Authentication to network-services using hosted authentication information

Description

BACKGROUND

Computing devices can utilize communication networks to exchange data. Companies and organizations operate computer networks that interconnect a number of computing devices to support operations or to provide services to third parties. The computing systems can be located in a single geographic location or located in multiple, distinct geographic locations (e.g., interconnected via private or public communication networks). Specifically, data centers or data processing centers, herein generally referred to as a “data center,” may include a number of interconnected computing systems to provide computing resources to users of the data center. The data centers may be private data centers operated on behalf of an organization or public data centers operated on behalf, or for the benefit of, the general public.

To facilitate increased utilization of data center resources, virtualization technologies allow a single physical computing device to host one or more instances of virtual machines that appear and operate as independent computing devices to users of a data center. With virtualization, the single physical computing device can create, maintain, delete, or otherwise manage virtual machines in a dynamic manner. In turn, users can request computer resources from a data center, including single computing devices or a configuration of networked computing devices, and be provided with varying numbers of virtual machine resources.

Virtualization technologies and data centers enable a variety of new techniques for providing network-based services. One such technique is “micro-services,” in which desired functionality is not simply housed within a single device providing a service, but distributed among a variety of smaller, fine-grained services (each a “micro-service”). Micro-services may be independently developed, maintained, managed, and scaled, providing higher flexibility and resiliency to “macro-services” built using the micro-services. A difficulty that arises in the use of micro-services is the need for such services to securely intercommunicate. Often, different micro-services are implemented on different platforms or hosts, and subject to different security constraints. Moreover, different micro-services may scale independently of one another. Independent scaling may be beneficial to the micro-service itself, but cause difficulties in integrating different micro-services. For example, a first micro-service may scale to a point where its communications to another micro-service overwhelm the resources of that other micro-service

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram depicting an illustrative logical flow of communications between network services and a database, as facilitated by a connection pool;

FIG. 2 is a block diagram depicting an illustrative environment in which a connection manager service may provide a connection pool to network-based services facilitating secure communications with another network-based service;

FIG. 3 depicts a general architecture of a computing device providing the connection manager service 150 of FIG. 1;

FIG. 4 is a flow diagram depicting illustrative interactions for configuring the connection manager service 150 of FIG. 1 to provide a connection pool for a first network-based service, and for configuring a second network-based service to communicate with the first service via the connection pool;

FIG. 5 is a flow diagram depicting illustrative interactions for securely initiating connections between a connection pool provided by the connection manager service 150 of FIG. 1 and a network-based service to which the pool provides access;

FIGS. 6A and 6B are flow diagrams depicting illustrative interactions for initiating a connection between the connection manager service 150 of FIG. 1 and a network-based service attempting to utilize a connection pool provided by the connection manager service 150;

FIG. 7 is a flow diagram depicting illustrative interactions for securely communicating between a first and second network-based service utilizing a connection pool provided by the connection manager service 150 of FIG. 1;

FIG. 8 is a flow chart depicting an illustrative routine for providing connection pools to connection-limited network services;

FIG. 9 is a flow chart depicting an illustrative routine for initiating connections between serverless code executions and target network services; and

FIG. 10 is a flow chart depicting an illustrative routine for providing authentication to hosted services instances.

DETAILED DESCRIPTION

Generally described, aspects of the present disclosure relate to facilitating secure, scalable connections between network-based services (such as micro-services) by utilizing an intermediary connection pool provided by a connection management service. As disclosed herein, the connection pool may enable connections to the services on each “side” of the pool to be scaled independently, such that scaling of one service does not overwhelm another service. The connection pool may further provide for traversal of disparate networks hosting respective services, such that services can interact with one another via the pool as if they existed within a common network. Still further, the connection pool may provide a robust security model, by decoupling authentication between two services such that the services can authenticate with one another without requiring each service be provided with authentication information of the other service.

As an illustrative example, consider an instance in which a user stores information in a network-accessible database. The database may provide a limited number of connections, such that if attempts by other services to access the database exceed that number, no connection to the database is possible. Further, consider that the user may configure a second, highly-scalable service to access and utilize information from the database. For example, the second service may be implemented through an on-demand code execution system (sometimes referred to as a “serverless” system), which functions to execute user-defined code on an on-demand basis. If each execution of the user-defined code attempts to access the database, then instances of the second service can be expected to fail if executions of the user-defined code exceed the maximum number of connections provided by the database.

Connection pools provide a solution to this problem, by acting as a “middle man” between network services. For example, where a database has capacity for n connections, a connection pool may initiate n (or less than n) connections to the database. Others services can connect to the connection pool, and submit queries the pool for further submission to the database. In this manner, connections to the database can be expected not to exceed capacity of the database. Moreover, connections pools can provide a type of “oversubscription,” such that more than n instances of a service can communicate with the database. For example, many database protocols are multi-phase, requiring a service to first open a connection to the database and later use the connection to interact with the database. Thus, a connection between a service and a database can limit other connections to the database, regardless of whether the connection is actively being used. A connection pool can address this issue, by reusing a given connection to a database for multiple accessing services, as required based on activity of the service. For example, each service may initiate a connection to the connection pool independently of the database. As queries are submitted to the connection pool, the pool may select an unused connection to the database, and submit the query to the database over that connection. So long as the number of active connections required by services does not exceed the number of possible connections to the database, the number of services connected to the pool (and thus, “connected” to the database from the point of view of the service) can scale nearly limitlessly.

One example of a logical flow of communications between network services and a database, as facilitated by a connection pool, is shown in FIG. 1. Specifically, in FIG. 1, a number of network services 10-30 are shown, each of which functions based on a connection 60 to a database 50. A volume of connections 60 of each service 10-30 is shown as a relative width of the connections 60, with the sum of the volumes of connections 60A-C exceeding a volume of connection 60D. Thus, while the database 50 may support a limited number of connections 60D, the connection pool 40 enables the connections 60A-C of the services 10-30 to exceed that limited number. This configuration is particularly desirable in instances where services 10-30 are configured to scale independently of the database 50.

One option in creating a connection pool 40 would be to manually configure a connection pool 40 for each database 50 (or other resource-limited service). For example, where the services 10-30 and database 50 are implemented in a hosted computing environment (sometimes referred to as a “cloud” computing environment), a user of that environment may also implement a connection pool 40, such as by provisioning a virtual machine instance with software providing the connection pool 40. However, user creation of connection pool 40 imposes significant disadvantages. For example, hosted computing environments often provide isolated networks to various services. Illustratively, a hosted computing environment may enable a user to configure a “virtual private network environment” or “virtual private cloud” (“VPC”) such that computing devices included within the network are able to communicate with one another as if they were connected via a physical local area network (LAN). The database 50 of FIG. 1 may be included within such a VPC. If the network services 10-30 are not located within the VPC, use of a connection pool 40 would require that a user “pierce” the VPC boundary, enabling either the services 10-30 or the connection pool 40 to access the VPC.

Moreover, a user-configured connection pool 40 may generally require that the user handle authentication between the services 10-30, the connection pool 40, and the database 50. Illustratively, network services 10-30 may be required to store authentication information for the pool 40, and the pool 40 may be required to store authentication information for the database 50. This may lead to complex, duplicative, and potentially insecure storage of authentication information. For example, where a network service 10 is implemented as user-defined code executing on an on-demand code execution system, storing authentication information in the service 10 may require “hard-coding” a username and password for the service into the user-defined code, which is not generally considered a best practice for security. Moreover, this storage may be duplicative, as the services 10-30 themselves may already be authenticated in some manner. For example, where the services 10-30 are implemented within a hosted computing environment, the services 10-30 can be expected to be authenticated to the hosted computing environment by virtue of their being hosted in that environment. It would be desirable for the services 10-30 to utilize this existing authentication to authenticate to the pool 40, rather than requiring manual storage of additional authentication information.

Still further, manual user configuration of a connection pool 40 may require reconfiguration of network services 10-30 that utilize the pool. For example, a user may be required to modify each service 10-30 to direct requests to the pool 40, such as by modifying user-defined code for the service. Should changes to the pool 40 occur (such as scaling of the pool 40, relocation of the pool 40, etc.), the user may be required to modify each service 10-30 to reflect these changes.

The above-noted problems are addressed in embodiments of the present disclosure, at least partly by use of a connection manager service 150 configured to provide connection pools for hosted services (such as databases). The connection manager service 150 as disclosed herein can be tightly integrated with a hosted computing environment 110 hosting both source services accessing a connection pool and target services accessed by a connection pool. Due at least partly to this integration, the connection manager service 150 can address the problems described above, by enabling secure traversal of isolated networks of the environment, enabling reuse of existing authentication information for hosted services (thus negating a need to separately store authentication information at each service), and enabling programmatic reconfiguration of source services as modifications to the connection pool are made.

While embodiments of the present disclosure are discussed with respect to specific connection-limited services, such as database services, embodiments of the present disclosure can be used to provide connection pooling to any connection-limited network service. Moreover, techniques described herein may be applied to managing communications between a variety of network-based services, and in some cases may be applied outside of the context of connection pooling.

The foregoing aspects and many of the attendant advantages of this disclosure will become more readily appreciated as the same become better understood by reference to the following description, when taken in conjunction with the accompanying drawings.

FIG. 2 is a block diagram of an illustrative operating environment 100 in which client devices 102 may interact with a hosted computing environment 110 via a network 104. By way of illustration, various example client devices 102 are shown in communication with the hosted computing environment 110, including a desktop computer, laptop, and a mobile phone. In general, the client devices 102 can be any computing device such as a desktop, laptop or tablet computer, personal computer, wearable computer, server, personal digital assistant (PDA), hybrid PDA/mobile phone, mobile phone, electronic book reader, set-top box, voice command device, camera, digital media player, and the like. The hosted computing environment 110 may provide the client devices 102 with one or more user interfaces, command-line interfaces (CLIs), application programming interfaces (APIs), and/or other programmatic interfaces for utilizing services provided by the hosted computing environment 110, including virtual private environments 120, an on-demand code execution system 130, an authentication service 140, and a secrets manager service 160. Although one or more embodiments may be described herein as using a user interface, it should be appreciated that such embodiments may, additionally or alternatively, use any CLIs, APIs, or other programmatic interfaces. Moreover, while end users may operate client devices 102, client devices 102 may also include non-end-user devices, such as servers, or other devices that access respective services provided by the hosted computing environment 110.

The client devices 102 and hosted computing environment 110 may communicate via a network 104, which may include any wired network, wireless network, or combination thereof. For example, the network 104 may be a personal area network, local area network, wide area network, over-the-air broadcast network (e.g., for radio or television), cable network, satellite network, cellular telephone network, or combination thereof. As a further example, the network 104 may be a publicly accessible network of linked networks, possibly operated by various distinct parties, such as the Internet. In some embodiments, the network 104 may be a private or semi-private network, such as a corporate or university intranet. The network 104 may include one or more wireless networks, such as a Global System for Mobile Communications (GSM) network, a Code Division Multiple Access (CDMA) network, a Long Term Evolution (LTE) network, or any other type of wireless network. The network 104 can use protocols and components for communicating via the Internet or any of the other aforementioned types of networks. For example, the protocols used by the network 104 may include Hypertext Transfer Protocol (HTTP), HTTP Secure (HTTPS), Message Queue Telemetry Transport (MQTT), Constrained Application Protocol (CoAP), and the like. Protocols and components for communicating via the Internet or any of the other aforementioned types of communication networks are well known to those skilled in the art and, thus, are not described in more detail herein.

The hosted computing environment 110 is depicted in FIG. 2 as operating in a distributed computing environment including several computer systems that are interconnected using one or more computer networks (not shown in FIG. 2), which systems operate to provide the virtual private environments 120, on-demand code execution system 130, authentication service 130, connection manager service 150, and secrets manager service 160. Illustratively, the environment 110 includes a number of rapidly provisioned and released computing resources configured to provide the virtual private environments 120, on-demand code execution system 130, authentication service 130, connection manager service 150, and secrets manager service 160. The hosted computing environment 110 may also be referred to as a “cloud computing environment.” Each of the virtual private environments 120, on-demand code execution system 130, authentication service 130, connection manager service 150, and secrets manager service 160 could also operate within a computing environment having a fewer or greater number of devices than are illustrated in FIG. 2. Thus, the depiction of the virtual private environments 120, on-demand code execution system 130, authentication service 130, connection manager service 150, and secrets manager service 160 in FIG. 2 should be taken as illustrative and not limiting to the present disclosure. For example, the elements of the environment 110 or various constituents thereof could implement various Web services components and/or peer to peer network configurations to implement at least a portion of the processes described herein. In some instances, two or more of the virtual private environments 120, on-demand code execution system 130, authentication service 130, connection manager service 150, and secrets manager service 160 may be combined into a single service. Each of the virtual private environments 120, on-demand code execution system 130, authentication service 130, connection manager service 150, and secrets manager service 160 may be implemented directly in hardware or software executed by hardware devices and may, for instance, include one or more physical or virtual servers implemented on physical computer hardware configured to execute computer executable instructions for performing various features that will be described herein. The one or more servers may be geographically dispersed or geographically co-located, for instance, in one or more data centers.

Within the hosted computing environment, the virtual private environments 120 represent virtual networking environments that are logically isolated from one another, as well as from other networks. Each environment 120 may include one or more virtual computing devices (e.g., virtual machines or VMs) provided by the environment 110 and configured to operate on behalf of a user, such as to provide a service. For example, an environment 120 of FIG. 2 is depicted as included a database instance 122, which instance 122 can be implemented by a specifically configured virtual computing device hosted within the environment 120 on behalf of a user.

While a database instance 122 is depicted in FIG. 2 as an example of a network-accessible service implemented by a device within a virtual private environment 120, the environments 120 may enable a wide variety of services. For example, the hosted computing environment 110 may enable client devices 102 request, obtain, configure, and manage different types of service instances, each of which represents a computing device (or portion of a computing device) configured to provide a service on behalf of a user. Each service instance may, for example, represent a physical computing device, a virtual computing device, a software container within a computing device, or a thread executing on a computing device. Each service instance may provide a network-accessible service, such as a database service, web hosting service, video transcoding service, or any of a wide variety of known network-accessible services. In one embodiment, a service instance, such as the database instance 122, provides a micro-service on behalf of a user. The hosted computing environment 110 can provide a variety of interfaces through which client devices 102 may configure service instances. For example, the hosted computing environment 110 may enable a client device 102 to specify a hardware configuration of each of their service instances (e.g., processing power, memory, etc.) and a software configuration (e.g., an operating system, applications, etc., which may illustratively be provided in the form of a device image provisioned to a disk drive accessible to an instance). The hosted computing environment 110 may further enable a client device 102 to specify how instances within environments 120 should be created, destroyed, or maintained. For example, a client device 102 may specify that an instance should be created or destroyed at certain times or according to certain conditions specified by a user. A variety of techniques for hosting service instances within hosted computing environments are known in the art and thus the details of operation of the environment 110 to provide and manage service instances will not be discussed herein.

The hosted computing environment 110 is illustratively configured to enable devices within each virtual private environment 120 to interact with one another as if they were connected via a physical LAN. For example, where each device within an environment 120 is a virtual computing device hosted by a physical computing device, the hosted computing environment 110 may use virtual networking techniques to encapsulate traffic from the virtual computing devices, and pass that traffic over a substrate physical network connecting the physical computing devices. On receiving traffic from a first virtual device in an environment 120 over the substrate physical network, a physical device may decapsulate the traffic (e.g., strip away encapsulating headers to return the packet to its original state prior to encapsulation) and pass the traffic to another virtual device in the environment 120. Thus, devices in an environment 120 may communicate as if they connected within a physical LAN, even when geographically distant. A variety of techniques for implementing virtual networks between computing devices are known in the art and thus will not be described in detail herein.

In general, virtual private environments 120 are configured and operate on behalf of an individual user or set of users (e.g., an organization). In addition, the hosted computing environment 110 includes a number of additional services generally accessible by users. For example, the environment 110 includes an on-demand code execution system 130 enabling on-demand execution of user-defined code. The on-demand code execution system 130 may also be referred to as a serverless computing system. Embodiments for providing an on-demand code execution system 130 are provided, for example, in U.S. Pat. No. 9,323,556, entitled “PROGRAMMATIC EVENT DETECTION AND MESSAGE GENERATION FOR REQUESTS TO EXECUTE PROGRAM CODE,” and filed Sep. 30, 2014 (the “'556 patent”), the entirety of which is hereby incorporated by reference. In brief, the on-demand code execution system 130 can enable client devices 102 to submit executable code (e.g., source code) implementing desired functionality, which functionality is generally referred to herein as a “task.” The system 130 can further enable a client device 102 to define one or more triggers that result in execution of the code on the system 130. For example, a client device 102 may request that each time a specific application programming interface (API) call is made, the code should be executed on the system 130. When a trigger occurs, the system 130 can configure an execution environment 132 for the code, which may correspond to a virtual machine instance, a software container, or other logically isolated environment in which code can execute. The system 130 can then execute the code within the environment 132, resulting in a task execution 134. When the task execution 134 completes, the system 130 can remove the environment 132, thus freeing computing resources for other task executions. The system 130 can thus enable a client device 102 to execute user-defined code on the system 130, without requiring the user to handle aspects of execution such as acquiring a computing device, provisioning the device with the code, etc.

