IP Library › Granted Patent US 11,240,309
Granted Patent B1
US 11,240,309 · App. 17/484,807 · Granted Feb 1, 2022

State management and storage with policy enforcement in a distributed cloud computing network

Inventors: Kenton Taylor Varda (Austin, TX); Alex Dwane Robinson (Austin, TX); Brett Joseph Hoerner (Austin, TX); Loren Cody Koeninger (Austin, TX); Gregory Richard McKeon (New York, NY)
Assignee: CLOUDFLARE, INC.
H04L67/1097H04L67/1021H04L67/42
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,240,309
App. No.
17/484,807
Granted
Feb 1, 2022
Kind
B1
Abstract

A compute server of a distributed cloud computing network receives a request for an object that is to be handled by an object worker, where the object worker includes a single instantiation of a piece of code that solely controls reading/writing to the object. Policies are accessed that are applicable for processing the object. If the policies do not allow the object worker to be instantiated on the compute server, the object worker will not be instantiated and the request will not be processed at that compute server. If the policies allow the object worker to be instantiated on the compute server, the object worker is instantiated and the request is processed.

Claims (137)

1. A method, comprising:

receiving, at a first one of a plurality of compute servers of a distributed cloud computing network, a first request for a first object that is to be handled by a first object worker, the first request being received from a first client device, and wherein the first object worker includes a single instantiation of a first piece of code that solely controls reading and writing to the first object;

accessing a first set of one or more policies that are applicable for processing the first object;

determining that the first set of policies do not allow the first one of the plurality of compute servers to instantiate the first object worker and responsive to this determination, preventing the first object worker from being instantiated on the first one of the plurality of compute servers;

receiving, at a second one of the plurality of compute servers of the distributed cloud computing network, a second request for the first object that is to be handled by the first object worker, the second request being received from a second client device;

accessing the first set of one or more policies that are applicable for processing the first object;

determining that the first set of policies allow for the second one of the plurality of compute servers to instantiate the first object worker;

instantiating the first object worker at the second one of the plurality of compute servers, wherein all requests for the first object are to be processed by the first object worker;

causing a directory service to be updated to indicate that the first object worker is instantiated at the second one of the plurality of compute servers; and

processing, with the first piece of code, the second request.

2. The method of claim 1 , wherein the first set of one or more policies indicate a location in which the first object worker is allowed to be instantiated, and wherein the first one of the plurality of compute servers is not located in that location.

3. The method of claim 1 , further comprising:

receiving, at a third one of the plurality of compute servers of the distributed cloud computing network, a third request for the first object that is to be handled by the first object worker, the third request being received from a third client device;

determining that the first object worker has been instantiated for the first object and is currently running on the second one of the plurality of compute servers;

accessing the first set of one or more policies that are applicable for processing the first object;

determining that the first set of policies allow for the third request to be processed by the first object worker instantiated on the second one of the plurality of compute servers, and responsive to this determination, transmitting the third request to the second one of the plurality of compute servers for the first object worker to process;

receiving, at the third one of the plurality of compute servers, a reply from the second one of the plurality of compute servers to the third request; and

transmitting a response to the third client device based on the received reply.

4. The method of claim 1 , further comprising:

receiving, at a third one of the plurality of compute servers of the distributed cloud computing network, a third request for the first object that is to be handled by the first object worker, the third request being received from a third client device;

determining that the first object worker has been instantiated for the first object and is currently running on the second one of the plurality of compute servers;

transmitting the third request from the third one of the plurality of compute servers to the second one of the plurality of compute servers for the first object worker to process;

receiving, at the second one of the plurality of compute servers from the third one of the plurality of compute servers, the third request;

accessing the first set of one or more policies that are applicable for processing the first object; and

determining that the first set of policies do not allow for the third request to be processed by the first object worker, and responsive to this determination, blocking the third request.

