Granted Patent B2

US 12,395,556 · App. 18/766,015 · Granted Aug 19, 2025

Inventors: Kenton Taylor Varda (Austin, TX); Alex Dwane Robinson (Austin, TX); Brett Joseph Hoerner (Austin, TX); Loren Cody Koeninger (Austin, TX); Gregory Richard McKeon (New York, NY)

Assignee: CLOUDFLARE, INC.

H04L67/1097H04L63/10H04L67/01H04L67/1021

Abstract

Claims (59)

1. A method, comprising:

instantiating a first object worker on a first compute server of a plurality of compute servers of a distributed cloud computing network, wherein the first object worker is associated with a first object, and wherein the first object worker includes a single instantiation of a first piece of code that solely controls reading and writing to the first object;

receiving, at a first compute server, a first request for the first object worker to send a first communication with the first object to a first asset that is on a first network that is external to the distributed cloud computing network;

accessing a first set of one or more policies that are applicable for processing the first object, wherein the first set of one or more policies include an external communication policy;

determining, based on an external communication policy associated with the first object worker, that the first object worker is not allowed to send the first communication with the first object to the first asset that is on the first network that is external to the distributed cloud computing network, and responsive to this determination, preventing the first object worker from sending the first communication with the first object to the first asset that is on the first network that is external to the distributed cloud computing network;

receiving, at the first compute server, a second request for the first object worker to send a second communication with the first object to a second asset that is on a second network that is external to the distributed cloud computing network;

accessing the first set of one or more policies that are applicable for processing the first object; and

determining, based on the external communication policy associated with the first object worker, that the first object worker is allowed to send the second communication with the first object to the second asset that is on the second network that is external to the distributed cloud computing network, and responsive to this determination, allowing the first object worker to send the second communication with the first object to the second asset.

2. The method of claim 1 , wherein the external communication policy specifies a set of one or conditions that control whether communication can be sent to assets on networks external to the distributed cloud computing network.

3. The method of claim 1 , further comprising:

receiving, at the first compute server, a third request for the first object worker to second a third communication with the first object to a second object worker that is associated with another organization or domain compared to the first object worker;

accessing the first set of one or more policies that are applicable for processing the first object; and

determining, based on the external communication policy associated with the first object worker, that the first object worker is not allowed to send the third communication with the first object to the second object worker, and responsive to this determination, preventing the first object worker from sending the third communication with the first object to the second object worker.

4. The method of claim 1 , further comprising:

receiving, at the first compute server, a third request for the first object worker to second a third communication with the first object to a second object worker that is associated with another organization or domain compared to the first object worker;

accessing the first set of one or more policies that are applicable for processing the first object; and

determining, based on the external communication policy associated with the first object worker, that the first object worker is allowed to send the third communication with the first object to the second object worker and responsive to this determination, transmitting the third communication with the first object from the first object worker to the second object worker.

5. The method of claim 1 , wherein the first set of one or more policies are defined by an owner of the first object.

6. The method of claim 1 , wherein the first set of one or more policies are defined by an end user.

7. A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor, will cause said processor to carry out the operations comprising:

instantiating a first object worker on a first compute server of a plurality of compute servers of a distributed cloud computing network, wherein the first object worker is associated with a first object, and wherein the first object worker includes a single instantiation of a first piece of code that solely controls reading and writing to the first object;

receiving, at a first compute server, a first request for the first object worker to send a first communication with the first object to a first asset that is on a first network that is external to the distributed cloud computing network;

accessing a first set of one or more policies that are applicable for processing the first object, wherein the first set of one or more policies include an external communication policy;

determining, based on an external communication policy associated with the first object worker, that the first object worker is not allowed to send the first communication with the first object to the first asset that is on the first network that is external to the distributed cloud computing network, and responsive to this determination, preventing the first object worker from sending the first communication with the first object to the first asset that is on the first network that is external to the distributed cloud computing network;

receiving, at the first compute server, a second request for the first object worker to send a second communication with the first object to a second asset that is on a second network that is external to the distributed cloud computing network;

accessing the first set of one or more policies that are applicable for processing the first object; and

determining, based on the external communication policy associated with the first object worker, that the first object worker is allowed to send the second communication with the first object to the second asset that is on the second network that is external to the distributed cloud computing network, and responsive to this determination, allowing the first object worker to send the second communication with the first object to the second asset.