In accordance with embodiments of the present disclosure, the execution environment 132 of FIG. 2 are further depicted as including a pooling interface 136. Generally described, the pooling interface 136 can represent code executing within an execution environment 132 and enabling a task execution 134 in that environment to interface with a connection manager service 150 (described in more detail below). In one embodiment, the pooling interface 136 corresponds to code executed within an environment 132 of a task execution 134, which can be interfaced with in a manner similar to the service for which a connection pool is implemented (e.g., the database instance 122). For example, where the database instance 122 is a MYSQL™ database accessed via a transmission control protocol (TCP) server, the pooling interface 136 can act as a proxy for the MYSQL TCP server, by implementing a corresponding TCP server that accepts transmissions in a manner similar or identical to that of the MYSQL TCP server. As will be described in detail below, on receiving a communication from a task execution 134, the pooling interface 136 may encapsulate the transmission with additional information enabling appropriate handling of the transmission on within the environment 110, and submit the encapsulated transmission to the connection manager service 150 for eventual delivery to the database instance 122.

Use of a pooling interface 136 may illustratively simplify generation of tasks by client devices 102, by simplifying code that must be authored by a user. For example, each task execution 134 may result in a corresponding pooling interface 136 being implemented by the system 130, creating a one-to-one correspondence between task execution 134 and pooling interface 136. This correspondence can enable each task execution 134 to locally reference a respective pooling interface 136 for that execution 134, such that the execution 134 need to be programmed to rely on external services to interface with a database instance 122. For example, code of a task may be configured to interact with a database at a “localhost” address, thus giving the appearance (from the point of view of a task execution 134) that a database exists locally. As discussed below, the pooling interface 136 may also facilitate authentication to a connection pool for the instance 122, further simplifying code for a task.

In one embodiment, code implementing the pooling interface 136 is provided by an operator of the on-demand code execution system 130, and may be associated with a task by inclusion of a reference to such code within user-defined code for a task. In this manner, the pooling interface 136 may be considered a “dependency” for a task, such that each task execution 134 results in execution of a corresponding the pooling interface 136. Implementation of task dependencies on an on-demand code execution system is discussed in more detail in U.S. patent application Ser. No. 15/841,143, entitled “DEPENDENCY HANDLING IN AN ON-DEMAND NETWORK CODE EXECUTION SYSTEM,” the entirety of which is incorporated by reference herein.

While execution environments 132 are depicted as within the on-demand code execution system 130, in some instances the system 130 may be configured to create and manage such environments 132 within a virtual private environment 120 (e.g., when executing a task owned by an owner of that environment 120). The environment 120 in which a task is executed may differ from the environment 120 in which a network-accessible service accessed by the task is hosted.

To facilitate interaction with the hosted computing environment 110, the environment 110 further includes an authentication service 140 enabling client devices 102 to authenticate to services within the environment 110, such as to create virtual private environments 120 or devices within the environments 120, to create or trigger tasks on the on-demand code execution system 130, and the like. Authentication services 140 are known in the art, and thus operation of the service 140 will not be described in detail herein. However, in brief, a client device 102 may authenticate to the service 140 using a set of authentication information (e.g., a username and password), and the authentication service 140 may return other authentication information, such as an authentication token, to the client 102. The authentication token may then be provided from the client device 102 to other devices to authenticate the client device 102 to the other devices (which devices may verify the token by, for example, passing the token to the service 140 for verification). Services implemented on behalf of a client device 102, such as a database instance 122 or task execution 134 may be authenticated with the authentication service 140 on initiation within the environment 110. For example, a task execution 134 occurring at the request of the client device 102 may be provided, on initialization, with an authentication token identifying the task execution 134 as executing on behalf of the client device 102.

In accordance with embodiments of the present disclosure, the hosted computing environment 110 further includes a connection manager service 150 configured to provide connection pools to services on the environment 110, such as a database service provided by the database instance 122. Each connection pool is provided by one or more connection proxies 154, each of which illustratively represents a computing device configured to receive network traffic on behalf of a network service (e.g., the database instance 122) and to transmit the traffic to the network service over a fixed number of connections to the service. In one embodiment, connection proxies 154 may each be “single-tenanted” and configured to provide a connection pool to a single network service. In another embodiment, connection proxies may be “multi-tenanted” and configured to provide connection pools for multiple services. In some cases, single tenanted proxies 154 may be preferable for their increased security. For example, a proxy 154 providing a connection pool for the database instance 122 may be configured to interact with the instance 122 as if the proxy 154 were part of the virtual private environment 120. Single-tenancy may help to ensure that only appropriate traffic is routed to that environment 120 (which may occur, for example, if a multi-tenanted proxy 154 transmitted traffic to the incorrect environment 120, such as due to misconfiguration or malicious traffic).

To assist in routing traffic to the connection proxies 154, the connection manager service 150 further includes a connection router 156 implementing a “routing layer” for the service 150. The connection router 156 illustratively acts as a known endpoint for services to attempt to communicate with a connection proxy 154. On receiving traffic relate to a specific connection pool, the connection router 156 can identify one or more proxies 154 providing the pool and pass the traffic to the proxies 154. In some instances, the connection router 156 may authenticate traffic before passing the traffic to a proxy 154.

Still further, the connection manager service 150 includes a configuration interface 152. The interface 152 may provide a “control plane” for the connection manager service 150, enabling client devices 102 to create, configure, and delete connection pools for services. For example, the interface 152 may enable a client device 102 to create a connection pool for the database instance 122, and to specify to the connection manager service 150 configuration information for the pool, such as an identifier of the instance 122, authentication information to be used to access the instance 122, and a number of maximum connections to the instance 122.

As shown in FIG. 1, the hosted computing environment 110 further includes a secrets manager service 160, configured to securely store confidential information, such as authentication information. Illustratively, the secrets manager service 160 may provide a centralized location for a user to store sensitive information, such that any changes to that information (e.g., rotating a password), auditing of information, and the like need only occur at a single location.

In accordance with embodiments of the present disclosure, the secrets manager service 160 may be configured by a client device 102 to store authentication information for a service associated with a connection pool, such as the database instance 122. Connection proxies 154 can be configured to securely interact with the secrets manager service 160 to obtain the authentication information prior to connecting to the database instance 122, and to append that authentication information to traffic received at a connection pool as appropriate to enable the traffic to interact with the instance 122. Thus, use of connection proxies 154 and secretes manager service 160 can enable other services, such as task executions 134, to access the database instance 122 without requiring the services to themselves store authentication information for the database instance 122. In one embodiment, services, such as task executions 134, authenticate to the connection manager service 150 based on authentication information passed to the service at a time of initialization. For example, when a task execution 134 is triggered on behalf of a client device 102, an authentication token can be passed to the execution 134, which the execution 134 can use to authenticate with the connection manager service 150. The service 150, in turn, can retrieve authentication information for the database instance 122 from the secrets manager service 160 and use that authentication information to enable communications between the task execution 134 and the database instance 122. The task execution 134 therefore need not store the authentication information, increasing security of the database instance 122.

FIG. 3 depicts a general architecture of a computing system (a connection manager server 200) implementing the connection manager service 150 of FIG. 12 The general architecture of the server 200 depicted in FIG. 3 includes an arrangement of computer hardware and software that may be used to implement aspects of the present disclosure. The hardware may be implemented on physical electronic devices, as discussed in greater detail below. The server 200 may include many more (or fewer) elements than those shown in FIG. 3. It is not necessary, however, that all of these generally conventional elements be shown in order to provide an enabling disclosure. Additionally, the general architecture illustrated in FIG. 3 may be used to implement one or more of the other components illustrated in FIG. 2.

As illustrated, the server 200 includes a processing unit 290, a network interface 292, a computer readable medium drive 294, and an input/output device interface 296, all of which may communicate with one another by way of a communication bus. The network interface 292 may provide connectivity to one or more networks or computing systems. The processing unit 290 may thus receive information and instructions from other computing systems or services via the network 104. The processing unit 290 may also communicate to and from primary memory 280 and/or secondary memory 298 and further provide output information for an optional display (not shown) via the input/output device interface 296. The input/output device interface 296 may also accept input from an optional input device (not shown).

The primary memory 280 and/or secondary memory 298 may contain computer program instructions (grouped as units in some embodiments) that the processing unit 290 executes in order to implement one or more aspects of the present disclosure. These program instructions are shown in FIG. 3 as included within the primary memory 280, but may additionally or alternatively be stored within secondary memory 298. The primary memory 280 and secondary memory 298 correspond to one or more tiers of memory devices, including (but not limited to) RAM, 3D)(POINT memory, flash memory, magnetic storage, and the like. The primary memory 280 is assumed for the purposes of description to represent a main working memory of the server 200, with a higher speed but lower total capacity than secondary memory 298.

The primary memory 280 may store an operating system 284 that provides computer program instructions for use by the processing unit 290 in the general administration and operation of the server 200. The memory 280 may further include computer program instructions and other information for implementing aspects of the present disclosure. For example, in one embodiment, the memory 280 includes a user interface unit 282 that generates user interfaces (and/or instructions therefor) for display upon a computing device, e.g., via a navigation and/or browsing interface such as a browser or application installed on the computing device.

In addition to and/or in combination with the user interface unit 282, the memory 280 may include a configuration interface unit 286, a connection proxy unit 288, and a connection router unit 289, each of which represents code executable to implement a configuration interface 152, connection proxy 154, and connection router 156 of FIG. 3, respectively.

The server 200 of FIG. 3 is one illustrative configuration of such a device, of which others are possible. For example, while shown as a single device, a server 200 may in some embodiments be implemented as multiple physical host devices. In other embodiments, the server 200 may be implemented as one or more virtual devices executing on a physical computing device. While described in FIG. 3 as a server 200, similar components may be utilized in some embodiments to implement other devices shown in the environment 100 of FIG. 3.

With reference to FIG. 4, illustrative interactions will be described for configuring the connection manager service 150 to provide a connection pool for a connection-limited service, such as the database instance 122. The interactions begin at (1), where a client device 102 submits to the configuration manager 152 a request to creation a connection pool for the instance 122. The request may include information pertaining to how the connection pool interacts with the instance 122. For example, the request may include a maximum number of connections to the instance 122 and an identifier of a secret (e.g., as stored on the secrets manager service 160) to use to access the instance 122. In addition, the request may specify how other devices may access the connection pool. For example, the request may specify permissions for the connection pool, such as an account, identity, or “role” (also referred to herein as an “authentication role”) with permissions to access the connection pool. In some instances, the request may further specify information relating to a format of communications flowing through the connection pool, such as a wire protocol used by the database instance 122. Illustratively, knowledge of the wire protocol used by the database instance 122 may enable the connection manager service 150 to more accurately detect a state of a connection flowing through the pool (e.g., as active or idle). For example, specific wire protocols (such as commonly used database wire protocols) may include commands indicative of an active (or idle) connection, and thus the connection manager service 150 may be configured to inspect communications across the connection pool to determine whether a connection between a source device (e.g., a service requesting access to the connection pool) and the database instance 122 is active or idle.

On receiving the request, the connection manager service 150, at (2), generates one or more connection proxies 154, which operate to provide the connection pool. Illustratively, the connection manager 150 may generate a virtual computing instance and provision the instance with software enabling the instance to accept connections from source devices and pass queries (or other data) received from source devices to the database instance 122 in accordance with embodiments of the present disclosure. In one embodiment, the connection proxies 154 are generated by the service 150 such that they are enabled to communicate with the instance 122. For example, the service 150 may include the proxies 154 in the virtual private environment 120 of the instance 122 or otherwise modify the environment 120 to enable communications from the proxies to reach the instance 122.

At (3), the configuration interface 152 returns to the client device 102 an identifier for the connection pool, which identifier may thereafter be used by source services to access the database instance 122 via the connection pool. In one embodiment, the identifier is a globally or universally unique identifier (a “GUID” or “UUID”). In another embodiment, the identifier is unique to an account of the client device 102 on the hosted computing environment 110, and a combination of an account identifier of the account and the identifier of the connection pool form a globally unique identifier.

While the client device 102 may thereafter configure any number of (appropriately authenticated) services to access the instance 122, connection pooling may be particularly beneficial in rapidly scalable and/or transient source services, such as services provided by task executions 134 on the on-demand code execution system 130. Thus, FIG. 4 depicts interactions enabling such a task execution 134 to access the database instance 122 through the connection pool provided by the service 150.

Specifically, at (4), the client device 102 interacts with the on-demand code execution system 130 to configure a task (e.g., the code that when executed results in task execution 134) with the identifier of the connection pool, as well as specifying an account, identifier, or role for the task that enables the task to connect to the connection pool. The identifier and role information may be stored as metadata associated with the task, rather than within user-defined code for the task. Thus, modification of a connection pool identifier and/or role may not require modification of the user-defined code. When executing a task, the system 130 may, in addition to executing the user-defined code as a task execution 134, implement a pooling interface 136 within an environment 132 of the task, and configure the pooling interface 136 to include an identifier of the task. The pooling interface 136 may be provided with authentication information for the user-specified role, such that the interface 136 can provide the authentication information to the service 150 to authenticate itself. Thereafter, the pooling interface 136 may operate to receive communications from the task execution 134, and to submit them to the service 150 in an authenticated manner that also identifies the connection pool.

For example, as will be described in more detail below with respect to FIG. 6A, the pooling interface 136 may represent a TCP server that receives network transmissions from the task execution 134 according to a wire protocol also used by the database instance 122. On receiving such a transmission, the interface 136 may encapsulate the transmission with additional information, such as authentication information and an identifier of the connection pool, and transmit the encapsulated transmission to the connection service 150 (e.g., to a router 156). The service 150 may utilize the additional information to authenticate the transmission, and to route the request to an appropriate connection proxy 154. The proxy 154 may then decapsulate the transmission and pass the transmission to the database instance 122. Thus, from the perspective of the user-defined code executing as the task execution 134, database queries may be submitted to a local endpoint (the interface 136), without requiring authentication and without apparent reliance on external services. This model therefore greatly simplifies creation of tasks, and enables high scalability of tasks on the system 130.

With reference to FIG. 5, illustrative interactions will be described securely initiating connections between a connection pool provided by the connection manager service 150 of FIG. 1 and a network-based service to which the pool provides access (e.g., the database instance 122). As discussed above, a connection pool implemented by connection proxies 154 may facilitate interaction with the database instance 122 by enabling source devices to submit queries to the pool, which are then passed to the instance 122 via an idle connection between the pool and the instance 122. Thus, the interactions of FIG. 5 can enable a connection proxy 154 to create a secure connection to the instance 122. In one embodiment, the interactions of FIG. 5 occur at initialization of the connection pool. For example, where the pool is configured to provide n connections to the instance 122, the proxies 154 providing the pool may establish those connections on initialization, such that subsequent attempts to transmit information to the instance 122 can utilize the pre-established connections. In another embodiment, the interactions of FIG. 5 occur on an as-needed basis. For example, the proxies 154 of a pool may establish a connection to the instance 122 when there is no existing idle connection to the instance 122. In some embodiments, the interactions of FIG. 5 may occur both on initialization of a proxy 154 and on an as-needed basis. For example, a pool may be configured with both a minimum and maximum number of connections to a service, such as the database instance 122. On initialization, a proxy 154 hosting a pool may undertake the interactions of FIG. 5 in order to establish the specified minimum number of connections for the pool. Thereafter, the proxy 154 may repeat the interactions of FIG. 5 on an as-needed basis, until the maximum number of connections is reached.

For the purposes of description, it will be assumed that the database instance 122, like many network-accessible services, requires clients to authenticate with the instance 122 prior to establishing a connection. Rather than storing authentication information for the instance 122 at the service 150, a user may elect to store such information in a secure, centralized location, like that provided by the secrets manager service 160. Thus, prior to establishing a connection to the instance 122, the proxies 154 providing a pool can interact with the secrets manager service 160 to obtain authentication information for the instance 122.

Specifically, at (1), the proxies 154 request the authentication information from the secrets manager service 160. At (2), the service 160 authenticates the requesting proxies 154. In one embodiment, the service 160 may authenticate the proxies 154 based on an authentication token provided to the proxies 154 on initialization. For example, when creating a connection pool, a client device 102 may specify an identity or “role” to be assumed by devices providing the pool. On initialization, proxies 154 may be provided with authentication information (e.g., a token) identifying their use of that role, which information may be passed to the secrets manager service 160. The service 160 may then authenticate the proxies 154 using the provided information (e.g., by passing the token to the authentication service 140 and requesting verification of the token). After authentication, the service 160, at (3), returns to the proxies 154 the authentication information for the database instance 122 (e.g., a username and password).

Thereafter, at (4), the proxies 154 utilize the authentication information for the database instance 122 to request a connection to the instance. Illustratively, the connection may be a MySQL protocol connection. The database instance 122 then, at (5), returns the connection information to the proxies 154, thus establishing a connection between the instance 122 and the one or more proxies 154 providing a connection pool for the instance 122. The connection may illustratively be encrypted to secure communications between the proxies 154 and the instance 122. For example, the connection may utilize transport layer security (TLS) (or its predecessor, secure sockets layer (SSL)). Moreover, the connection may logically occur within a virtualize network of the virtual private environment 120, further securing the connection.

While shown as two interactions in FIG. 5, various protocols may require additional interactions between the proxies 154 and the instance 122 to establish a connection. For example, particular wire protocols may define a multi-step “handshake” enabling the proxies 154 and instance 122 to exchange information for the connection. As will be described below, the connection between proxies 154 and the instance 122 may thereafter be used to pass queries from source services, such as task executions 154 to the instance 122. Notably, because authentication between the proxies 154 and instance 122 occurs independently of source services, the proxies 154 can also be viewed as “authentication proxies” for source services, allowing those services to utilize other authentication information (such as information gained by virtue of creation of the service on the hosted computing environment 110) to access the connection pool, while utilizing database-specific authentication information (e.g., from the secrets manager service 160) to connect to the instance 122.