5. The method of claim 1 , further comprising:

receiving, at a third one of the plurality of compute servers of the distributed cloud computing network, a third request for the first object that is to be handled by the first object worker, the third request being received from a third client device;

determining that the first object worker has been previously instantiated on another one of the plurality of compute servers and is not currently running;

accessing the first set of one or more policies that are applicable for processing the first object;

determining that the first set of policies do not allow the first object worker to be instantiated on the third one of the plurality of compute servers, and responsive to this determination, transmitting the request to another one of the plurality of compute servers that is allowed per the first set of policies to instantiate the first object worker;

receiving, at the third one of the plurality of compute servers, a fourth request for a second object that is to be handled by a second object worker, the fourth request being received from a fourth client device, and wherein the second object worker includes a single instantiation of a second piece of code that solely controls reading and writing to the second object;

determining that the second object worker has been previously instantiated on another one of the plurality of compute servers and is not currently running;

accessing a second set of one or more policies that are applicable for processing the second object;

determining that the second set of polices allow the second object worker to be instantiated on the fourth one of the plurality of compute servers, and responsive to this determination, instantiating the second object worker at the fourth one of the plurality of compute servers, wherein all requests for the second object are to be processed by the second object worker;

causing a directory service to be updated to indicate that the second object worker is instantiated at the fourth one of the plurality of compute servers;

processing, with the second piece of code, the fourth request; and

transmitting a response to the fourth client device based on the processed fourth request.

6. The method of claim 1 , wherein the first set of one or more policies are defined by an owner of the first object.

7. The method of claim 1 , wherein the first set of one or more policies are defined by an end user.

8. The method of claim 1 , further comprising:

receiving, at a third one of the plurality of compute servers of the distributed cloud computing network, a third request for the first object that is to be handled by the first object worker, the third request being received from a third client device;

accessing the first set of one or more policies that are applicable for processing the first object;

determining that the first set of policies do not allow the third request from being processed by the first object worker; and

blocking the third request.

9. The method of claim 8 , wherein the first set of one or more policies indicate a location of client devices for which access to the first object worker is allowed, and wherein the third client device is not located in that location.

10. A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor, will cause said processor to carry out the operations comprising:

receiving, at a first one of a plurality of compute servers of a distributed cloud computing network, a first request for a first object that is to be handled by a first object worker, the first request being received from a first client device, and wherein the first object worker includes a single instantiation of a first piece of code that solely controls reading and writing to the first object;

accessing a first set of one or more policies that are applicable for processing the first object;

determining that the first set of policies do not allow the first one of the plurality of compute servers to instantiate the first object worker and responsive to this determination, preventing the first object worker from being instantiated on the first one of the plurality of compute servers;

receiving, at a second one of the plurality of compute servers of the distributed cloud computing network, a second request for the first object that is to be handled by the first object worker, the second request being received from a second client device;

accessing the first set of one or more policies that are applicable for processing the first object;

determining that the first set of policies allow for the second one of the plurality of compute servers to instantiate the first object worker;

instantiating the first object worker at the second one of the plurality of compute servers, wherein all requests for the first object are to be processed by the first object worker;

causing a directory service to be updated to indicate that the first object worker is instantiated at the second one of the plurality of compute servers; and

processing, with the first piece of code, the second request.

11. The non-transitory machine-readable storage medium of claim 10 , wherein the first set of one or more policies indicate a location in which the first object worker is allowed to be instantiated, and wherein the first one of the plurality of compute servers is not located in that location.

12. The non-transitory machine-readable storage medium of claim 10 , wherein the operations further comprise:

receiving, at a third one of the plurality of compute servers of the distributed cloud computing network, a third request for the first object that is to be handled by the first object worker, the third request being received from a third client device;

determining that the first object worker has been instantiated for the first object and is currently running on the second one of the plurality of compute servers;

accessing the first set of one or more policies that are applicable for processing the first object;

determining that the first set of policies allow for the third request to be processed by the first object worker instantiated on the second one of the plurality of compute servers, and responsive to this determination, transmitting the third request to the second one of the plurality of compute servers for the first object worker to process;

receiving, at the third one of the plurality of compute servers, a reply from the second one of the plurality of compute servers to the third request; and

transmitting a response to the third client device based on the received reply.

