corresponding entries in a routing table for the different possible prefix lengths may be determined according to a hash scheme for the routing table. The entry values may be read from the routing table and evaluated at subsequent stages to identify the entry with a longest prefix match with respect to the destination address for the network packet. The routing table may include entries for different types of network packets and may be configured to include virtual routing and forwarding for network packets.

Patent Agency Ranking