FIGS. 6A and 6B are flow diagrams depicting illustrative interactions for initiating a connection between the connection manager service 150 and a network-based service, such as the task execution 134 on the on-demand code execution system 130, attempting to utilize a connection pool provided by the connection manager service 150.

The interactions of FIG. 6A begin at (1), where the system 130 initiates the task execution 134. As discussed above, the task execution 134 generally represents execution of user-defined code, and can be triggered based on a variety of criteria monitored by the system 130. For example, the system 130 may initiate the task execution 134 based on a call received from a client device 102. In addition to initiating the task execution 134, the system 130 also initiates the pooling interface 136. In one embodiment, the system 130 initiates the pooling interface 136 based on a reference to the interface 136 within code of the task. For example, the user-defined task code (or metadata for the task) may contain an “include” statement referring to code of the pooling interface 136, thus causing the system 130 to execute the interface 136 along with the task. In one embodiment, the pooling interface 136 is executed in a common execution environment as the task, thus enabling the task to utilize a relative network identifier for the pooling interface 136, such as the “localhost” identifier. In another embodiment, the pooling interface 136 is executed in a separate execution environment. For example, the pooling interface 136 may be implemented as a “sidecar VM instance” as disclosed in U.S. patent application Ser. No. 16/017,970, entitled “EXECUTION OF AUXILIARY FUNCTIONS IN AN ON-DEMAND NETWORK CODE EXECUTION SYSTEM,” the entirety of which is hereby incorporated by reference.

At (2), the task execution 134 transmits to the pooling interface 136 a request to connect to the database 122. In one embodiment, because the task execution 134 utilizes the pooling interface 136 rather than attempting to directly connect to the database 122, the task execution 134 need not specifically identify the database 122 within the request. Moreover, because the connection manager service 150 is configured to authenticate calls to the database based on authentication information provided by the on-demand code execution system 130 in initiating the task execution 134, the task execution 134 need not specify authentication information for the database within the request. As such, the format of the request is greatly simplified. For example, where the task execution 134 represents executing Python code (e.g., formatted according to the Python 2.6 standard) and the database 122 is a MySQL database, the code may include a statement such as ‘mydatabase=mysql.connector.connect(host=“localhost”, user=“ ”, passwd=“ ”)’, where ‘mydatabase’ is a handle to the connection, “mysql.connector” is a MySQL-provided class containing functions related to MySQL databases, and the “connect” function is a function attempting to initiate a connection to a MySQL database, which function is passed a “host” variable identifying “localhost” as a location of the database, and “user” and “passwd” variables specifying no authentication information for the database. The request is illustratively transmitted via the TCP protocol to a TCP server implemented by the pooling interface 136.

While embodiments of the present disclosure may remove a need to specify an identifier of a connection pool within the request of interaction (2), in some instances it may be beneficial to enable that identifier to be specified by a task execution 134. For example, the on-demand code execution system 130 may enable a task to be associated with multiple network-accessible, connection-limited services, each accessible via a distinct connection pool. The system 130 may further provide a pooling interface 136 for each such pool. To facilitate distinguishing between interfaces 136 for the respective pools, the on-demand code execution system 130 may provide an API enabling resolution of an identifier of a given connection pool into access information for an interface 136 of the pool. For example, the system 130 may provide a function to a task such as “getPoolAddress” which takes as a parameter a pool identifier, and which when invoked returns a network address and port number of the interface 136 for that pool. Thus, a task may call the getPoolAddress function to obtain an address and port number for a given pool, and insert that address and port into the “host” field of a connect function (or similar database function) in order to request a database connection from the pooling interface 136. Notably, connecting to a service in this embodiment may require only specification of an identifier of the service within code of the task, without requiring, for example, authentication information of the service or knowledge of a network location at which the service is implemented to be hard-coded within task code.

On receiving the request, at (3), the pooling interface 136 adds to the request additional information to be utilized by the connection manager service 150 in routing and processing the request. Specifically, the service 150 adds information specifying at least an identifier for the connection pool of the database instance 122 and authentication information to be used by the service 150 to authenticate the request. Both of the above-noted items of information may be supplied to the pooling interface 136 by the system 130, such as on initialization of the interface 136. For example, as discussed above, a client device 102 may configure a task with metadata specifying a role of the task and an identifier of a connection pool for the database instance 122. Thus, on initiating the task execution 134, the system 130 may pass the identifier and an authentication token (or other authentication information) to the interface 136. In one embodiment, the pooling interface 136 adds the above-noted information by use of network encapsulation techniques, by encapsulating the original request (e.g., in the form of a TCP packet) with an additional header specifying the above-noted information. Use of encapsulation may beneficially reduce or eliminate the need to modify the packet as transmitted by the task execution 134.

At (4), the pooling interface 136 forwards the encapsulated request to the connection router 156. As noted above, the router 156 can generally function to authenticate transmissions from pooling interfaces 136, and to route those transmission to a connection proxy 154 providing a connection pool for a service, such as the database instance 122.

Accordingly, at (5), the connection router 156 requests from the authentication service 140 authentication of the pooling interface 136 based on the authentication information provided by the interface 136 within the request. For example, the connection router 156 may submit to the authentication service 140 a request to validate an authentication token provided by the pooling interface 136. The authentication service 140, at (6), evaluates the authentication information and returns an authentication result to the connection router 156. Illustratively, the authentication service 140 may verify or determine a role associated with the authentication token, and notify the connection router 156 that the interface 136 is authenticated as that role.

In addition, the router 156, at (7), verifies that the role to which the interface 136 has been authenticated has permissions to access the connection pool identified within the request (e.g., based on permissions for the pool specified by a client device 102). Should authentication of verification of permissions fail, the router 156 can notify the interface 136 of the failure, which may for example generate an error within a log of the task execution 134. However, for the purposes of description of FIGS. 6A-B, it will be assumed that the authentication result indicates successful authentication of the pooling interface 136, and that the router 156 verifies that the role of the interface 136 has appropriate permissions to access the connection pool for the database instance 122.

The interactions of FIG. 6A are continued in FIG. 6B, where, at (8), the connection router 156 identifies a connection proxy 154 providing a connection pool for the database instance 122. In one embodiment, the connection router 156 may maintain a mapping of identifiers to proxies 154, such as in a data store of the connection manager service 150. In cases where the pool is provided by multiple proxies 154, the router may in some embodiments select between the proxies 154 based on load balancing criteria. In another embodiment, the connection router 156 may utilize the domain name system (DNS) to identify the connection proxy 154. For example, each connection proxy 154 providing a given pool may register with a DNS server (not shown in FIG. 6B) to associate an address of the proxy 154 to a domain name corresponding to an identifier of the connection pool (e.g., “poolID.connectionmanagerservice.hostedenvironment.tld”). The router 156, on receiving a request, may thus generate the domain name based on the identifier, and interact with a DNS server to resolve the domain name into a network address of a proxy 154 providing the identified connection pool. The DNS server may, instances where a pool is provided by multiple proxies 154, conduct DNS-based load balancing, such as by resolving a domain name of the connection pool into an address of one or more proxies 154 selected based on their load.

On identifying a proxy 154 providing the identified connection pool, the router 156 initializes a connection with the proxy 154, at (9). The proxy 154, in turn, responses to the router 156 indicating a successful connection. The router 156 thus indicates a successful connection to the interface 136, which indicates a successful connection to the task execution 134. In one embodiment, each of the connections between the respective task execution 134, interface 136, router 156 and proxy 154 is an encrypted connection, such as a TLS-compliant TCP connection. In some instances, additional interactions, such as multi-phase handshake, may occur between these components during establishment of a connection.

While FIGS. 6A and 6B are described with respect to specific mechanisms of augmenting a request for a network service at a pooling interface 136, embodiments of the present disclosure may be utilized to augment service requests (e.g., requests for operations) with a variety of information. For example, in addition to authentication information, requests may be augmented with a variety of types of state information for a task execution 134, which may vary during a task execution or across executions. Such state information may include, e.g., permissions information for a task execution (e.g., network resources to which the execution has access permissions), a current real (e.g., “wall clock”) time as maintained at the execution, a running time of the execution, a network location of the execution, etc. In addition to an identifier of a connection pool, requests may additionally or alternatively be augmented with a variety of types of metadata, any of which may be specified by an owner of a task during configuration of the task on the system 130. By augmenting requests with state information and/or metadata, the need to hard-code such information into code of the task is reduced or eliminated. Moreover, by utilizing a pooling interface 136 to augment requests, such as via encapsulation, the code of the task may remain compatible with existing libraries or code packages not necessarily intended for use in the system 130 (e.g., code or libraries that expect a particular wire protocol, which may be intended for use within a local network, use outside a connection manager service 150 or on-demand code execution system 130, etc.). Thus, portability of code is increased relative to conventional techniques.

FIG. 7 is a flow diagram depicting illustrative interactions for securely communicating between a first and second network-based service (e.g., the system 130 hosting the task execution 134 and the database instance 122) utilizing a connection pool provided by the connection manager service 150 of FIG. 1. The interactions of FIG. 7 are assumed for purposes of discussion to occur subsequent to connections being established between the elements of FIG. 7 (e.g., the execution 134 and the interface 136, the interface and the router 156, etc.). Thus, at (1), the task execution 134 submits a database query to the pooling interface 136 via the connection. Submission of the query may correspond for example, to execution of a statement in code such as ‘mydatabase.cursor( ).execute(“SHOW TABLES”)’, where “mydatabase” is a handle to a MySQL database connection, “cursor( )” is a function that returns a “MySQLCursor” class object that executes operations against a database, and “execute” is a function that instructs to execute the operation passed to that function (e.g., “SHOW TABLES,” an SQL command to list tables in a database). While FIG. 7 is discussed with respect to queries, a task execution 134 may execute any number of operations against a database.

At (2), on receiving the request from the task execution 134, the pooling interface 136 adds to the query an identifier of the connection pool for the database 122 and authentication information of the task execution 134. As noted above, both of the above-noted items of information may be supplied to the pooling interface 136 by the system 130, such as on initialization of the interface 136. In the embodiment shown in FIG. 7, the interface 136 adds the information by encapsulating the query (e.g., as received in the form of a TCP packet) with a new header specifying the information.

At (3), the interface 136 transmits the encapsulated query to the connection router 156, which at (4) forwards the query to the proxy 154 identified as providing the connection pool identified within the request (e.g., identified according to the interactions of FIGS. 6A and 6B, discussed above).

At (5), the proxy 154 validates the query, by confirming that the pool identified within the encapsulated query matches a pool provided by the proxy 154. In some embodiments, validation at the proxy 154 may be omitted, as the router 156 is expected to pass queries only to a proxy 154 providing a connection pool identified within a request. However, additional verification at the proxy 154 may increase security of the service 150. In instances where no validation occurs at the proxy 154, the router 156 may decapsulate the query and transmit the query to the proxy 154 in decapsulated form.

At (6), the proxy 154 decapsulates the query (if necessary), and transmits the query to the instance 122 via an existing connection to the instance 122. (In the case that no existing connection to the instance 122 is in an idle state, the proxy 154 may initiate a new connection to the database, such as by the interactions of FIG. 5, discussed above.) As noted above, by using an existing connection to the instance 122, a set of connections to the instance 122 may be “oversubscribed,” enabling more services (e.g., task executions 134) to maintain (from their point of view) connections to the instance 122 than the instance 122 would be able to support without use of a connection pool.

At (7), the instance 122 executes the query to generate a response, which is returned to the proxy 154. The proxy 154, in turn, returns the response to the router 156 at (8), which returns the response to the interface 136 at (9), which returns the response to the execution, at (10). Thus, the execution 134 is enabled to submit operations to the instance 122 and obtain a result of that operation.

In one embodiment, the proxy 154 transmits the query to the instance 122 by utilizing a virtual network of the virtual private environment 120A, such that (from the point of view of the instance 122) the query appears to originate within the environment 120A. As noted above, the task execution 134 may submit the query to the interface 136 within a common execution environment (e.g., at a “localhost” address). Thus, the appearance of a local client-database connection is provided to both the task execution 134 and database instance 122, despite these services existing in disparate and potentially otherwise isolated networks.

The above-described interactions provide a number of benefits over prior approaches. For example, as discussed above, these interactions enable a connection manager service to provide multiple connection pools associated with multiple services, even when such services exist within isolated network environments (e.g., virtual private environments 120), and to route requests to such pools based on identifiers of the pools. These interactions further enable simplification of tasks on an on-demand code execution system, by enabling use of a pooling interface 136 that can append additional information to requests received from task executions, such as authentication information and an identifier of the service, thus enabling the task execution to make requests to a service without specifying this information. These interactions further enable authentication of hosted services based on a pre-existing authentication scheme of the hosted service, by utilizing authentication information provided by a hosting system to authenticate the hosted service to another network service (which may utilize a different authentication scheme). FIGS. 9-11 depict illustrative routines that may be implemented by elements of the environment 100 to provide these benefits.

Specifically, FIG. 8 depicts a connection pool routing routine 800, which may be used to provide connection pools for connection-limited services, and to route requests to those pools based on an identifier of the pool. The routine 800 may be implemented, for example, by the connection manager service 150.

The routine 800 begins at block 802, where the connection manager service 150 implements connection pools for connection-limited services. Illustratively, each connection pool may be implemented by one or more connection proxies 154. Where the connection-limited services exist within isolated environments, the proxies 154 can be configured to access the isolated environments.

At block 804, the connection manager service 150 receives a request to transmit an operation to a target network service, the request including an identifier of the connection pool. Illustratively, the request may be received at a connection router 156 of the connection manager service 150. In one embodiment, the request may include the identifier as a header of an encapsulated data packet, the encapsulated portion of which corresponds to a wire protocol of the target network service. For example, the encapsulated portion may conform to a particular database protocol when the target network service is a database service.

At block 806, the connection manager service 150 selects a device providing a pool for the target network service, based on the identifier as included within the request. Illustratively, the connection manager service 150 may utilize DNS to map the identifier to a network address of a proxy 154 providing a pool for the service. In some instances, the connection manager service 150 may apply load balancing criteria to select from multiple proxies 154 providing a pool for the service.

At block 808, the connection manager service 150 routes the request to the target service through the selected device. Illustratively, the connection manager service 150 may pass the request to the device through a first network connection, and the device may then pass the request to the service via a pre-existing network connection (or, of no idle pre-existing connection exists, may create an additional connection to the network service.

The routine 800 then ends at block 810.

FIG. 9 depicts a serverless service connections routine 900, which may be utilized to enable serverless code executions (e.g., task execution 134) to connect to network-accessible services, without requiring information for the service (such as an identifier of the service, or metadata of the task, authentication information, or other state information of the task execution) to be hard-coded into user-defined code. The routine 900 may be implemented, for example, by the on-demand code execution system 130.

The routine 900 begins at block 902, where the on-demand code execution system 130 obtains a request to execute code on the serverless system. The request may be obtained, for example, based on an API call from a client device 102, detection of a pre-defined trigger condition on the system 130, etc.

At block 904, the on-demand code execution system 130 initiates execution of the serverless code (e.g., a task execution). For example, the system 130 may identify or generate an execution environment, such as a virtual machine instance or software container, for the code, provision the environment with the code, and execute the code within the environment. In addition to the code, the on-demand code execution system 130 further executes additional code providing a service interface for a target network-accessible service. The service interface may for example correspond to a TCP server accessible to the serverless code via a relative identifier (e.g., the “localhost” network address). In one embodiment, the service interface is implemented in the same execution environment as the serverless code.

At block 906, the on-demand code execution system 130 passes execution state information to the interface. The execution state information may illustratively be any information regarding the task execution as implemented on the on-demand code execution system 130, such as authentication information of the execution (e.g., an authentication token indicating that the task was executed by the system 130 in an authorized state), permissions information indicating resources to which the execution has access permissions, a current time as maintained at the task execution, etc. In some embodiments, additional data may be passed to the interface, such as service metadata for the serverless code. The service metadata may be defined by a user of the on-demand code execution system 130 when configuring serverless code, such that the metadata is modifiable independent of the user-defined code. Service metadata may include, for example, an identifier of a connection pool for a service.

At block 908, on-demand code execution system 130 receives a request to access the service from the serverless code at the interface. For example, the system 130 may obtain a local TCP data packet addressed to the interface.

At block 910, the on-demand code execution system 130, via operation of the interface, augments the request with state information, thus enabling a downstream component to obtain the state information without requiring the task execution to be hard-coded to provide such information. In one embodiment, augmenting the request may include encapsulating the request with a header including the state information. Use of encapsulation may be beneficial, for example, in allowing a wire protocol format of the initial request to be maintained. For example, encapsulation of the request by an interface may reduce or eliminate the need for use of custom libraries or functions within a task execution, instead enabling the task to utilize standard libraries or functions (e.g., those intended to access a local service or a service not associated with a connection manager service 150).

At block 912, the on-demand code execution system 130 routes the augmented request to the service using the interface. Illustratively, the interface may transmit the request to a router configured to route the request based on state information, such as by first authenticating the request based on an authentication token with which the request has been augmented at the interface.

The routine 900 then ends at block 914.

FIG. 10 depicts a routine 1000 providing authentication proxying for hosted service instances, which may be utilized to enable hosted service instances to utilize one set of authentication information (e.g., providing by a hosting system for the hosted service) to authenticate to other services utilizing other authentication information (e.g., a database service using a username and password), without requiring that the hosted service directly store the other authentication information. The routine 1000 may be implemented, for example, by the connection manager service 150.