13. The non-transitory machine-readable storage medium of claim 10 , wherein the operations further comprise:

receiving, at a third one of the plurality of compute servers of the distributed cloud computing network, a third request for the first object that is to be handled by the first object worker, the third request being received from a third client device;

determining that the first object worker has been instantiated for the first object and is currently running on the second one of the plurality of compute servers;

transmitting the third request from the third one of the plurality of compute servers to the second one of the plurality of compute servers for the first object worker to process;

receiving, at the second one of the plurality of compute servers from the third one of the plurality of compute servers, the third request;

accessing the first set of one or more policies that are applicable for processing the first object; and

determining that the first set of policies do not allow for the third request to be processed by the first object worker, and responsive to this determination, blocking the third request.

14. The non-transitory machine-readable storage medium of claim 10 , wherein the operations further comprise:

receiving, at a third one of the plurality of compute servers of the distributed cloud computing network, a third request for the first object that is to be handled by the first object worker, the third request being received from a third client device;

determining that the first object worker has been previously instantiated on another one of the plurality of compute servers and is not currently running;

accessing the first set of one or more policies that are applicable for processing the first object;

determining that the first set of policies do not allow the first object worker to be instantiated on the third one of the plurality of compute servers, and responsive to this determination, transmitting the request to another one of the plurality of compute servers that is allowed per the first set of policies to instantiate the first object worker;

receiving, at the third one of the plurality of compute servers, a fourth request for a second object that is to be handled by a second object worker, the fourth request being received from a fourth client device, and wherein the second object worker includes a single instantiation of a second piece of code that solely controls reading and writing to the second object;

determining that the second object worker has been previously instantiated on another one of the plurality of compute servers and is not currently running;

accessing a second set of one or more policies that are applicable for processing the second object;

determining that the second set of polices allow the second object worker to be instantiated on the fourth one of the plurality of compute servers, and responsive to this determination, instantiating the second object worker at the fourth one of the plurality of compute servers, wherein all requests for the second object are to be processed by the second object worker;

causing a directory service to be updated to indicate that the second object worker is instantiated at the fourth one of the plurality of compute servers;

processing, with the second piece of code, the fourth request; and

transmitting a response to the fourth client device based on the processed fourth request.

15. The non-transitory machine-readable storage medium of claim 10 , wherein the first set of one or more policies are defined by an owner of the first object.

16. The non-transitory machine-readable storage medium of claim 10 , wherein the first set of one or more policies are defined by an end user.

17. The non-transitory machine-readable storage medium of claim 10 , wherein the operations further comprise:

receiving, at a third one of the plurality of compute servers of the distributed cloud computing network, a third request for the first object that is to be handled by the first object worker, the third request being received from a third client device;

accessing the first set of one or more policies that are applicable for processing the first object;

determining that the first set of policies do not allow the third request from being processed by the first object worker; and

blocking the third request.

18. The non-transitory machine-readable storage medium of claim 17 , wherein the first set of one or more policies indicate a location of client devices for which access to the first object worker is allowed, and wherein the third client device is not located in that location.

19. A server, comprising:

a processor; and

a non-transitory machine-readable storage medium coupled to the processor, wherein the non-transitory machine-readable storage medium stores instructions that, when executed by the processor, causes the server to perform the following operations:

receive, at a first one of a plurality of compute servers of a distributed cloud computing network, a first request for a first object that is to be handled by a first object worker, the first request being received from a first client device, and wherein the first object worker includes a single instantiation of a first piece of code that solely controls reading and writing to the first object;

access a first set of one or more policies that are applicable for processing the first object;

determine that the first set of policies do not allow the first one of the plurality of compute servers to instantiate the first object worker and responsive to this determination, prevent the first object worker from being instantiated on the first one of the plurality of compute servers;

receive, at a second one of the plurality of compute servers of the distributed cloud computing network, a second request for the first object that is to be handled by the first object worker, the second request being received from a second client device;

access the first set of one or more policies that are applicable for processing the first object;

determine that the first set of policies allow for the second one of the plurality of compute servers to instantiate the first object worker;

instantiate the first object worker at the second one of the plurality of compute servers, wherein all requests for the first object are to be processed by the first object worker;

cause a directory service to be updated to indicate that the first object worker is instantiated at the second one of the plurality of compute servers; and

process, with the first piece of code, the second request.

20. The server of claim 19 , wherein the first set of one or more policies indicate a location in which the first object worker is allowed to be instantiated, and wherein the first one of the plurality of compute servers is not located in that location.

