Granted Patent B2

US 12,250,197 · App. 17/397,772 · Granted Mar 11, 2025

Inventors: Adam J. Salter (Pacifica, CA); Deepanshu Badola (San Francisco, CA); Stephen Fung (Daly Ciy, CA); Santhosh ram Vetrinadar Manohar (San Jose, CA); Varun Kulkarni Somashekhar (Fremont, CA); Amitabh B. Chakrabarty (Fremont, CA); Vinod Vasant Pai (Sunnyvale, CA); Christopher Jason Donley (Bothell, WA); Prabhat Singh (Sunnyvale, CA)

Assignee: Salesforce, Inc.

H04L61/4541H04L61/2585H04L61/5076H04L67/51

Abstract

Claims (49)

1. A computer-implemented method for acquiring data regarding external IP addresses of services offered in a trusted public cloud environment, the computer-implemented method comprising:

establishing a functional domain within the trusted public cloud environment, wherein the functional domain comprises a boundary preventing changes in the functional domain from propagating to another functional domain;

providing an application program interface (API) for a service executing in the trusted public cloud environment and assigned to the functional domain, wherein the service is provisioned with an external IP address (EIP) through which the service is accessible by a consumer service;

monitoring, via the API, events related to the EIP of the service

responsive to detecting an event based on the monitoring, extracting EIP data including metadata associated with the EIP;

generating a data structure including: (i) an action to update a network parameter of the service, (ii) the extracted EIP data, and (iii) metadata associated with the extracted EIP data;

providing a message including the generated data structure to a message queue service for posting in a message queue associated with the EIP of the service offered in the trusted public cloud environment, wherein the message initiates an update to an entry associated with the EIP of the service in a database storing data in association with EIPs of additional services in the trusted public cloud environment; and

enforcing a policy, based on the EIP of the service, against the consumer service requesting access to the service via the EIP of the service in the trusted public cloud environment;

wherein the data structure is generated in response to an API call, and

wherein the network parameter is one of: a network address translation (NAT) gateway with respect to the EIP, or a virtual private network (VPN) connection.

2. The computer-implemented method of claim 1 , wherein the action comprises at least one of:

associating the EIP to the service;

disassociating the EIP from the service;

creating the NAT gateway with respect to the EIP;

deleting the NAT gateway with respect to the EIP;

releasing the EIP;

creating the VPN connection; or

deleting the VPN connection.

3. The computer-implemented method of claim 1 , wherein the metadata associated with the extracted EIP data comprises one or more of:

an address value of the EIP;

a name of the service;

the functional domain in which the service executes;

a time stamp;

an allocation identifier; and

an association identifier.

4. The computer-implemented method of claim 1 , wherein generating the data structure comprises packaging the extracted metadata associated with the EIP into a pre-specified data format for providing to the message queue service.

5. The computer-implemented method of claim 4 , wherein the pre-specified data format is a JSON data structure comprising metadata associated with the extracted EIP data.

6. The computer-implemented method of claim 1 , wherein prior to providing the message with the generated data structure to the message queue service for posting in the message queue, the method further comprises:

acquiring pre-specified permissions for the posting; and

encrypting the generated data structure prior to the posting.

7. A computer system comprising:

a computer processor; and

a non-transitory computer readable storage medium for storing instructions that when executed by the computer processor cause the computer processor to perform steps for acquiring data regarding external IP addresses of services offered in a trusted public cloud environment, the steps comprising:

establishing a functional domain within the trusted public cloud environment, wherein the functional domain comprises a boundary preventing changes in the functional domain from propagating to another functional domain;

providing an application program interface (API) for a service executing in the trusted public cloud environment and assigned to the functional domain, wherein the service is provisioned with an external IP address (EIP) through which the service is accessible by a consumer service;

monitoring, via the API, events related to the EIP of the service;

responsive to detecting an event based on the monitoring, extracting EIP data including metadata associated with the EIP;

generating a data structure including: (i) an action to update a network parameter of the service, (ii) the extracted EIP data, and (iii) metadata associated with the extracted EIP data;

providing a message including the generated data structure to a message queue service for posting in a message queue associated with the EIP of the service offered in the trusted public cloud environment, wherein the message initiates an update to an entry associated with the EIP of the service in a database storing data in association with EIPs of additional services in the trusted public cloud environment; and

enforcing a policy, based on the EIP of the service, against the consumer service requesting access to the service via the EIP of the service in the trusted public cloud environment;

wherein the data structure is generated in response to an API call, and

wherein the network parameter is one of the: a network address translation (NAT) gateway with respect to the EIP, or (iii) a virtual private network (VPN) connection.

8. The computer system of claim 7 , wherein the metadata associated with the extracted EIP data, comprises one or more of:

an address value of the EIP;

a name of the service;

the functional domain in which the service executes;

a time stamp;

an allocation identifier; and

an association identifier.

Assignments (2)

Continuity (1)

References Cited (11)