The routine 1000 begins at 1002, where the service 150 obtains a request for a hosted service instance to access a target service. The hosted service instance may correspond, for example, to a task execution on the on-demand code execution system 130.

At block 1004, the service 150 obtains authentication information for the hosted service instance provided by a hosting system for the hosted service instance. For example, where the hosted service instance is a task execution on the on-demand code execution system 130, the service 150 may obtain authentication information for the task execution from the system 130. In some instances, the service 150 may query the hosting system for authentication information. In another embodiment, the authentication information may be included within the request (e.g., as a field of a header of the request).

At block 1006, the service 150 verifies the authentication information for the hosted service instance. Illustratively, the service 150 may transmit the authentication information to an authentication service that authored the information, in order to verify its authenticity. In addition, the service 150 may obtain permissions for the target network service, and verify that the authentication information complies with such permissions (e.g., that the authentication information corresponds to a role that has permissions to access the service).

At block 1008, the service 150 obtains authentication information for the target service. The authentication information is illustratively stored separately from the hosted service instance and independently modifiable. For example, the authentication information for the target service may be stored within a secrets manager service.

At block 1010, the service 150 submits the request to the target service using the authentication information for the target service. For example, the service 150 may initiate a connection to the target service using the authentication information for the target service, and pass the request to the target service over that connection. In this manner, a hosted service instance may pass requests to a target service without requiring that the hosted service instance itself store authentication information for the target service.

The routine 1000 then ends at block 1012.

While illustrative routines are discussed above, various modifications or additions to these routines are possible and contemplated herein. For example, the routines of FIGS. 8-10 may be implemented in combination to provide the benefits described herein, as depicted in the interactions of FIGS. 4-7, above. Thus, the interactions of FIGS. 8-10 are intended to be illustrative and not exhaustive in nature.

All of the methods and processes described above may be embodied in, and fully automated via, software code modules executed by one or more computers or processors. The code modules may be stored in any type of non-transitory computer-readable medium or other computer storage device. Some or all of the methods may alternatively be embodied in specialized computer hardware.

Conditional language such as, among others, “can,” “could,” “might” or “may,” unless specifically stated otherwise, are otherwise understood within the context as used in general to present that certain embodiments include, while other embodiments do not include, certain features, elements and/or steps. Thus, such conditional language is not generally intended to imply that features, elements and/or steps are in any way required for one or more embodiments or that one or more embodiments necessarily include logic for deciding, with or without user input or prompting, whether these features, elements and/or steps are included or are to be performed in any particular embodiment.

Disjunctive language such as the phrase “at least one of X, Y or Z,” unless specifically stated otherwise, is otherwise understood with the context as used in general to present that an item, term, etc., may be either X, Y or Z, or any combination thereof (e.g., X, Y and/or Z). Thus, such disjunctive language is not generally intended to, and should not, imply that certain embodiments require at least one of X, at least one of Y or at least one of Z to each be present.

Unless otherwise explicitly stated, articles such as ‘a’ or ‘an’ should generally be interpreted to include one or more described items. Accordingly, phrases such as “a device configured to” are intended to include one or more recited devices. Such one or more recited devices can also be collectively configured to carry out the stated recitations. For example, “a processor configured to carry out recitations A, B and C” can include a first processor configured to carry out recitation A working in conjunction with a second processor configured to carry out recitations B and C.

Any routine descriptions, elements or blocks in the flow diagrams described herein and/or depicted in the attached figures should be understood as potentially representing modules, segments, or portions of code which include one or more executable instructions for implementing specific logical functions or elements in the routine. Alternate implementations are included within the scope of the embodiments described herein in which elements or functions may be deleted, or executed out of order from that shown or discussed, including substantially synchronously or in reverse order, depending on the functionality involved as would be understood by those skilled in the art.

It should be emphasized that many variations and modifications may be made to the above-described embodiments, the elements of which are to be understood as being among other acceptable examples. All such modifications and variations are intended to be included herein within the scope of this disclosure and protected by the following claims.

Examples of the embodiments of the present disclosure can be described in view of the following clauses:

- Clause 1. A system comprising:
  - one or more computing devices providing a plurality of connection pools, each connection pool providing a pool of connections to a corresponding connection-limited, network-accessible service of a plurality of connection-limited, network-accessible services; and
  - a connection router device configured to:
    - receive a transmission of an operation to a target network service of the plurality of connection-limited, network-accessible services, the transmission including an identifier of a connection pool, from the plurality of connection pools, corresponding to the target network service;
    - identify a computing device of the one or more computing devices providing the connection pool based at least in part on the identifier of the connection pool; and
    - route the transmission to the computing device providing the connection pool;
  - wherein the computing device providing the connection pool is configured to obtain the transmission and to forward the operation to the target network service through an existing connection to the target network service.
- Clause 2. The system of Clause 1, wherein the target network service is a database, and wherein the transmission corresponds to an encapsulated data packet comprising a header including the identifier of the connection pool and an encapsulated portion formatted according to a wire protocol of the database.
- Clause 3. The system of Clause 1, wherein the target network service is included within a virtual private network environment, and wherein the system further comprises a configuration device configured to:
  - receive a request to generate the connection pool corresponding to the target network service; and
  - configure the computing device to access the virtual private network environment.
- Clause 4. The system of Clause 2, wherein the computing device receives the transmission outside the virtual private network environment and forwards the operation to the target network service through the virtual private network environment.
- Clause 5. The system of Clause 1, wherein the transmission includes a network packet encapsulated with a header including the identifier of the connection pool, and wherein the computing device providing the connection pool is configured to decapsulate the network packet prior to forwarding the operation to the target network service.
- Clause 6. A computer-implemented method comprising:
  - receiving a transmission of an operation to a target network service of a plurality of connection-limited, network-accessible services, the transmission including an identifier of a connection pool, from a plurality of connection pools, corresponding to the target network service, wherein each connection pool of the plurality of connection pools provides a pool of connections to a corresponding connection-limited, network-accessible service of the plurality of connection-limited, network-accessible services;
  - identifying a computing device providing the connection pool based at least in part on the identifier of the connection pool; and
  - routing the transmission to the computing device providing the connection pool;
  - wherein the computing device providing the connection pool is configured to obtain the transmission and to forward the operation to the target network service through an existing connection to the target network service.
- Clause 7. The computer-implemented method of Clause 6, wherein identifying a computing device providing the connection pool based at least in part on the identifier of the connection pool comprises resolving the identifier of the connection pool into a network address of the computing device utilizing a domain name service (DNS) server.
- Clause 8. The computer-implemented method of Clause 6, wherein a set of computing devices provide the connection pool, and wherein identifying a computing device providing the connection pool based at least in part on the identifier of the connection pool comprises applying load balancing criteria to identify the computing device among the set of computing devices.
- Clause 9. The computer-implemented method of Clause 6, wherein the transmission further includes authentication information of a source device, and wherein the method further comprises authenticating the source device using the authentication information prior to routing the transmission to the computing device providing the pool.
- Clause 10. The computer-implemented method of Clause 9, wherein the transmission includes a network packet identifying the operation encapsulated with a header including the authentication information of the source device.
- Clause 11. The computer-implemented method of Clause 9, wherein the source device is a virtual computing device hosted on a hosted computing environment, and wherein the authentication information of the source device is provided to the virtual computing device by the hosted computing environment.
- Clause 12. The computer-implemented method of Clause 6, wherein the target network service is included within a virtual private network environment, and wherein the method further comprises:
  - receiving a request to generate the connection pool corresponding to the target network service; and
  - configuring the computing device to access the virtual private network environment.
- Clause 13. The computer-implemented method of Clause 5 further comprising:
  - receiving a response of the target network service from the computing device providing the connection pool; and
  - returning the response to a source device from which the transmission was received.
- Clause 14. A system comprising:
  - a data store including computer-executable instructions; and
  - one or more processors configured to execute the computer-executable instructions to:
    - receive a transmission of an operation to a target network service of a plurality of connection-limited, network-accessible services, the transmission including an identifier of a connection pool, from a plurality of connection pools, corresponding to the target network service, wherein each connection pool of the plurality of connection pools provides a pool of connections to a corresponding connection-limited, network-accessible service of the plurality of connection-limited, network-accessible services;
    - identify a computing device providing the connection pool based at least in part on the identifier of the connection pool; and
    - route the transmission to the computing device providing the connection pool;
    - wherein the computing device providing the connection pool is configured to obtain the transmission and to forward the operation to the target network service through an existing connection to the target network service.
- Clause 15. The system of Clause 14, wherein the target network service is included within a virtual private network environment, and wherein the one or more processors are further configured to:
  - receive a request to generate the connection pool corresponding to the target network service; and
  - configure the computing device to access the virtual private network environment.
- Clause 16. The system of Clause 15, wherein the computing device receives the transmission outside the virtual private network environment and forwards the operation to the target network service through the virtual private network environment.
- Clause 17. The system of Clause 14, wherein the transmission includes a network packet identifying to the operation encapsulated with a header including the identifier of the connection pool, and wherein the computing device providing the connection pool is configured to decapsulate the network packet prior to forwarding the operation to the target network service.
- Clause 18. The system of Clause 14, wherein the transmission further includes authentication information of a source device, and wherein the one or more processors are further configured to authenticate the source device using the authentication information prior to routing the transmission to the computing device providing the pool.
- Clause 19. The system of Clause 18, wherein the source device is a virtual computing device hosted by on a hosted computing environment, and wherein the authentication information of the source device is provided by the hosted computing environment.
- Clause 20. The system of Clause 14, wherein the one or more processors are further configured to act as a proxy for additional communications between the computing device providing the connection pool and source device for the transmission.
- Clause 21. A system comprising:
  - a hosting system associated with an on-demand code execution system, the hosting system comprising one or more computing devices configured to:
    - receive a request to execute user-defined code implementing a task on the on-demand code execution system, wherein the task is associated with metadata including an authentication role under which the task should be executed;
    - in response to the request, execute, within an execution environment of the on-demand code execution system, the user-defined code implementing the task and additional code implementing an interface to the network-accessible service; and
    - pass to the interface an authentication token corresponding to the authentication role for the task;
  - wherein the user-defined code causes the computing device to request access to a network-accessible service from the interface; and
  - wherein the additional code providing the interface causes the computing device to:
    - receive the request to access the network-accessible service;
    - encapsulate the request with a header including the authentication token for the task to result in an encapsulated request; and
    - transmit the encapsulated request to a router, wherein the router is configured to authenticate the request based on the authentication token.
- Clause 22. The system of Clause 21, wherein the network-accessible service is a connection-limited database service, and wherein the endpoint provides a connection pool for the database service.
- Clause 23. The system of Clause 21, wherein the additional code providing the interface causes the computing device to implement a transport control protocol (TCP) server on which to receive the request.
- Clause 24. The system of Clause 23, wherein the user-defined code causes the computing device to request access to a network-accessible service from the interface by transmitting the request to the TCP server by use of a local relative identifier for the execution environment.
- Clause 25. A computer-implemented method comprising:
  - receiving a request to execute user-defined code implementing a task on the on-demand code execution system, wherein the task is associated with metadata specifying that calls to a network-accessible service originating from executions of the task are to be augmented with information regarding a state of an execution environment in which the task is executed;
  - in response to the request, executing, on the on-demand code execution system, the user-defined code implementing the task and additional code implementing an interface to the network-accessible service; and
  - passing to the interface the information regarding the state of the execution environment in which the task is executed;
  - wherein executing the user-defined code implementing the task comprises requesting access to the network-accessible service from the interface; and
  - wherein executing the additional code providing the interface comprises:
    - receiving the request to access the network-accessible service;
    - augmenting the request with the information regarding the state of the execution environment in which the task is executed to result in an augmented request; and
    - transmitting the augmented request to the network-accessible service.
- Clause 26. The computer-implemented method of Clause 25, wherein the information regarding the state of the execution environment in which the task is executed comprises an authentication token indicating the state of the execution environment as authenticated by the on-demand code execution system.
- Clause 27. The computer-implemented method of Clause 25, wherein the additional code is executed within the execution environment.
- Clause 28. The computer-implemented method of Clause 25, wherein requesting access to the network-accessible service from the interface comprises identifying the interface using a relative identifier of a local execution environment.
- Clause 29. The computer-implemented method of Clause 25, wherein requesting access to the network-accessible service from the interface comprises requesting access without specifying authentication information.
- Clause 30. The computer-implemented method of Clause 29, wherein the information regarding the state of the execution environment in which the task is executed comprises a listing of resources to which the task has access permissions.
- Clause 31. The computer-implemented method of Clause 25, wherein augmenting the request with the information regarding the state of the execution environment in which the task is executed to result in the augmented request comprises encapsulating the request with a header comprising the information regarding the state of the execution environment in which the task is executed.
- Clause 32. A system comprising:
  - a hosting system associated with an on-demand code execution system, the hosting system comprising one or more computing devices configured to:
    - receive a request to execute user-defined code implementing a task on the on-demand code execution system, wherein the task is associated with metadata specifying that calls to a network-accessible service originating from executions of the task are to be augmented with information regarding a state of an execution environment in which the task is executed;
    - in response to the request, execute, within an execution environment of the on-demand code execution system, the user-defined code implementing the task and additional code implementing an interface to the network-accessible service; and
    - pass to the interface the information regarding the state of the execution environment in which the task is executed;
  - wherein the user-defined code causes the computing device to request access to a network-accessible service from the interface; and
  - wherein the additional code providing the interface causes the computing device to:
    - receive the request to access the network-accessible service;
    - augment the request with the information regarding the state of the execution environment in which the task is executed to result in an augmented request;
    - transmit the augmented request to the network-accessible service.
- Clause 33. The system of Clause 33, wherein augmenting the request with the information regarding the state of the execution environment in which the task is executed to result in the augmented request comprises encapsulating the request with a header comprising the information regarding the state of the execution environment in which the task is executed.
- Clause 34. The system of Clause 34, wherein the request is in a wire protocol format of the network-accessible service and wherein encapsulating the request maintains the wire protocol format of the request within an encapsulated portion of the augmented request.
- Clause 35. The system of Clause 33, wherein the one or more computing devices of the hosting system are further configured to pass to the interface authentication information for the task, wherein the additional code providing the interface further causes the computing device to add the authentication information to the request, and wherein the request to the network-accessible service is authenticated based at least partly on the authentication information for the task.
- Clause 36. The system of Clause 33, wherein the one or more computing devices of the hosting system are further configured to pass to the interface an identifier of the network-accessible service, wherein the additional code providing the interface further causes the computing device to add the identifier to the request, and wherein the request to the network-accessible service is routed to the network-accessible service based at least partly on the identifier.
- Clause 37. The system of Clause 33, wherein the additional code providing the interface causes the computing device to implement a transport control protocol (TCP) server on which to receive the request, and wherein the user-defined code causes the computing device to request access to a network-accessible service from the interface by transmitting the request to the TCP server by use a local relative identifier for the execution environment.
- Clause 38. The system of Clause 33, wherein executing the user-defined code and the additional code comprising executing the user-defined code within a first virtual machine instance and executing the additional code within a second virtual machine instance.
- Clause 39. The system of Clause 33, wherein the user-defined code causes the computing device to request access to the network-accessible service from the interface without specifying authentication information for the network-accessible service.
- Clause 40. The system of Clause 33, wherein the additional code providing the interface causes the computing device to act as a proxy for additional communications between the user-defined code and the network-accessible service.
- Clause 41. A system comprising:
  - a hosting system associated with an on-demand code execution system, the hosting system comprising one or more computing devices configured to:
    - receive a client request to execute user-defined code implementing a task on the on-demand code execution system, wherein the task is associated with metadata including an authentication role under which the task should be executed;
    - in response to the request, execute, within an execution environment of the on-demand code execution system, the user-defined code implementing the task; and
    - pass to the execution environment authentication information for the authentication role;
    - wherein the user-defined code causes the on-demand code execution system to transmit a request for an operation on a network-accessible service using the authentication information for the authentication role; and
  - a connection subsystem comprising one or more computing devices configured to:
    - receive the request for the operation on the network-accessible service using the authentication information for the authentication role;
    - verify that the authentication information authenticates the authentication role and that the authentication role has permission to access the network-accessible service; and
    - request the operation on the network-accessible service using authentication information for the network-accessible service, wherein the authentication information for the network-accessible service is distinct from the authentication information for the authentication role and is not provided by the computing device executing the user-defined code.
- Clause 42. The system of Clause 41, wherein the authentication information for the authentication role is an authentication token, and wherein the authentication information for the network-accessible service includes a password for the network-accessible service.
- Clause 43. The system of Clause 41, wherein the network-accessible service is a connection-limited database service, and the connection subsystem implements a connection pool for the connection-limited database service comprising a pool of connections to the connection-limited database service, individual connections of the pool authenticated utilizing the authentication information for the network-accessible service.
- Clause 44. The system of Clause 41, wherein one or more computing devices of the hosting system are further configured to execute within the execution environment additional code implementing an interface, and wherein passing the authentication information to the execution environment comprises passing the authentication information to the interface.
- Clause 45. A computer-implemented method comprising, at a computing device:
  - receiving a request to access a target network-accessible service using authentication information, wherein the request is received from a hosted network service, and wherein the authentication information is provided to the hosted network service by a hosting system hosting the hosted network service in connection with hosting the hosted network service;
  - verifying that the authentication information authenticates to an authentication role that has permissions to access the target network-accessible service;
  - retrieving authentication information for the target network-accessible service, wherein the authentication information for the target network-accessible service is distinct from the authentication information of the hosted network service; and
  - requesting the operation on the target network-accessible service using the authentication information for the target network-accessible service.
- Clause 46. The computer-implemented method of Clause 45, further comprising, at the hosting system:
  - receiving a client request to execute user-defined code implementing a task corresponding to the hosted network service on an on-demand code execution system, wherein the task is associated with metadata indicating that the task should be executed under the authentication role;
  - in response to the request, executing, within an execution environment of the on-demand code execution system, the user-defined code implementing the task; and
  - passing to the execution environment the authentication information for the authentication role;
  - wherein the user-defined code causes the on-demand code execution system to transmit the request to access the target network-accessible service using the authentication information for the authentication role.
- Clause 47. The computer-implemented method of Clause 46 further comprising executing within the execution environment additional code implementing an interface, and wherein passing the authentication information to the execution environment comprises passing the authentication information to the interface.
- Clause 48. The computer-implemented method of Clause 45, wherein verifying that the authentication information authenticates to the authentication role that has permissions to access the target network-accessible service comprises:
  - transmitting the authentication information to an authentication service that authored the authentication information;
  - receiving verification that the authentication information authenticates to the authentication role;
  - obtaining permissions information for the target network-accessible service; and
  - verifying that the permissions information indicates that the authentication role has permissions to access the target network-accessible service.
- Clause 49. The computer-implemented method of Clause 45, wherein the network-accessible service is a connection-limited database service, and wherein requesting the operation on the target network-accessible service using the authentication information for the target network-accessible service comprises:
  - initiating a connection with the target network-accessible service using the target; and
  - transmitting the request via the connection.
- Clause 50. The computer-implemented method of Clause 45, wherein the network-accessible service is within an isolated network environment, wherein the request is received outside the isolated network environment, and wherein requesting the operation on the target network-accessible service using the authentication information for the target network-accessible service comprises transmitting a request for the operation within the isolated network environment.
- Clause 51. The computer-implemented method of Clause 45, wherein the request is encapsulated within a header including the authentication information.
- Clause 52. The computer-implemented method of Clause 51, wherein the method further comprises:
  - decapsulating the request; and
  - forwarding the request to the target network-accessible service.
- Clause 53. The computer-implemented method of Clause 45, wherein the header further comprises an identifier of an endpoint for the target network-accessible service.
- Clause 54. The computer-implemented method of Clause 53, wherein the method further comprises identifying the endpoint based on the identifier.
- Clause 55. A system comprising:
  - a data store including computer-executable instructions; and
  - one or more processors configured to execute the computer-executable instructions to:
    - receive a request to access a target network-accessible service using authentication information, wherein the request is received from a hosted network service, and wherein the authentication information is provided to the hosted network service by a hosting system hosting the hosted network service in connection with hosting the hosted network service;
    - verify that the authentication information authenticates to an authentication role that has permissions to access the network-accessible service;
    - retrieve authentication information for the target network-accessible service, wherein the authentication information for the target network-accessible service is distinct from the authentication information of the hosted network service; and
    - request the operation on the target network-accessible service using the authentication information for the target network-accessible service.
- Clause 56. The system of Clause 55, wherein the one or more processors are further configured to:
  - receive a client request to execute user-defined code implementing a task corresponding to the hosted network service on an on-demand code execution system, wherein the task is associated with metadata indicating that the task should be executed under the authentication role;
  - in response to the request, executing, within an execution environment of the on-demand code execution system, the user-defined code implementing the task; and
  - passing to the execution environment the authentication information for the authentication role;
  - wherein the user-defined code causes the on-demand code execution system to transmit the request to access the target network-accessible service using the authentication information for the authentication role.
- Clause 57. The system of Clause 56, wherein the one or more processors are further configured to execute within the execution environment additional code implementing an interface, and wherein passing the authentication information to the execution environment comprises passing the authentication information to the interface.
- Clause 58. The system of Clause 57, wherein the user-defined code causes the on-demand code execution system to transmit the request for the operation on a network-accessible service using the authentication information for the authentication role at least partly by causing the on-demand code execution system to pass the request for the operation to the interface.
- Clause 59. The system of Clause 58, wherein execution of the additional code implementing the interface causes the on-demand code execution system to add the authentication information for the authentication role to the request prior to transmitting the request outside of the on-demand code execution system.
- Clause 60. The system of Clause 58, wherein to verify that the authentication information authenticates to the authentication role that has permissions to access the target network-accessible service, the one or more processors are further configured to:
- transmit the authentication information to an authentication service that authored the authentication information;
- receive verification that the authentication information authenticates to the authentication role;
- obtain permissions information for the target network-accessible service; and
- verify that the permissions information indicates that the authentication role has permissions to access the target network-accessible service.