21. The server of claim 19 , wherein the operations further comprise:

receive, at a third one of the plurality of compute servers of the distributed cloud computing network, a third request for the first object that is to be handled by the first object worker, the third request being received from a third client device;

determine that the first object worker has been instantiated for the first object and is currently running on the second one of the plurality of compute servers;

access the first set of one or more policies that are applicable for processing the first object;

determine that the first set of policies allow for the third request to be processed by the first object worker instantiated on the second one of the plurality of compute servers, and responsive to this determination, transmit the third request to the second one of the plurality of compute servers for the first object worker to process;

receive, at the third one of the plurality of compute servers, a reply from the second one of the plurality of compute servers to the third request; and

transmit a response to the third client device based on the received reply.

22. The server of claim 19 , wherein the operations further comprise:

receive, at a third one of the plurality of compute servers of the distributed cloud computing network, a third request for the first object that is to be handled by the first object worker, the third request being received from a third client device;

determine that the first object worker has been instantiated for the first object and is currently running on the second one of the plurality of compute servers;

transmit the third request from the third one of the plurality of compute servers to the second one of the plurality of compute servers for the first object worker to process;

receive, at the second one of the plurality of compute servers from the third one of the plurality of compute servers, the third request;

access the first set of one or more policies that are applicable for processing the first object; and

determine that the first set of policies do not allow for the third request to be processed by the first object worker, and responsive to this determination, blocking the third request.

23. The server of claim 19 , wherein the operations further comprise:

receive, at a third one of the plurality of compute servers of the distributed cloud computing network, a third request for the first object that is to be handled by the first object worker, the third request being received from a third client device;

determine that the first object worker has been previously instantiated on another one of the plurality of compute servers and is not currently running;

access the first set of one or more policies that are applicable for processing the first object;

determine that the first set of policies do not allow the first object worker to be instantiated on the third one of the plurality of compute servers, and responsive to this determination, transmit the request to another one of the plurality of compute servers that is allowed per the first set of policies to instantiate the first object worker;

receive, at the third one of the plurality of compute servers, a fourth request for a second object that is to be handled by a second object worker, the fourth request being received from a fourth client device, and wherein the second object worker includes a single instantiation of a second piece of code that solely controls reading and writing to the second object;

determine that the second object worker has been previously instantiated on another one of the plurality of compute servers and is not currently running;

access a second set of one or more policies that are applicable for processing the second object;

determine that the second set of polices allow the second object worker to be instantiated on the fourth one of the plurality of compute servers, and responsive to this determination, instantiate the second object worker at the fourth one of the plurality of compute servers, wherein all requests for the second object are to be processed by the second object worker;

cause a directory service to be updated to indicate that the second object worker is instantiated at the fourth one of the plurality of compute servers;

process, with the second piece of code, the fourth request; and

transmit a response to the fourth client device based on the processed fourth request.

24. The server of claim 19 , wherein the first set of one or more policies are defined by an owner of the first object.

25. The server of claim 19 , wherein the first set of one or more policies are defined by an end user.

26. The server of claim 19 , wherein the operations further comprise:

receive, at a third one of the plurality of compute servers of the distributed cloud computing network, a third request for the first object that is to be handled by the first object worker, the third request being received from a third client device;

access the first set of one or more policies that are applicable for processing the first object;

determine that the first set of policies do not allow the third request from being processed by the first object worker; and

block the third request.

27. The server of claim 26 , wherein the first set of one or more policies indicate a location of client devices for which access to the first object worker is allowed, and wherein the third client device is not located in that location.

Assignments (2)
SECURITY INTEREST Recorded May 20, 2024
From: CLOUDFLARE, INC.
To: CITIBANK, N.A.
Reel/Frame 067472/0246 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Sep 24, 2021
From: VARDA, KENTON TAYLOR; ROBINSON, ALEX DWANE; HOERNER, BRETT JOSEPH; KOENINGER, LOREN CODY; MCKEON, GREGORY RICHARD
To: CLOUDFLARE, INC.
Reel/Frame 057594/0717 →
Continuity (1)
Provisional Application 63121793 · Dec 4, 2020
Cited By (1)
US 12,676,844