8. The non-transitory machine-readable storage medium of claim 7 , wherein the external communication policy specifies a set of one or conditions that control whether communication can be sent to assets on networks external to the distributed cloud computing network.

9. The non-transitory machine-readable storage medium of claim 7 , wherein the operations further comprise:

receiving, at the first compute server, a third request for the first object worker to second a third communication with the first object to a second object worker that is associated with another organization or domain compared to the first object worker;

accessing the first set of one or more policies that are applicable for processing the first object; and

determining, based on the external communication policy associated with the first object worker, that the first object worker is not allowed to send the third communication with the first object to the second object worker, and responsive to this determination, preventing the first object worker from sending the third communication with the first object to the second object worker.

10. The non-transitory machine-readable storage medium of claim 7 , wherein the operations further comprise:

receiving, at the first compute server, a third request for the first object worker to second a third communication with the first object to a second object worker that is associated with another organization or domain compared to the first object worker;

accessing the first set of one or more policies that are applicable for processing the first object; and

determining, based on the external communication policy associated with the first object worker, that the first object worker is allowed to send the third communication with the first object to the second object worker and responsive to this determination, transmitting the third communication with the first object from the first object worker to the second object worker.

11. The non-transitory machine-readable storage medium of claim 7 , wherein the first set of one or more policies are defined by an owner of the first object.

12. The non-transitory machine-readable storage medium of claim 7 , wherein the first set of one or more policies are defined by an end user.

13. A first compute server, comprising:

a processor; and

a non-transitory machine-readable storage medium coupled to the processor, wherein the non-transitory machine-readable storage medium stores instructions that, when executed by the processor, causes the server to perform operations including:

instantiate a first object worker on the first compute server of a plurality of compute servers of a distributed cloud computing network, wherein the first object worker is associated with a first object, and wherein the first object worker includes a single instantiation of a first piece of code that solely controls reading and writing to the first object;

receive, at the first compute server, a first request for the first object worker to send a first communication with the first object to a first asset that is on a first network that is external to the distributed cloud computing network;

access a first set of one or more policies that are applicable for processing the first object, wherein the first set of one or more policies include an external communication policy;

determine, based on an external communication policy associated with the first object worker, that the first object worker is not allowed to send the first communication with the first object to the first asset that is on the first network that is external to the distributed cloud computing network, and responsive to this determination, prevent the first object worker from sending the first communication with the first object to the first asset that is on the first network that is external to the distributed cloud computing network;

receive, at the first compute server, a second request for the first object worker to send a second communication with the first object to a second asset that is on a second network that is external to the distributed cloud computing network;

access the first set of one or more policies that are applicable for processing the first object; and

determine, based on the external communication policy associated with the first object worker, that the first object worker is allowed to send the second communication with the first object to the second asset that is on the second network that is external to the distributed cloud computing network, and responsive to this determination, allowing the first object worker to send the second communication with the first object to the second asset.

14. The first compute server of claim 13 , wherein the external communication policy specifies a set of one or conditions that control whether communication can be sent to assets on networks external to the distributed cloud computing network.

15. The first compute server of claim 13 , wherein the operations further include:

receive, at the first compute server, a third request for the first object worker to second a third communication with the first object to a second object worker that is associated with another organization or domain compared to the first object worker;

access the first set of one or more policies that are applicable for processing the first object; and

determine, based on the external communication policy associated with the first object worker, that the first object worker is not allowed to send the third communication with the first object to the second object worker, and responsive to this determination, prevent the first object worker from sending the third communication with the first object to the second object worker.

16. The first compute server of claim 13 , wherein the operations further include:

receive, at the first compute server, a third request for the first object worker to second a third communication with the first object to a second object worker that is associated with another organization or domain compared to the first object worker;

access the first set of one or more policies that are applicable for processing the first object; and

determine, based on the external communication policy associated with the first object worker, that the first object worker is allowed to send the third communication with the first object to the second object worker and responsive to this determination, transmit the third communication with the first object from the first object worker to the second object worker.

17. The first compute server of claim 13 , wherein the first set of one or more policies are defined by an owner of the first object.

18. The first compute server of claim 13 , wherein the first set of one or more policies are defined by an end user.

Assignments (1)

Continuity (4)

References Cited (57)