Claims

1. A system comprising: a hosting system associated with an on-demand code execution system, the hosting system comprising one or more hardware computing devices configured to:receive a client request to execute user-defined code implementing a task on the on-demand code execution system, wherein the task is associated with metadata including an authentication role under which the task should be executed;in response to the request, execute, within an execution environment of the on-demand code execution system, the user-defined code implementing the task; andpass to the execution environment authentication information for the authentication role;wherein the user-defined code causes the on-demand code execution system to transmit a request for an operation on a network-accessible service using the authentication information for the authentication role; and
2. The system of claim 1, wherein the authentication information for the authentication role is an authentication token, and wherein the authentication information for the network-accessible service includes a password for the network-accessible service.
3. The system of claim 1, wherein the network-accessible service is a connection-limited database service, and the connection subsystem implements a connection pool for the connection-limited database service comprising a pool of connections to the connection-limited database service, individual connections of the pool authenticated utilizing the authentication information for the network-accessible service.
4. The system of claim 1, wherein one or more computing devices of the hosting system are further configured to execute within the execution environment additional code implementing an interface, and wherein passing the authentication information to the execution environment comprises passing the authentication information to the interface.
5. A computer-implemented method comprising, at a computing device: receiving a request to access a target network-accessible service using authentication information, wherein the request is received from a hosted network service, and wherein the authentication information is provided to the hosted network service by a hosting system hosting the hosted network service in connection with hosting the hosted network service;verifying that the authentication information authenticates to an authentication role that has permissions to access the target network-accessible service;retrieving authentication information for the target network-accessible service, wherein the authentication information for the target network-accessible service is distinct from the authentication information of the hosted network service; andrequesting the access to the target network-accessible service using the authentication information for the target network-accessible service.
6. The computer-implemented method of claim 5, further comprising, at the hosting system: receiving a client request to execute user-defined code implementing a task corresponding to the hosted network service on an on-demand code execution system, wherein the task is associated with metadata indicating that the task should be executed under the authentication role;in response to the request, executing, within an execution environment of the on-demand code execution system, the user-defined code implementing the task; andpassing to the execution environment the authentication information for the authentication role;wherein the user-defined code causes the on-demand code execution system to transmit the request to access the target network-accessible service using the authentication information for the authentication role.
7. The computer-implemented method of claim 6 further comprising executing within the execution environment additional code implementing an interface, and wherein passing the authentication information to the execution environment comprises passing the authentication information to the interface.
8. The computer-implemented method of claim 5, wherein verifying that the authentication information authenticates to the authentication role that has permissions to access the target network-accessible service comprises: transmitting the authentication information to an authentication service that authored the authentication information;receiving verification that the authentication information authenticates to the authentication role;obtaining permissions information for the target network-accessible service; andverifying that the permissions information indicates that the authentication role has permissions to access the target network-accessible service.
9. The computer-implemented method of claim 5, wherein the network-accessible service is a connection-limited database service, and wherein requesting the operation on the target network-accessible service using the authentication information for the target network-accessible service comprises: initiating a connection with the target network-accessible service using the target; andtransmitting the request via the connection.
10. The computer-implemented method of claim 5, wherein the network-accessible service is within an isolated network environment, wherein the request is received outside the isolated network environment, and wherein requesting the operation on the target network-accessible service using the authentication information for the target network-accessible service comprises transmitting a request for the operation within the isolated network environment.
11. The computer-implemented method of claim 5, wherein the request is encapsulated within a header including the authentication information.
12. The computer-implemented method of claim 11, wherein the method further comprises: decapsulating the request; andforwarding the request to the target network-accessible service.
13. The computer-implemented method of claim 5, wherein the header further comprises an identifier of an endpoint for the target network-accessible service.
14. The computer-implemented method of claim 13, wherein the method further comprises identifying the endpoint based on the identifier.
15. A system comprising: a data store including computer-executable instructions; andone or more processors configured to execute the computer-executable instructions to:receive a request to access a target network-accessible service using authentication information, wherein the request is received from a hosted network service, and wherein the authentication information is provided to the hosted network service by a hosting system hosting the hosted network service in connection with hosting the hosted network service;verify that the authentication information authenticates to an authentication role that has permissions to access the network-accessible service;retrieve authentication information for the target network-accessible service, wherein the authentication information for the target network-accessible service is distinct from the authentication information of the hosted network service; andrequest the access to the target network-accessible service using the authentication information for the target network-accessible service.
16. The system of claim 15, wherein the one or more processors are further configured to: receive a client request to execute user-defined code implementing a task corresponding to the hosted network service on an on-demand code execution system, wherein the task is associated with metadata indicating that the task should be executed under the authentication role;in response to the request, executing, within an execution environment of the on-demand code execution system, the user-defined code implementing the task; andpassing to the execution environment the authentication information for the authentication role;wherein the user-defined code causes the on-demand code execution system to transmit the request to access the target network-accessible service using the authentication information for the authentication role.
17. The system of claim 16, wherein the one or more processors are further configured to execute within the execution environment additional code implementing an interface, and wherein passing the authentication information to the execution environment comprises passing the authentication information to the interface.
18. The system of claim 17, wherein the user-defined code causes the on-demand code execution system to transmit the request for the operation on a network-accessible service using the authentication information for the authentication role at least partly by causing the on-demand code execution system to pass the request for the operation to the interface.
19. The system of claim 18, wherein execution of the additional code implementing the interface causes the on-demand code execution system to add the authentication information for the authentication role to the request prior to transmitting the request outside of the on-demand code execution system.
20. The system of claim 18, wherein to verify that the authentication information authenticates to the authentication role that has permissions to access the target network-accessible service, the one or more processors are further configured to: transmit the authentication information to an authentication service that authored the authentication information;receive verification that the authentication information authenticates to the authentication role;obtain permissions information for the target network-accessible service; andverify that the permissions information indicates that the authentication role has permissions to access the target network-accessible service.

US Referenced Citations (808)

