公开(公告)号：US20250094204A1

公开(公告)日：2025-03-20

申请号：US18964430

申请日：2024-11-30

Applicant: Google LLC

Inventor： Ilya Beyer ,  Manoj Sharma ,  Gururaj Pangal ,  Maurilio Cometto

IPC: G06F9/455 ,  G06F8/60 ,  G06F9/50

Abstract: A system includes first host machines implementing a public-cloud computing environment, wherein at least one of the first host machines includes a resource manager that provides a public-cloud resource interface through which one or more public-cloud clients interact with one or more virtual machines, and second host machines implementing a private-cloud computing environment, wherein at least one of the second host machines includes one or more private-cloud virtual machines, wherein at least one of the first host machines further includes a private-cloud VM resource provider through which the resource manager interacts with the private-cloud virtual machines, wherein the VM resource provider translates requests to perform virtual machine operations from a public-cloud-resource interface to a private-cloud virtual machine interface, and the private-cloud virtual machines perform the requested virtual machine operations in response to receiving the translated requests from the VM resource provider.

公开(公告)号：US12158964B2

公开(公告)日：2024-12-03

申请号：US17497386

申请日：2021-10-08

Applicant: Google LLC

Inventor： Atul Goel ,  Diganta Paladhi ,  Manoj Sharma ,  Maurilio Cometto

IPC: H04L29/06 ,  G06F21/62

Abstract: The present disclosure describes an architecture and design of Unauthorized-Blocking-Role (UAB). UAB is a mechanism which prevents higher privileged users of cloud-hosted software from performing unauthorized activities on protected objects, such as management objects. UAB works by periodically monitoring the permissions of customer users on key management objects in an object hierarchy in management software. If a customer user is detected to have privileges higher than the user should have on those objects, UAB applies restrictive role-based access controls (RBACs) on the user. Similarly, UAB also monitors protected principals and protected roles to ensure that their privileges are not modified by a customer user.

公开(公告)号：US12052254B2

公开(公告)日：2024-07-30

申请号：US17446751

申请日：2021-09-02

Applicant: Google LLC

Inventor： Manoj Sharma ,  Choudhury Sarada Prasanna Nanda ,  Ilya Beyer ,  Maurilio Cometto

IPC: G06F21/00 ,  G06F11/34 ,  G06F21/62 ,  H04L9/40

CPC classification number: H04L63/102 ,  G06F11/3438 ,  G06F21/6281 ,  H04L63/108 ,  G06F2221/2141

Abstract: In one embodiment, a system includes a computing device providing a computing environment including a number of user accounts, where each of the user accounts is assigned specified privileges to execute particular commands or programs, receiving a request to temporarily escalate privileges for one of the user accounts during a specified duration, where the request includes an identifier of the user account, requested privileges, and the specified duration, granting the requested privileges for the specified duration in conjunction with specific restrictions on one or more prohibited activities that are normally permitted for user accounts with the requested privileges, monitoring, during the specified duration, for any indication that the user account has attempted a prohibited activity, detecting an indication that the user account attempted one of the prohibited activities, and initiating an automated remediation corresponding to the indication.

公开(公告)号：US20220129575A1

公开(公告)日：2022-04-28

申请号：US17497386

申请日：2021-10-08

Applicant: Google LLC

Inventor： Atul Goel ,  Diganta Paladhi ,  Manoj Sharma ,  Maurilio Cometto

IPC: G06F21/62

Abstract: The present disclosure describes an architecture and design of Unauthorized-Blocking-Role (UAB). UAB is a mechanism which prevents higher privileged users of cloud-hosted software from performing unauthorized activities on protected objects, such as management objects. UAB works by periodically monitoring the permissions of customer users on key management objects in an object hierarchy in management software. If a customer user is detected to have privileges higher than the user should have on those objects, UAB applies restrictive role-based access controls (RBACs) on the user. Similarly, UAB also monitors protected principals and protected roles to ensure that their privileges are not modified by a customer user.

公开(公告)号：US20240356897A1

公开(公告)日：2024-10-24

申请号：US18659847

申请日：2024-05-09

Applicant: Google LLC

Inventor： Maurilio Cometto ,  Mate Ferenczy ,  Sriganesh Kini ,  Mohammad Y. Hajjat ,  Manoj Sharma

IPC: H04L9/40 ,  G06F9/455 ,  H04L12/46 ,  H04L61/2575 ,  H04L67/1001

CPC classification number: H04L63/0263 ,  G06F9/45558 ,  H04L12/4633 ,  H04L12/4641 ,  H04L61/2575 ,  H04L63/0209 ,  H04L63/101 ,  H04L67/1001 ,  G06F2009/45595

Abstract: In one embodiment, a system includes a plurality of first host machines implementing a public-cloud computing environment, wherein at least one of the first host machines comprises at least one public-cloud virtual machine (VM) that performs network address translation; and a plurality of second host machines implementing a private-cloud computing environment, wherein at least one of the second host machines comprises one or more private-cloud virtual machines, wherein the public-cloud VM is configured to receive, via a network tunnel from the private-cloud VM, one or more first packets to be sent to a public Internet Protocol (IP) address of a public network host, translate, using a NAT mapping, a source address of each first packet from a private IP address of the private-cloud VM to an IP address of the public-cloud VM, and send the first packet to the IP address of the public-cloud VM.