Number	Name	Date	Kind
4949254	Shorter	Aug 1990	A
5283888	Dao et al.	Feb 1994	A
5835764	Platt et al.	Nov 1998	A
5970488	Crowe et al.	Oct 1999	A
5983197	Enta	Nov 1999	A
6237005	Griffin	May 2001	B1
6260058	Hoenninger et al.	Jul 2001	B1
6385636	Suzuki	May 2002	B1
6463509	Teoman et al.	Oct 2002	B1
6501736	Smolik et al.	Dec 2002	B1
6523035	Fleming et al.	Feb 2003	B1
6549936	Hirabayashi	Apr 2003	B1
6708276	Yarsa et al.	Mar 2004	B1
7036121	Casabona et al.	Apr 2006	B1
7308463	Taulbee et al.	Dec 2007	B2
7340522	Basu et al.	Mar 2008	B1
7360215	Kraiss et al.	Apr 2008	B2
7558719	Donlin	Jul 2009	B1
7577722	Khandekar et al.	Aug 2009	B1
7590806	Harris et al.	Sep 2009	B2
7665090	Tormasov et al.	Feb 2010	B1
7707579	Rodriguez	Apr 2010	B2
7730464	Trowbridge	Jun 2010	B2
7774191	Berkowitz et al.	Aug 2010	B2
7823186	Pouliot	Oct 2010	B2
7831464	Nichols et al.	Nov 2010	B1
7870153	Croft et al.	Jan 2011	B2
7886021	Scheifler et al.	Feb 2011	B2
7949677	Croft et al.	May 2011	B2
7954150	Croft et al.	May 2011	B2
8010679	Low et al.	Aug 2011	B2
8010990	Ferguson et al.	Aug 2011	B2
8024564	Bassani et al.	Sep 2011	B2
8046765	Cherkasova et al.	Oct 2011	B2
8051180	Mazzaferri et al.	Nov 2011	B2
8051266	DeVal et al.	Nov 2011	B2
8065676	Sahai et al.	Nov 2011	B1
8065682	Baryshnikov et al.	Nov 2011	B2
8095931	Chen et al.	Jan 2012	B1
8127284	Meijer et al.	Feb 2012	B2
8146073	Sinha	Mar 2012	B2
8166304	Murase et al.	Apr 2012	B2
8171473	Lavin	May 2012	B2
8201026	Bornstein et al.	Jun 2012	B1
8209695	Pruyne et al.	Jun 2012	B1
8219987	Vlaovic et al.	Jul 2012	B1
8296267	Cahill et al.	Oct 2012	B2
8321554	Dickinson	Nov 2012	B2
8321558	Sirota et al.	Nov 2012	B1
8336079	Budko et al.	Dec 2012	B2
8352608	Keagy et al.	Jan 2013	B1
8387075	McCann et al.	Feb 2013	B1
8392558	Ahuja et al.	Mar 2013	B1
8402514	Thompson	Mar 2013	B1
8417723	Lissack et al.	Apr 2013	B1
8429282	Ahuja	Apr 2013	B1
8448165	Conover	May 2013	B1
8479195	Adams et al.	Jul 2013	B2
8490088	Tang	Jul 2013	B2
8555281	Van Dijk et al.	Oct 2013	B1
8560699	Theimer et al.	Oct 2013	B1
8566835	Wang et al.	Oct 2013	B2
8601323	Tsantilis	Dec 2013	B2
8613070	Borzycki et al.	Dec 2013	B1
8615589	Adogla et al.	Dec 2013	B1
8631130	Jackson	Jan 2014	B2
8667471	Wintergerst et al.	Mar 2014	B2
8677359	Cavage et al.	Mar 2014	B1
8694996	Cawlfield et al.	Apr 2014	B2
8700768	Benari	Apr 2014	B2
8719415	Sirota et al.	May 2014	B1
8725702	Raman et al.	May 2014	B1
8756322	Lynch	Jun 2014	B1
8756696	Miller	Jun 2014	B1
8763091	Singh	Jun 2014	B1
8769519	Leitman et al.	Jul 2014	B2
8793676	Quinn et al.	Jul 2014	B2
8799236	Azari et al.	Aug 2014	B1
8799879	Wright et al.	Aug 2014	B2
8806468	Meijer et al.	Aug 2014	B2
8806644	McCorkendale et al.	Aug 2014	B1
8819679	Agarwal et al.	Aug 2014	B2
8825863	Hansson et al.	Sep 2014	B2
8825964	Sopka et al.	Sep 2014	B1
8839035	Dimitrovich et al.	Sep 2014	B1
8850432	Mcgrath et al.	Sep 2014	B2
8869300	Singh et al.	Oct 2014	B2
8874952	Tameshige et al.	Oct 2014	B2
8904008	Calder et al.	Dec 2014	B2
8966495	Kulkarni	Feb 2015	B2
8972980	Banga et al.	Mar 2015	B2
8997093	Dimitrov	Mar 2015	B2
9002871	Bulkowski et al.	Apr 2015	B2
9021501	Li et al.	Apr 2015	B2
9027087	Ishaya et al.	May 2015	B2
9038068	Engle et al.	May 2015	B2
9052935	Rajaa	Jun 2015	B1
9086897	Oh et al.	Jul 2015	B2
9086924	Barsness et al.	Jul 2015	B2
9092837	Bala et al.	Jul 2015	B2
9098528	Wang	Aug 2015	B2
9104477	Kodialam et al.	Aug 2015	B2
9110732	Forschmiedt et al.	Aug 2015	B1
9110770	Raju et al.	Aug 2015	B1
9111037	Nalis et al.	Aug 2015	B1
9112813	Jackson	Aug 2015	B2
9116733	Banga et al.	Aug 2015	B2
9141410	Leafe et al.	Sep 2015	B2
9146764	Wagner	Sep 2015	B1
9152406	De et al.	Oct 2015	B2
9164754	Pohlack	Oct 2015	B1
9183019	Kruglick	Nov 2015	B2
9208007	Harper et al.	Dec 2015	B2
9218190	Anand et al.	Dec 2015	B2
9223561	Orveillon et al.	Dec 2015	B2
9223966	Satish et al.	Dec 2015	B1
9250893	Blahaerath et al.	Feb 2016	B2
9268586	Voccio et al.	Feb 2016	B2
9298633	Zhao et al.	Mar 2016	B1
9317689	Aissi	Apr 2016	B2
9323556	Wagner	Apr 2016	B2
9361145	Wilson et al.	Jun 2016	B1
9405582	Fuller et al.	Aug 2016	B2
9411645	Duan et al.	Aug 2016	B1
9413626	Reque et al.	Aug 2016	B2
9417918	Chin et al.	Aug 2016	B2
9430290	Gupta et al.	Aug 2016	B1
9436555	Dornemann et al.	Sep 2016	B2
9461996	Hayton et al.	Oct 2016	B2
9471775	Wagner et al.	Oct 2016	B1
9471776	Gu et al.	Oct 2016	B2
9483335	Wagner et al.	Nov 2016	B1
9489227	Oh et al.	Nov 2016	B2
9497136	Ramarao et al.	Nov 2016	B1
9501345	Lietz et al.	Nov 2016	B1
9514037	Dow et al.	Dec 2016	B1
9537788	Reque et al.	Jan 2017	B2
9563613	Dinkel et al.	Feb 2017	B1
9575798	Terayama et al.	Feb 2017	B2
9588790	Wagner et al.	Mar 2017	B1
9594590	Hsu	Mar 2017	B2
9596350	Dymshyts et al.	Mar 2017	B1
9600312	Wagner et al.	Mar 2017	B2
9613127	Rus et al.	Apr 2017	B1
9626204	Banga et al.	Apr 2017	B1
9628332	Bruno, Jr. et al.	Apr 2017	B2
9635132	Lin et al.	Apr 2017	B1
9652306	Wagner et al.	May 2017	B1
9652617	Evans et al.	May 2017	B1
9654508	Barton et al.	May 2017	B2
9661011	Van Horenbeeck et al.	May 2017	B1
9678773	Wagner et al.	Jun 2017	B1
9678778	Youseff	Jun 2017	B1
9703681	Taylor et al.	Jul 2017	B2
9715402	Wagner et al.	Jul 2017	B2
9720661	Gschwind et al.	Aug 2017	B2
9720662	Gschwind et al.	Aug 2017	B2
9727725	Wagner et al.	Aug 2017	B2
9733967	Wagner et al.	Aug 2017	B2
9760387	Wagner et al.	Sep 2017	B2
9760443	Tarasuk - Levin et al.	Sep 2017	B2
9767271	Ghose	Sep 2017	B2
9785476	Wagner et al.	Oct 2017	B2
9787779	Frank et al.	Oct 2017	B2
9798831	Chattopadhyay et al.	Oct 2017	B2
9811363	Wagner	Nov 2017	B1
9811434	Wagner	Nov 2017	B1
9817695	Clark	Nov 2017	B2
9830175	Wagner	Nov 2017	B1
9830193	Wagner et al.	Nov 2017	B1
9830449	Wagner	Nov 2017	B1
9864636	Patel et al.	Jan 2018	B1
9898393	Moorthi et al.	Feb 2018	B2
9910713	Wisniewski et al.	Mar 2018	B2
9921864	Singaravelu et al.	Mar 2018	B2
9928108	Wagner et al.	Mar 2018	B1
9929916	Subramanian et al.	Mar 2018	B1
9930103	Thompson	Mar 2018	B2
9930133	Susarla et al.	Mar 2018	B2
9952896	Wagner et al.	Apr 2018	B2
9977691	Marriner et al.	May 2018	B2
9979817	Huang et al.	May 2018	B2
9983982	Kumar et al.	May 2018	B1
10002026	Wagner	Jun 2018	B1
10013267	Wagner et al.	Jul 2018	B1
10042660	Wagner et al.	Aug 2018	B2
10048974	Wagner et al.	Aug 2018	B1
10061613	Brooker et al.	Aug 2018	B1
10067801	Wagner	Sep 2018	B1
10102040	Marriner et al.	Oct 2018	B2
10108443	Wagner et al.	Oct 2018	B2
10139876	Lu et al.	Nov 2018	B2
10140137	Wagner	Nov 2018	B2
10146635	Chai et al.	Dec 2018	B1
10162655	Tuch et al.	Dec 2018	B2
10162672	Wagner et al.	Dec 2018	B2
10162688	Wagner	Dec 2018	B2
10198298	Bishop et al.	Feb 2019	B2
10203990	Wagner et al.	Feb 2019	B2
10248467	Wisniewski et al.	Apr 2019	B2
10255090	Tuch et al.	Apr 2019	B2
10277708	Wagner et al.	Apr 2019	B2
10303492	Wagner et al.	May 2019	B1
10331462	Varda et al.	Jun 2019	B1
10346625	Anderson et al.	Jul 2019	B2
10353678	Wagner	Jul 2019	B1
10353746	Reque et al.	Jul 2019	B2
10360025	Foskett et al.	Jul 2019	B2
10360067	Wagner	Jul 2019	B1
10365985	Wagner	Jul 2019	B2
10387177	Wagner et al.	Aug 2019	B2
10402231	Marriner et al.	Sep 2019	B2
10423158	Hadlich	Sep 2019	B1
10437629	Wagner et al.	Oct 2019	B2
10445140	Sagar et al.	Oct 2019	B1
10459822	Gondi	Oct 2019	B1
10503626	Idicula et al.	Dec 2019	B2
10528390	Brooker et al.	Jan 2020	B2
10531226	Wang et al.	Jan 2020	B1
10552193	Wagner et al.	Feb 2020	B2
10552442	Lusk	Feb 2020	B1
10564946	Wagner et al.	Feb 2020	B1
10572375	Wagner	Feb 2020	B1
10592269	Wagner et al.	Mar 2020	B2
10615984	Wang	Apr 2020	B1
10623476	Thompson	Apr 2020	B2
10649749	Brooker et al.	May 2020	B1
10649792	Kulchytskyy et al.	May 2020	B1
10650156	Anderson et al.	May 2020	B2
10686605	Chhabra et al.	Jun 2020	B2
10691498	Wagner	Jun 2020	B2
10713080	Brooker et al.	Jul 2020	B1
10719367	Kim et al.	Jul 2020	B1
10725752	Wagner et al.	Jul 2020	B1
10725826	Sagar et al.	Jul 2020	B1
10733085	Wagner	Aug 2020	B1
10754701	Wagner	Aug 2020	B1
10776091	Wagner et al.	Sep 2020	B1
10776171	Wagner et al.	Sep 2020	B2
10817331	Mullen et al.	Oct 2020	B2
10824484	Wagner et al.	Nov 2020	B2
10831898	Wagner	Nov 2020	B1
10853112	Wagner et al.	Dec 2020	B2
10853115	Mullen et al.	Dec 2020	B2
10884722	Brooker et al.	Jan 2021	B2
10884787	Wagner et al.	Jan 2021	B1
10884802	Wagner et al.	Jan 2021	B2
10884812	Brooker et al.	Jan 2021	B2
10891145	Wagner et al.	Jan 2021	B2
10915371	Wagner et al.	Feb 2021	B2
10942795	Yanacek et al.	Mar 2021	B1
10949237	Piwonka et al.	Mar 2021	B2
10956185	Wagner	Mar 2021	B2
11016815	Wisniewski et al.	May 2021	B2
20010044817	Asano et al.	Nov 2001	A1
20020120685	Srivastava et al.	Aug 2002	A1
20020172273	Baker et al.	Nov 2002	A1
20030071842	King et al.	Apr 2003	A1
20030084434	Ren	May 2003	A1
20030149801	Kushnirskiy	Aug 2003	A1
20030191795	Bernardin et al.	Oct 2003	A1
20030208569	O'Brien et al.	Nov 2003	A1
20030229794	James, II et al.	Dec 2003	A1
20040003087	Chambliss et al.	Jan 2004	A1
20040019886	Berent et al.	Jan 2004	A1
20040044721	Song et al.	Mar 2004	A1
20040049768	Matsuyama et al.	Mar 2004	A1
20040098154	McCarthy	May 2004	A1
20040158551	Santosuosso	Aug 2004	A1
20040205493	Simpson et al.	Oct 2004	A1
20040249947	Novaes et al.	Dec 2004	A1
20040268358	Darling et al.	Dec 2004	A1
20050027611	Wharton	Feb 2005	A1
20050044301	Vasilevsky et al.	Feb 2005	A1
20050120160	Plouffe et al.	Jun 2005	A1
20050132167	Longobardi	Jun 2005	A1
20050132368	Sexton et al.	Jun 2005	A1
20050149535	Frey et al.	Jul 2005	A1
20050193113	Kokusho et al.	Sep 2005	A1
20050193283	Reinhardt et al.	Sep 2005	A1
20050237948	Wan et al.	Oct 2005	A1
20050257051	Richard	Nov 2005	A1
20050262183	Colrain	Nov 2005	A1
20050262512	Schmidt et al.	Nov 2005	A1
20060010440	Anderson et al.	Jan 2006	A1
20060015740	Kramer	Jan 2006	A1
20060080678	Bailey et al.	Apr 2006	A1
20060123066	Jacobs et al.	Jun 2006	A1
20060129684	Datta	Jun 2006	A1
20060155800	Matsumoto	Jul 2006	A1
20060168174	Gebhart et al.	Jul 2006	A1
20060184669	Vaidyanathan et al.	Aug 2006	A1
20060200668	Hybre et al.	Sep 2006	A1
20060212332	Jackson	Sep 2006	A1
20060218601	Michel	Sep 2006	A1
20060242647	Kimbrel et al.	Oct 2006	A1
20060248195	Toumura et al.	Nov 2006	A1
20060288120	Hoshino et al.	Dec 2006	A1
20070033085	Johnson	Feb 2007	A1
20070050779	Hayashi	Mar 2007	A1
20070094396	Takano et al.	Apr 2007	A1
20070101325	Bystricky et al.	May 2007	A1
20070112864	Ben-Natan	May 2007	A1
20070130341	Ma	Jun 2007	A1
20070174419	O'Connell et al.	Jul 2007	A1
20070180449	Croft et al.	Aug 2007	A1
20070180450	Croft et al.	Aug 2007	A1
20070180493	Croft et al.	Aug 2007	A1
20070186212	Mazzaferri et al.	Aug 2007	A1
20070192082	Gaos et al.	Aug 2007	A1
20070192329	Croft et al.	Aug 2007	A1
20070198656	Mazzaferri et al.	Aug 2007	A1
20070199000	Shekhel et al.	Aug 2007	A1
20070220009	Morris et al.	Sep 2007	A1
20070226700	Gal et al.	Sep 2007	A1
20070240160	Paterson-Jones	Oct 2007	A1
20070255604	Seelig	Nov 2007	A1
20080028409	Cherkasova et al.	Jan 2008	A1
20080052401	Bugenhagen et al.	Feb 2008	A1
20080052725	Stoodley et al.	Feb 2008	A1
20080082977	Araujo et al.	Apr 2008	A1
20080104247	Venkatakrishnan et al.	May 2008	A1
20080104608	Hyser et al.	May 2008	A1
20080115143	Shimizu et al.	May 2008	A1
20080126110	Haeberle et al.	May 2008	A1
20080126486	Heist	May 2008	A1
20080127125	Anckaert et al.	May 2008	A1
20080147893	Marripudi et al.	Jun 2008	A1
20080189468	Schmidt et al.	Aug 2008	A1
20080195369	Duyanovich et al.	Aug 2008	A1
20080201568	Quinn et al.	Aug 2008	A1
20080201711	Amir Husain	Aug 2008	A1
20080209423	Hirai	Aug 2008	A1
20080244547	Wintergerst et al.	Oct 2008	A1
20080288940	Adams et al.	Nov 2008	A1
20080307098	Kelly	Dec 2008	A1
20090006897	Sarsfield	Jan 2009	A1
20090013153	Hilton	Jan 2009	A1
20090025009	Brunswig et al.	Jan 2009	A1
20090034537	Colrain et al.	Feb 2009	A1
20090055810	Kondur	Feb 2009	A1
20090055829	Gibson	Feb 2009	A1
20090070355	Cadarette et al.	Mar 2009	A1
20090077569	Appleton et al.	Mar 2009	A1
20090125902	Ghosh et al.	May 2009	A1
20090158275	Wang et al.	Jun 2009	A1
20090158407	Nicodemus et al.	Jun 2009	A1
20090177860	Zhu et al.	Jul 2009	A1
20090183162	Kindel et al.	Jul 2009	A1
20090193410	Arthursson et al.	Jul 2009	A1
20090198769	Keller et al.	Aug 2009	A1
20090204960	Ben-yehuda et al.	Aug 2009	A1
20090204964	Foley et al.	Aug 2009	A1
20090222922	Sidiroglou et al.	Sep 2009	A1
20090271472	Scheifler et al.	Oct 2009	A1
20090288084	Astete et al.	Nov 2009	A1
20090300151	Friedman et al.	Dec 2009	A1
20090300599	Piotrowski	Dec 2009	A1
20100023940	Iwamatsu et al.	Jan 2010	A1
20100031274	Sim-Tang	Feb 2010	A1
20100031325	Maigne et al.	Feb 2010	A1
20100036925	Haffner	Feb 2010	A1
20100037031	DeSantis et al.	Feb 2010	A1
20100058342	Machida	Mar 2010	A1
20100058351	Yahagi	Mar 2010	A1
20100064299	Kacin et al.	Mar 2010	A1
20100070678	Zhang et al.	Mar 2010	A1
20100070725	Prahlad et al.	Mar 2010	A1
20100083048	Calinoiu et al.	Apr 2010	A1
20100083248	Wood et al.	Apr 2010	A1
20100094816	Groves, Jr. et al.	Apr 2010	A1
20100106926	Kandasamy et al.	Apr 2010	A1
20100114825	Siddegowda	May 2010	A1
20100115098	De Baer et al.	May 2010	A1
20100122343	Ghosh	May 2010	A1
20100131936	Cheriton	May 2010	A1
20100131959	Spiers et al.	May 2010	A1
20100186011	Magenheimer	Jul 2010	A1
20100198972	Umbehocker	Aug 2010	A1
20100199285	Medovich	Aug 2010	A1
20100257116	Mehta et al.	Oct 2010	A1
20100257269	Clark	Oct 2010	A1
20100269109	Cartales	Oct 2010	A1
20100299541	Ishikawa et al.	Nov 2010	A1
20100312871	Desantis et al.	Dec 2010	A1
20100325727	Neystadt et al.	Dec 2010	A1
20100329149	Singh et al.	Dec 2010	A1
20100329643	Kuang	Dec 2010	A1
20110010690	Howard et al.	Jan 2011	A1
20110010722	Matsuyama	Jan 2011	A1
20110023026	Oza	Jan 2011	A1
20110029970	Arasaratnam	Feb 2011	A1
20110029984	Norman et al.	Feb 2011	A1
20110040812	Phillips	Feb 2011	A1
20110055378	Ferris et al.	Mar 2011	A1
20110055396	DeHaan	Mar 2011	A1
20110055683	Jiang	Mar 2011	A1
20110078679	Bozek et al.	Mar 2011	A1
20110099204	Thaler	Apr 2011	A1
20110099551	Fahrig et al.	Apr 2011	A1
20110131572	Elyashev et al.	Jun 2011	A1
20110134761	Smith	Jun 2011	A1
20110141124	Halls et al.	Jun 2011	A1
20110153541	Koch et al.	Jun 2011	A1
20110153727	Li	Jun 2011	A1
20110153838	Belkine et al.	Jun 2011	A1
20110154353	Theroux et al.	Jun 2011	A1
20110173637	Brandwine et al.	Jul 2011	A1
20110179162	Mayo et al.	Jul 2011	A1
20110184993	Chawla et al.	Jul 2011	A1
20110225277	Freimuth et al.	Sep 2011	A1
20110231680	Padmanabhan et al.	Sep 2011	A1
20110247005	Benedetti et al.	Oct 2011	A1
20110258603	Wisnovsky et al.	Oct 2011	A1
20110265067	Schulte et al.	Oct 2011	A1
20110265069	Fee et al.	Oct 2011	A1
20110265164	Lucovsky	Oct 2011	A1
20110271276	Ashok et al.	Nov 2011	A1
20110276945	Chasman et al.	Nov 2011	A1
20110276963	Wu et al.	Nov 2011	A1
20110296412	Banga et al.	Dec 2011	A1
20110314465	Smith et al.	Dec 2011	A1
20110321033	Kelkar et al.	Dec 2011	A1
20110321051	Rastogi	Dec 2011	A1
20120011496	Shimamura	Jan 2012	A1
20120011511	Horvitz et al.	Jan 2012	A1
20120016721	Weinman	Jan 2012	A1
20120041970	Ghosh et al.	Feb 2012	A1
20120054744	Singh et al.	Mar 2012	A1
20120060207	Mardikar	Mar 2012	A1
20120072762	Atchison et al.	Mar 2012	A1
20120072914	Ota	Mar 2012	A1
20120072920	Kawamura	Mar 2012	A1
20120079004	Herman	Mar 2012	A1
20120096271	Ramarathinam et al.	Apr 2012	A1
20120096468	Chakravorty et al.	Apr 2012	A1
20120102307	Wong	Apr 2012	A1
20120102333	Wong	Apr 2012	A1
20120102481	Mani et al.	Apr 2012	A1
20120102493	Allen et al.	Apr 2012	A1
20120110155	Adlung et al.	May 2012	A1
20120110164	Frey et al.	May 2012	A1
20120110570	Jacobson et al.	May 2012	A1
20120110588	Bieswanger et al.	May 2012	A1
20120131379	Tameshige et al.	May 2012	A1
20120144290	Goldman et al.	Jun 2012	A1
20120166624	Suit et al.	Jun 2012	A1
20120192184	Burckart et al.	Jul 2012	A1
20120197795	Campbell et al.	Aug 2012	A1
20120197958	Nightingale et al.	Aug 2012	A1
20120198442	Kashyap et al.	Aug 2012	A1
20120198514	McCune et al.	Aug 2012	A1
20120204164	Castanos et al.	Aug 2012	A1
20120209947	Glaser et al.	Aug 2012	A1
20120222038	Katragadda et al.	Aug 2012	A1
20120233464	Miller et al.	Sep 2012	A1
20120324236	Srivastava et al.	Dec 2012	A1
20120331113	Jain et al.	Dec 2012	A1
20130014101	Ballani et al.	Jan 2013	A1
20130042234	DeLuca et al.	Feb 2013	A1
20130054804	Jana et al.	Feb 2013	A1
20130054927	Raj et al.	Feb 2013	A1
20130055262	Lubsey et al.	Feb 2013	A1
20130061208	Tsao et al.	Mar 2013	A1
20130061212	Krause et al.	Mar 2013	A1
20130061220	Gnanasambandam et al.	Mar 2013	A1
20130067484	Sonoda et al.	Mar 2013	A1
20130067494	Srour et al.	Mar 2013	A1
20130080641	Lui et al.	Mar 2013	A1
20130091387	Bohnet et al.	Apr 2013	A1
20130097601	Podvratnik et al.	Apr 2013	A1
20130111032	Alapati et al.	May 2013	A1
20130111469	B et al.	May 2013	A1
20130124807	Nielsen et al.	May 2013	A1
20130132942	Wang	May 2013	A1
20130132953	Chuang et al.	May 2013	A1
20130139152	Chang et al.	May 2013	A1
20130139166	Zhang et al.	May 2013	A1
20130151587	Takeshima et al.	Jun 2013	A1
20130151648	Luna	Jun 2013	A1
20130151684	Forsman et al.	Jun 2013	A1
20130152047	Moorthi et al.	Jun 2013	A1
20130167147	Corrie et al.	Jun 2013	A1
20130179574	Calder et al.	Jul 2013	A1
20130179881	Calder et al.	Jul 2013	A1
20130179894	Calder et al.	Jul 2013	A1
20130179895	Calder et al.	Jul 2013	A1
20130185719	Kar et al.	Jul 2013	A1
20130185729	Vasic et al.	Jul 2013	A1
20130191924	Tedesco	Jul 2013	A1
20130198319	Shen et al.	Aug 2013	A1
20130198743	Kruglick	Aug 2013	A1
20130198748	Sharp et al.	Aug 2013	A1
20130198763	Kunze et al.	Aug 2013	A1
20130205092	Roy et al.	Aug 2013	A1
20130219390	Lee et al.	Aug 2013	A1
20130227097	Yasuda et al.	Aug 2013	A1
20130227534	Ike et al.	Aug 2013	A1
20130227563	McGrath	Aug 2013	A1
20130227641	White et al.	Aug 2013	A1
20130227710	Barak et al.	Aug 2013	A1
20130232190	Miller et al.	Sep 2013	A1
20130232480	Wnterfeldt et al.	Sep 2013	A1
20130239125	Iorio	Sep 2013	A1
20130246944	Pandiyan et al.	Sep 2013	A1
20130262556	Xu et al.	Oct 2013	A1
20130263117	Konik et al.	Oct 2013	A1
20130274006	Hudlow et al.	Oct 2013	A1
20130275376	Hudlow et al.	Oct 2013	A1
20130275958	Ivanov et al.	Oct 2013	A1
20130275969	Dimitrov	Oct 2013	A1
20130275975	Masuda et al.	Oct 2013	A1
20130283141	Stevenson et al.	Oct 2013	A1
20130283176	Hoole et al.	Oct 2013	A1
20130290538	Gmach et al.	Oct 2013	A1
20130291087	Kailash et al.	Oct 2013	A1
20130297964	Hegdal et al.	Nov 2013	A1
20130298183	McGrath et al.	Nov 2013	A1
20130311650	Brandwine et al.	Nov 2013	A1
20130326506	McGrath et al.	Dec 2013	A1
20130326507	McGrath et al.	Dec 2013	A1
20130339950	Ramarathinam et al.	Dec 2013	A1
20130346470	Obstfeld et al.	Dec 2013	A1
20130346946	Pinnix	Dec 2013	A1
20130346952	Huang et al.	Dec 2013	A1
20130346964	Nobuoka et al.	Dec 2013	A1
20130346987	Raney et al.	Dec 2013	A1
20130346994	Chen et al.	Dec 2013	A1
20130347095	Barjatiya et al.	Dec 2013	A1
20140007097	Chin et al.	Jan 2014	A1
20140019523	Heymann et al.	Jan 2014	A1
20140019735	Menon et al.	Jan 2014	A1
20140019965	Neuse et al.	Jan 2014	A1
20140019966	Neuse et al.	Jan 2014	A1
20140040343	Nickolov et al.	Feb 2014	A1
20140040857	Trinchini et al.	Feb 2014	A1
20140040880	Brownlow et al.	Feb 2014	A1
20140058871	Marr et al.	Feb 2014	A1
20140059209	Alnoor	Feb 2014	A1
20140059226	Messerli et al.	Feb 2014	A1
20140059552	Cunningham et al.	Feb 2014	A1
20140068568	Wisnovsky	Mar 2014	A1
20140068608	Kulkarni	Mar 2014	A1
20140068611	McGrath et al.	Mar 2014	A1
20140073300	Leeder et al.	Mar 2014	A1
20140081984	Sitsky et al.	Mar 2014	A1
20140082165	Marr et al.	Mar 2014	A1
20140082201	Shankari et al.	Mar 2014	A1
20140101643	Inoue	Apr 2014	A1
20140101649	Kamble et al.	Apr 2014	A1
20140108722	Lipchuk et al.	Apr 2014	A1
20140109087	Jujare et al.	Apr 2014	A1
20140109088	Dournov et al.	Apr 2014	A1
20140129667	Ozawa	May 2014	A1
20140130040	Lemanski	May 2014	A1
20140137110	Engle et al.	May 2014	A1
20140173614	Konik et al.	Jun 2014	A1
20140173616	Bird et al.	Jun 2014	A1
20140180862	Certain et al.	Jun 2014	A1
20140189677	Curzi et al.	Jul 2014	A1
20140189704	Narvaez et al.	Jul 2014	A1
20140201735	Kannan et al.	Jul 2014	A1
20140207912	Thibeault	Jul 2014	A1
20140214752	Rash et al.	Jul 2014	A1
20140215073	Dow et al.	Jul 2014	A1
20140229221	Shih et al.	Aug 2014	A1
20140245297	Hackett	Aug 2014	A1
20140279581	Devereaux	Sep 2014	A1
20140280325	Krishnamurthy et al.	Sep 2014	A1
20140282418	Wood et al.	Sep 2014	A1
20140282559	Verduzco et al.	Sep 2014	A1
20140282615	Cavage et al.	Sep 2014	A1
20140282629	Gupta et al.	Sep 2014	A1
20140283045	Brandwine et al.	Sep 2014	A1
20140289286	Gusak	Sep 2014	A1
20140298295	Overbeck	Oct 2014	A1
20140304246	Helmich et al.	Oct 2014	A1
20140304698	Chigurapati et al.	Oct 2014	A1
20140304815	Maeda	Oct 2014	A1
20140317617	O'Donnell	Oct 2014	A1
20140337953	Banatwala et al.	Nov 2014	A1
20140344457	Bruno, Jr. et al.	Nov 2014	A1
20140344736	Ryman et al.	Nov 2014	A1
20140359093	Raju et al.	Dec 2014	A1
20140372489	Jaiswal et al.	Dec 2014	A1
20140372533	Fu et al.	Dec 2014	A1
20140380085	Rash et al.	Dec 2014	A1
20150033241	Jackson et al.	Jan 2015	A1
20150039891	Ignatchenko et al.	Feb 2015	A1
20150040229	Chan et al.	Feb 2015	A1
20150046926	Kenchammana-Hosekote et al.	Feb 2015	A1
20150046971	Huh	Feb 2015	A1
20150052258	Johnson et al.	Feb 2015	A1
20150058914	Yadav	Feb 2015	A1
20150067019	Balko	Mar 2015	A1
20150067830	Johansson et al.	Mar 2015	A1
20150074659	Madsen et al.	Mar 2015	A1
20150074661	Kothari et al.	Mar 2015	A1
20150074662	Saladi et al.	Mar 2015	A1
20150081885	Thomas et al.	Mar 2015	A1
20150095822	Feis et al.	Apr 2015	A1
20150106805	Melander et al.	Apr 2015	A1
20150120928	Gummaraju et al.	Apr 2015	A1
20150121391	Wang	Apr 2015	A1
20150134626	Theimer et al.	May 2015	A1
20150135287	Medeiros et al.	May 2015	A1
20150142747	Zou	May 2015	A1
20150142952	Bragstad et al.	May 2015	A1
20150143374	Banga et al.	May 2015	A1
20150143381	Chin et al.	May 2015	A1
20150154046	Farkas et al.	Jun 2015	A1
20150161384	Gu et al.	Jun 2015	A1
20150163231	Sobko et al.	Jun 2015	A1
20150178110	Li et al.	Jun 2015	A1
20150186129	Apte et al.	Jul 2015	A1
20150188775	Van Der Walt et al.	Jul 2015	A1
20150199218	Wilson et al.	Jul 2015	A1
20150205596	Hiltegen et al.	Jul 2015	A1
20150227598	Hahn et al.	Aug 2015	A1
20150229645	Keith et al.	Aug 2015	A1
20150235144	Gusev et al.	Aug 2015	A1
20150242225	Muller et al.	Aug 2015	A1
20150254248	Burns et al.	Sep 2015	A1
20150256621	Noda et al.	Sep 2015	A1
20150261578	Greden et al.	Sep 2015	A1
20150264014	Budhani et al.	Sep 2015	A1
20150269494	Kardes et al.	Sep 2015	A1
20150289220	Kim et al.	Oct 2015	A1
20150309923	Iwata et al.	Oct 2015	A1
20150319160	Ferguson et al.	Nov 2015	A1
20150324174	Bromley et al.	Nov 2015	A1
20150324182	Barros et al.	Nov 2015	A1
20150324229	Valine	Nov 2015	A1
20150332048	Mooring et al.	Nov 2015	A1
20150332195	Jue	Nov 2015	A1
20150334173	Coulmeau et al.	Nov 2015	A1
20150350701	Lemus et al.	Dec 2015	A1
20150356294	Tan et al.	Dec 2015	A1
20150363181	Alberti et al.	Dec 2015	A1
20150363304	Nagamalla et al.	Dec 2015	A1
20150370560	Tan et al.	Dec 2015	A1
20150370591	Tuch et al.	Dec 2015	A1
20150370592	Tuch et al.	Dec 2015	A1
20150371244	Neuse et al.	Dec 2015	A1
20150378762	Saladi et al.	Dec 2015	A1
20150378764	Sivasubramanian et al.	Dec 2015	A1
20150378765	Singh et al.	Dec 2015	A1
20150379167	Griffith et al.	Dec 2015	A1
20160011901	Hurwitz et al.	Jan 2016	A1
20160012099	Tuatini et al.	Jan 2016	A1
20160019081	Chandrasekaran et al.	Jan 2016	A1
20160019082	Chandrasekaran et al.	Jan 2016	A1
20160019536	Ortiz et al.	Jan 2016	A1
20160021112	Katieb	Jan 2016	A1
20160026486	Abdallah	Jan 2016	A1
20160048606	Rubinstein et al.	Feb 2016	A1
20160070714	D'Sa et al.	Mar 2016	A1
20160072727	Leafe et al.	Mar 2016	A1
20160077901	Roth et al.	Mar 2016	A1
20160092320	Baca	Mar 2016	A1
20160092493	Ko et al.	Mar 2016	A1
20160098285	Davis et al.	Apr 2016	A1
20160100036	Lo et al.	Apr 2016	A1
20160103739	Huang et al.	Apr 2016	A1
20160110188	Verde et al.	Apr 2016	A1
20160117163	Fukui et al.	Apr 2016	A1
20160117254	Susarla et al.	Apr 2016	A1
20160124665	Jain et al.	May 2016	A1
20160124978	Nithrakashyap et al.	May 2016	A1
20160140180	Park et al.	May 2016	A1
20160150053	Janczuk et al.	May 2016	A1
20160188367	Zeng	Jun 2016	A1
20160191420	Nagarajan et al.	Jun 2016	A1
20160203219	Hoch et al.	Jul 2016	A1
20160212007	Alatorre et al.	Jul 2016	A1
20160226955	Moorthi et al.	Aug 2016	A1
20160282930	Ramachandran et al.	Sep 2016	A1
20160285906	Fine et al.	Sep 2016	A1
20160292016	Bussard et al.	Oct 2016	A1
20160294614	Searle et al.	Oct 2016	A1
20160306613	Busi et al.	Oct 2016	A1
20160315910	Kaufman	Oct 2016	A1
20160350099	Suparna et al.	Dec 2016	A1
20160357536	Firlik et al.	Dec 2016	A1
20160364265	Cao et al.	Dec 2016	A1
20160364316	Bhat et al.	Dec 2016	A1
20160371127	Antony et al.	Dec 2016	A1
20160371156	Merriman	Dec 2016	A1
20160378449	Khazanchi et al.	Dec 2016	A1
20160378547	Brouwer et al.	Dec 2016	A1
20160378554	Gummaraju et al.	Dec 2016	A1
20170004169	Merrill et al.	Jan 2017	A1
20170041144	Krapf et al.	Feb 2017	A1
20170041309	Ekambaram et al.	Feb 2017	A1
20170060615	Thakkar et al.	Mar 2017	A1
20170060621	Whipple et al.	Mar 2017	A1
20170068574	Cherkasova et al.	Mar 2017	A1
20170075749	Ambichl et al.	Mar 2017	A1
20170083381	Cong et al.	Mar 2017	A1
20170085447	Chen et al.	Mar 2017	A1
20170085502	Biruduraju	Mar 2017	A1
20170085591	Ganda et al.	Mar 2017	A1
20170093684	Jayaraman et al.	Mar 2017	A1
20170093920	Ducatel et al.	Mar 2017	A1
20170134519	Chen et al.	May 2017	A1
20170147656	Choudhary et al.	May 2017	A1
20170149740	Mansour et al.	May 2017	A1
20170161059	Wood et al.	Jun 2017	A1
20170177854	Gligor et al.	Jun 2017	A1
20170188213	Nirantar et al.	Jun 2017	A1
20170221000	Anand	Aug 2017	A1
20170230262	Sreeramoju et al.	Aug 2017	A1
20170230499	Mumick et al.	Aug 2017	A1
20170249130	Smiljamic et al.	Aug 2017	A1
20170264681	Apte et al.	Sep 2017	A1
20170272462	Kraemer et al.	Sep 2017	A1
20170286143	Wagner et al.	Oct 2017	A1
20170286187	Chen et al.	Oct 2017	A1
20170308520	Beahan, Jr. et al.	Oct 2017	A1
20170315163	Wang et al.	Nov 2017	A1
20170329578	Iscen	Nov 2017	A1
20170346808	Anzai et al.	Nov 2017	A1
20170353851	Gonzalez et al.	Dec 2017	A1
20170364345	Fontoura et al.	Dec 2017	A1
20170371720	Basu et al.	Dec 2017	A1
20170371724	Wagner et al.	Dec 2017	A1
20170372142	Bilobrov	Dec 2017	A1
20180004555	Ramanathan et al.	Jan 2018	A1
20180004556	Marriner et al.	Jan 2018	A1
20180004575	Marriner et al.	Jan 2018	A1
20180046453	Nair et al.	Feb 2018	A1
20180046482	Karve et al.	Feb 2018	A1
20180060132	Maru et al.	Mar 2018	A1
20180060221	Yim et al.	Mar 2018	A1
20180060318	Yang et al.	Mar 2018	A1
20180067841	Mahimkar	Mar 2018	A1
20180069702	Ayyadevara	Mar 2018	A1
20180081717	Li	Mar 2018	A1
20180089232	Spektor et al.	Mar 2018	A1
20180095738	Dürkop et al.	Apr 2018	A1
20180121245	Wagner et al.	May 2018	A1
20180121665	Anderson et al.	May 2018	A1
20180129684	Wilson et al.	May 2018	A1
20180143865	Wagner et al.	May 2018	A1
20180150339	Pan et al.	May 2018	A1
20180192101	Bilobrov	Jul 2018	A1
20180225096	Mishra et al.	Aug 2018	A1
20180239636	Arora et al.	Aug 2018	A1
20180253333	Gupta	Sep 2018	A1
20180268130	Ghosh et al.	Sep 2018	A1
20180275987	Vandeputte	Sep 2018	A1
20180285101	Yahav et al.	Oct 2018	A1
20180300111	Bhat et al.	Oct 2018	A1
20180309819	Thompson	Oct 2018	A1
20180314845	Anderson et al.	Nov 2018	A1
20180316552	Subramani Nadar et al.	Nov 2018	A1
20180341504	Kissell	Nov 2018	A1
20180365422	Callaghan et al.	Dec 2018	A1
20190004866	Du et al.	Jan 2019	A1
20190028552	Johnson, II et al.	Jan 2019	A1
20190043231	Uzgin et al.	Feb 2019	A1
20190072529	Andrawes et al.	Mar 2019	A1
20190079751	Foskett et al.	Mar 2019	A1
20190102231	Wagner	Apr 2019	A1
20190108058	Wagner et al.	Apr 2019	A1
20190140831	De Lima Junior et al.	May 2019	A1
20190147085	Pal et al.	May 2019	A1
20190155629	Wagner et al.	May 2019	A1
20190171423	Mishra et al.	Jun 2019	A1
20190171470	Wagner	Jun 2019	A1
20190179725	Mital et al.	Jun 2019	A1
20190180036	Shukla	Jun 2019	A1
20190188288	Holm et al.	Jun 2019	A1
20190196884	Wagner	Jun 2019	A1
20190227849	Wisniewski et al.	Jul 2019	A1
20190235848	Swiecki et al.	Aug 2019	A1
20190238590	Talukdar et al.	Aug 2019	A1
20190250937	Thomas et al.	Aug 2019	A1
20190286475	Mani	Sep 2019	A1
20190286492	Gulsvig Wood et al.	Sep 2019	A1
20190303117	Kocberber et al.	Oct 2019	A1
20190318312	Foskett et al.	Oct 2019	A1
20190361802	Li et al.	Nov 2019	A1
20190363885	Schiavoni et al.	Nov 2019	A1
20190384647	Reque et al.	Dec 2019	A1
20190391834	Mullen et al.	Dec 2019	A1
20200007456	Greenstein et al.	Jan 2020	A1
20200026527	Xu et al.	Jan 2020	A1
20200028936	Gupta et al.	Jan 2020	A1
20200057680	Marriner et al.	Feb 2020	A1
20200065079	Kocberber et al.	Feb 2020	A1
20200073770	Mortimore, Jr. et al.	Mar 2020	A1
20200073987	Perumala et al.	Mar 2020	A1
20200081745	Cybulski et al.	Mar 2020	A1
20200104198	Hussels et al.	Apr 2020	A1
20200104378	Wagner et al.	Apr 2020	A1
20200110691	Bryant et al.	Apr 2020	A1
20200120120	Cybulski	Apr 2020	A1
20200142724	Wagner et al.	May 2020	A1
20200153897	Mestery et al.	May 2020	A1
20200167208	Floes et al.	May 2020	A1
20200192707	Brooker et al.	Jun 2020	A1
20200213151	Srivatsan et al.	Jul 2020	A1
20200341799	Wagner et al.	Oct 2020	A1
20200366587	White et al.	Nov 2020	A1
20200412707	Siefker et al.	Dec 2020	A1
20200412825	Siefker et al.	Dec 2020	A1
20210081233	Mullen et al.	Mar 2021	A1