公开(公告)号：US12010097B2

公开(公告)日：2024-06-11

申请号：US17651417

申请日：2022-02-16

Applicant: Google LLC

Inventor： Maurilio Cometto ,  Mate Ferenczy ,  Sriganesh Kini ,  Mohammad Y. Hajjat ,  Manoj Sharma

IPC: H04L9/40 ,  G06F9/455 ,  H04L12/46 ,  H04L61/2575 ,  H04L67/1001

CPC classification number: H04L63/0263 ,  G06F9/45558 ,  H04L12/4633 ,  H04L12/4641 ,  H04L61/2575 ,  H04L63/0209 ,  H04L63/101 ,  H04L67/1001 ,  G06F2009/45595

Abstract: In one embodiment, a system includes a plurality of first host machines implementing a public-cloud computing environment, wherein at least one of the first host machines comprises at least one public-cloud virtual machine (VM) that performs network address translation; and a plurality of second host machines implementing a private-cloud computing environment, wherein at least one of the second host machines comprises one or more private-cloud virtual machines, wherein the public-cloud VM is configured to receive, via a network tunnel from the private-cloud VM, one or more first packets to be sent to a public Internet Protocol (IP) address of a public network host, translate, using a NAT mapping, a source address of each first packet from a private IP address of the private-cloud VM to an IP address of the public-cloud VM, and send the first packet to the IP address of the public-cloud VM.

公开(公告)号：US20220174042A1

公开(公告)日：2022-06-02

申请号：US17651417

申请日：2022-02-16

Applicant: Google LLC

Inventor： Maurilio Cometto ,  Mate Ferenczy ,  Sriganesh Kini ,  Mohammad Y. Hajjat ,  Manoj Sharma

IPC: H04L9/40 ,  H04L12/46 ,  H04L67/1001 ,  H04L61/2575 ,  G06F9/455

Abstract: In one embodiment, a system includes a plurality of first host machines implementing a public-cloud computing environment, wherein at least one of the first host machines comprises at least one public-cloud virtual machine (VM) that performs network address translation; and a plurality of second host machines implementing a private-cloud computing environment, wherein at least one of the second host machines comprises one or more private-cloud virtual machines, wherein the public-cloud VM is configured to receive, via a network tunnel from the private-cloud VM, one or more first packets to be sent to a public Internet Protocol (IP) address of a public network host, translate, using a NAT mapping, a source address of each first packet from a private IP address of the private-cloud VM to an IP address of the public-cloud VM, and send the first packet to the IP address of the public-cloud VM.

公开(公告)号：US11128629B2

公开(公告)日：2021-09-21

申请号：US16135193

申请日：2018-09-19

Applicant: Google LLC

Inventor： Manoj Sharma ,  Choudhury Sarada Prasanna Nanda ,  Ilya Beyer ,  Maurilio Cometto

IPC: G06F21/00 ,  H04L29/06 ,  G06F11/34 ,  G06F21/62

Abstract: In one embodiment, a system includes a computing device providing a computing environment including a number of user accounts, where each of the user accounts is assigned specified privileges to execute particular commands or programs, receiving a request to temporarily escalate privileges for one of the user accounts during a specified duration, where the request includes an identifier of the user account, requested privileges, and the specified duration, granting the requested privileges for the specified duration in conjunction with specific restrictions on one or more prohibited activities that are normally permitted for user accounts with the requested privileges, monitoring, during the specified duration, for any indication that the user account has attempted a prohibited activity, detecting an indication that the user account attempted one of the prohibited activities, and initiating an automated remediation corresponding to the indication.

公开(公告)号：US20210258208A1

公开(公告)日：2021-08-19

申请号：US17230920

申请日：2021-04-14

Applicant: Google LLC

Inventor： Manoj Sharma ,  Choudhury Sarada Prasanna Nanda ,  Gururaj Pangal ,  Maurilio Cornetta ,  Ilya Beyer

IPC: H04L12/24 ,  G06F9/50 ,  G06F21/62 ,  G06F9/455 ,  H04L29/06 ,  G06F8/61

Abstract: In one embodiment, a system includes a computing device providing a computing environment including a number of user accounts, where each of the user accounts is assigned specified privileges to execute particular commands or programs, receiving a request to temporarily escalate privileges for one of the user accounts during a specified duration, where the request includes an identifier of the user account, requested privileges, and the specified duration, granting the requested privileges for the specified duration in conjunction with specific restrictions on one or more prohibited activities that are normally permitted for user accounts with the requested privileges, monitoring, 1 0 during the specified duration, for any indication that the user account has attempted a prohibited activity, detecting an indication that the user account attempted one of the prohibited activities, and initiating an automated remediation corresponding to the indication.

公开(公告)号：US11853789B2

公开(公告)日：2023-12-26

申请号：US18058597

申请日：2022-11-23

Applicant: Google LLC

Inventor： Ilya Beyer ,  Manoj Sharma ,  Gururaj Pangal ,  Maurilio Cometto

IPC: G06F9/455 ,  G06F9/50 ,  G06F8/60

CPC classification number: G06F9/45558 ,  G06F8/60 ,  G06F9/5072 ,  G06F9/5077 ,  G06F2009/45583 ,  G06F2209/5011

Abstract: In one embodiment, a system includes first host machines implementing a public-cloud computing environment, wherein at least one of the first host machines includes a resource manager that provides a public-cloud resource interface through which one or more public-cloud clients interact with one or more virtual machines, and second host machines implementing a private-cloud computing environment, wherein at least one of the second host machines includes one or more private-cloud virtual machines, wherein at least one of the first host machines further includes a private-cloud VM resource provider through which the resource manager interacts with the private-cloud virtual machines, wherein the VM resource provider translates requests to perform virtual machine operations from a public-cloud-resource interface to a private-cloud virtual machine interface, and the private-cloud virtual machines perform the requested virtual machine operations in response to receiving the translated requests from the VM resource provider.