Foreign Referenced Citations (48)

Number	Date	Country
2975522	Aug 2016	CA
1341238	Mar 2002	CN
101002170	Jul 2007	CN
101345757	Jan 2009	CN
101496005	Jul 2009	CN
2663052	Nov 2013	EP
3201762	Aug 2017	EP
3254434	Dec 2017	EP
3201768	Dec 2019	EP
3811209	Apr 2021	EP
2002287974	Oct 2002	JP
2006-107599	Apr 2006	JP
2007-538323	Dec 2007	JP
2010-026562	Feb 2010	JP
2011-065243	Mar 2011	JP
2011-233146	Nov 2011	JP
2011257847	Dec 2011	JP
2013-156996	Aug 2013	JP
2014-525624	Sep 2014	JP
2017-534107	Nov 2017	JP
2017-534967	Nov 2017	JP
2018-503896	Feb 2018	JP
2018-512087	May 2018	JP
2018-536213	Dec 2018	JP
10-357850	Oct 2002	KR
WO 2008114454	Sep 2008	WO
WO 2009137567	Nov 2009	WO
WO 2012039834	Mar 2012	WO
WO 2012050772	Apr 2012	WO
WO 2013106257	Jul 2013	WO
WO 2015078394	Jun 2015	WO
WO 2015108539	Jul 2015	WO
WO 2016053950	Apr 2016	WO
WO 2016053968	Apr 2016	WO
WO 2016053973	Apr 2016	WO
WO 2016090292	Jun 2016	WO
WO 2016126731	Aug 2016	WO
WO 2016164633	Oct 2016	WO
WO 2016164638	Oct 2016	WO
WO 2017059248	Apr 2017	WO
WO 2017112526	Jun 2017	WO
WO 2017172440	Oct 2017	WO
WO 2018005829	Jan 2018	WO
WO 2018098443	May 2018	WO
WO 2018098445	May 2018	WO
WO 2020005764	Jan 2020	WO
WO 2020006081	Jan 2020	WO
WO 2020069104	Apr 2020	WO

Non-Patent Literature Citations (122)

Entry
Bebenita et al., “Trace-Based Compilation in Execution Environments without Interpreters,” ACM, Copyright 2010, 10 pages.
Bryan Liston, “Ad Hoc Big Data Processing Made Simple with Serverless Map Reduce”, Nov. 4, 2016, Amazon Web Services <https :/laws. amazon .com/blogs/compute/ad-hoc-big-data-processi ng-made-si mple-with-serverless-mapred uce >.
Dean et al, “MapReduce: Simplified Data Processing on Large Clusters”, ACM, 2008, pp. 107-113.
Ekanayake et al, “Twister: A Runtime for Iterative MapReduce”, ACM, 2010, pp. 810-818.
Fan et al., Online Optimization of VM Deployment in laaS Cloud, 2012, 6 pages.
Hammoud et al, “Locality-Aware Reduce Task Scheduling for MapReduce”, IEEE, 2011, pp. 570-576.
Kim et al, “MRBench: A Benchmark for Map-Reduce Framework”, IEEE, 2008, pp. 11-18.
Lin, “MR-Apriori: Association Rules Algorithm Based on MapReduce”, IEEE, 2014, pp. 141-144.
Search Query Report from IP.com, performed Dec. 2, 2020.
Yang, The Application of MapReduce in the Cloud Computing:, IEEE, 2011, pp. 154-156.
Office Action in European Application No. 19199402.9 dated Mar. 23, 2021.
Office Action in Japanese Application No. 2017-516160 dated Jan. 15, 2018.
Notice of Allowance in Japanese Application No. 2017-516160 dated May 8, 2018.
Office Action in Indian Application No. 201717013356 dated Jan. 22, 2021.
Office Action in Japanese Application No. 2017-516168 dated Mar. 26, 2018.
Office Action in Indian Application No. 201717019903 dated May 18, 2020.
Office Action in Australian Application No. 2016215438 dated Feb. 26, 2018.
Notice of Allowance in Australian Application No. 2016215438 dated Nov. 19, 2018.
Office Action in Canadian Application No. 2,975,522 dated Jun. 5, 2018.
Notice of Allowance in Canadian Application No. 2,975,522 dated Mar. 13, 2020.
Office Action in Indian Application No. 201717027369 dated May 21, 2020.
First Examination Report for Indian Application No. 201717034806 dated Jun. 25, 2020.
Office Action in European Application No. 16781265.0 dated Jul. 13, 2020.
Office Action in European Application No. 201817013748 dated Nov. 20, 2020.
Office Action in European Application No. 16823419.3 dated Mar. 12, 2021.
Office Action in European Application No. 17776325.7 dated Apr. 12, 2021.
Office Action in European Application No. 17740533.9 dated May 4, 2021.
Office Action in European Application No. 17743108.7 dated Dec. 22, 2020.
International Preliminary Report on Patentability dated Dec. 29, 2020 for International Application No. PCT/US2019/039246 in 8 pages.
International Preliminary Report on Patentability for Application No. PCT/US2019/038520 dated Dec. 29, 2020.
International Preliminary Report on Patentability and Written Opinion in PCT/US2019/053123 dated Mar. 23, 2021.
International Search Report and Written Opinion in PCT/US2019/053123 dated Jan. 7, 2020.
International Search Report for Application No. PCT/US2019/065365 dated Mar. 19, 2020.
International Search Report for Application No. PCT/US2020/062060 dated Mar. 5, 2021.
U.S. Appl. No. 16/457,570, Connection Pooling for Scalable Network Services, filed Jun. 28, 2019.
U.S. Appl. No. 16/457,537, Facilitating Service Connections in Serverless Code Executions, filed Jun. 28, 2019.
Anonymous: “Docker run reference”, Dec. 7, 2015, XP055350246, Retrieved from the Internet: URL:https://web.archive.org/web/20151207111702/https:/docs.docker.com/engine/reference/run/ [retrieved on Feb. 28, 2017].
Adapter Pattern, Wikipedia, https://en.wikipedia.org/w/index.php?title=Adapter_pattern&oldid=654971255, [retrieved May 26, 2016], 6 pages.
Amazon, “AWS Lambda: Developer Guide”, Retrieved from the Internet, Jun. 26, 2016, URL : http://docs.aws.amazon.com/lambda/ latest/dg/lambda-dg.pdf, 346 pages.
Amazon, “AWS Lambda: Developer Guide”, Retrieved from the Internet, 2019, URL : http://docs.aws.amazon.com/lambda/ latest/dg/lambda-dg.pdf, 521 pages.
Balazinska et al., Moirae: History-Enhanced Monitoring, Published: 2007, 12 pages.
Ben-Yehuda et al., “Deconstructing Amazon EC2 Spot Instance Pricing”, ACM Transactions on Economics and Computation 1.3, 2013, 15 pages.
Bhadani et al., Performance evaluation of web servers using central load balancing policy over virtual machines on cloud, Jan. 2010, 4 pages.
CodeChef ADMIN discussion web page, retrieved from https://discuss.codechef.com/t/what-are-the-memory-limit-and-stack-size-on-codechef/14159, 2019.
CodeChef IDE web page, Code, Compile & Run, retrieved from https://www.codechef.com/ide, 2019.
Czajkowski, G., and L. Daynes, Multitasking Without Compromise: A Virtual Machine Evolution 47(4a):60-73, ACM SIGPLAN Notices—Supplemental Issue, Apr. 2012.
Das et al., Adaptive Stream Processing using Dynamic Batch Sizing, 2014, 13 pages.
Deis, Container, 2014, 1 page.
Dombrowski, M., et al., Dynamic Monitor Allocation in the Java Virtual Machine, JTRES '13, Oct. 9-11, 2013, pp. 30-37.
Dynamic HTML, Wikipedia page from date Mar. 27, 2015, retrieved using the WayBackMachine, from https://web.archive.org/web/20150327215418/https://en.wikipedia.org/wiki/Dynamic_HTML, 2015, 6 pages.
Espadas, J., et al., A Tenant-Based Resource Allocation Model for Scaling Software-as-a-Service Applications Over Cloud Computing Infrastructures, Future Generation Computer Systems, vol. 29, pp. 273-286, 2013.
Han et al., Lightweight Resource Scaling for Cloud Applications, 2012, 8 pages.
Hoffman, Auto scaling your website with Amazon Web Services (AWS)—Part 2, Cardinalpath, Sep. 2015, 15 pages.
http://discuss.codechef.com discussion web page from date Nov. 11, 2012, retrieved using the WayBackMachine, from https://web.archive.org/web/20121111040051 /http://discuss.codechef.com/questions/2881 /why-are-simple-java-programs-using-up-so-much-space, 2012.
https://www.codechef.com code error help page from Jan. 2014, retrieved from https://www.codechef.com/JAN14/status/ERROR,va123, 2014.
http://www.codechef.com/ide web page from date Apr. 5, 2015, retrieved using the WayBackMachine, from https://web.archive.org/web/20150405045518/http://www.codechef.com/ide, 2015.
Kamga et al., Extended scheduler for efficient frequency scaling in virtualized systems, Jul. 2012, 8 pages.
Kato, et al. “Web Service Conversion Architecture of the Web Application and Evaluation”; Research Report from Information Processing Society, Apr. 3, 2006 with Machine Translation.
Kazempour et al., AASH: an asymmetry-aware scheduler for hypervisors, Jul. 2010, 12 pages.
Kraft et al., 10 performance prediction in consolidated virtualized environments, Mar. 2011, 12 pages.
Krsul et al., “VMPlants: Providing and Managing Virtual Machine Execution Environments for Grid Computing”, Supercomputing, 2004. Proceedings of the ACM/IEEESC 2004 Conference Pittsburgh, PA, XP010780332, Nov. 6-12, 2004, 12 pages.
Meng et al., Efficient resource provisioning in compute clouds via VM multiplexing, Jun. 2010, 10 pages.
Merkel, “Docker: Lightweight Linux Containers for Consistent Development and Deployment”, Linux Journal, vol. 2014 Issue 239, Mar. 2014, XP055171140, 16 pages.
Monteil, Coupling profile and historical methods to predict execution time of parallel applications. Parallel and Cloud Computing, 2013, <hal-01228236, pp. 81-89.
Nakajima, J., et al., Optimizing Virtual Machines Using Hybrid Virtualization, SAC '11, Mar. 21-25, 2011, TaiChung, Taiwan, pp. 573-578.
Qian, H., and D. Medhi, et al., Estimating Optimal Cost of Allocating Virtualized Resources With Dynamic Demand, ITC 2011, Sep. 2011, pp. 320-321.
Sakamoto, et al. “Platform for Web Services using Proxy Server”; Research Report from Information Processing Society, Mar. 22, 2002, vol. 2002, No. 31.
Shim (computing), Wikipedia, https://en.wikipedia.org/w/index.php?title+Shim_(computing)&oldid+654971528, [retrieved on May 26, 2016], 2 pages.
Stack Overflow, Creating a database connection pool, 2009, 4 pages.
Tan et al., Provisioning for large scale cloud computing services, Jun. 2012, 2 pages.
Vaghani, S.B., Virtual Machine File System, ACM SIGOPS Operating Systems Review 44(4):57-70, Dec. 2010.
Vaquero, L., et al., Dynamically Scaling Applications in the cloud, ACM SIGCOMM Computer Communication Review 41(1):45-52, Jan. 2011.
Wang et al., “Improving utilization through dynamic VM resource allocation in hybrid cloud environment”, Parallel and Distributed V Systems (ICPADS), IEEE, 2014. Retrieved on Feb. 14, 2019, Retrieved from the internet: URL<https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=7097814, 8 pages.
Wikipedia “API” pages from date Apr. 7, 2015, retrieved using the WayBackMachine from https://web.archive.org/web/20150407191158/https://en .wikipedia.org/wiki/Application_programming_interface.
Wikipedia List_of_HTTP status_codes web page, retrieved from https://en.wikipedia.org/wiki/List_of_HTTP status_codes, 2019.
Wikipedia Recursion web page from date Mar. 26, 2015, retrieved using the WayBackMachine, from https://web.archive.org/web/20150326230100/https://en.wikipedia.org/wiki/Recursion_(computer _science), 2015.
Wikipedia subroutine web page, retrieved from https://en.wikipedia.org/wiki/Subroutine, 2019.
Wu et al., HC-Midware: A Middleware to Enable High Performance Communication System Simulation in Heterogeneous Cloud, Association for Computing Machinery, Oct. 20-22, 2017, 10 pages.
Yamasaki et al. “Model-based resource selection for efficient virtual cluster deployment”, Virtualization Technology in Distributed Computing, ACM, Nov. 2007, pp. 1-7.
Yue et al., AC 2012-4107: Using Amazon EC2 in Computer and Network Security Lab Exercises: Design, Results, and Analysis, 2012, American Society for Engineering Education 2012.
Zheng, C., and D. Thain, Integrating Containers into Workflows: A Case Study Using Makeflow, Work Queue, and Docker, VTDC '15, Jun. 15, 2015, Portland, Oregon, pp. 31-38.
International Search Report and Written Opinion in PCT/US2015/052810 dated Dec. 17, 2015.
International Preliminary Report on Patentability in PCT/US2015/052810 dated Apr. 4, 2017.
Extended Search Report in European Application No. 15846932.0 dated May 3, 2018.
International Search Report and Written Opinion in PCT/US2015/052838 dated Dec. 18, 2015.
International Preliminary Report on Patentability in PCT/US2015/052838 dated Apr. 4, 2017.
Extended Search Report in European Application No. 15847202.7 dated Sep. 9, 2018.
International Search Report and Written Opinion in PCT/US2015/052833 dated Jan. 13, 2016.
International Preliminary Report on Patentability in PCT/US2015/052833 dated Apr. 4, 2017.
Extended Search Report in European Application No. 15846542.7 dated Aug. 27, 2018.
International Search Report and Written Opinion in PCT/US2015/064071 dated Mar. 16, 2016.
International Preliminary Report on Patentability in PCT/US2015/064071 dated Jun. 6, 2017.
International Search Report and Written Opinion in PCT/US2016/016211 dated Apr. 13, 2016.
International Preliminary Report on Patentability in PCT/US2016/016211 dated Aug. 17, 2017.
International Search Report and Written Opinion in PCT/US2016/026514 dated Jun. 8, 2016.
International Preliminary Report on Patentability in PCT/US2016/026514 dated Oct. 10, 2017.
International Search Report and Written Opinion in PCT/US2016/026520 dated Jul. 5, 2016.
International Preliminary Report on Patentability in PCT/US2016/026520 dated Oct. 10, 2017.
International Search Report and Written Opinion in PCT/US2016/054774 dated Dec. 16, 2016.
International Preliminary Report on Patentability in PCT/US2016/054774 dated Apr. 3, 2018.
International Search Report and Written Opinion in PCT/US2016/066997 dated Mar. 20, 2017.
International Preliminary Report on Patentability in PCT/US2016/066997 dated Jun. 26, 2018.
International Search Report and Written Opinion in PCT/US/2017/023564 dated Jun. 6, 2017.
International Preliminary Report on Patentability in PCT/US/2017/023564 dated Oct. 2, 2018.
International Search Report and Written Opinion in PCT/US2017/040054 dated Sep. 21, 2017.
International Preliminary Report on Patentability in PCT/US2017/040054 dated Jan. 1, 2019.
International Search Report and Written Opinion in PCT/US2017/039514 dated Oct. 10, 2017.
International Preliminary Report on Patentability in PCT/US2017/039514 dated Jan. 1, 2019.
Extended European Search Report in application No. 17776325.7 dated Oct. 23, 2019.
Office Action in European Application No. 17743108.7 dated Jan. 14, 2020.
Ha et al., A Concurrent Trace-based Just-In-Time Compiler for Single-threaded JavaScript, utexas.edu (Year: 2009).
Huang, Zhe, Danny HK Tsang, and James She. “A virtual machine consolidation framework for mapreduce enabled computing clouds.” 2012 24th International Teletraffic Congress (ITC 24). IEEE, 2012. (Year: 2012).
Lagar-Cavilla, H. Andres, et al. “Snowflock: Virtual machine cloning as a first-class cloud primitive.” ACM Transactions on Computer Systems (TOCS) 29.1 (2011): 1-45. (Year: 2011).
Tange, “GNU Parallel: The Command-Line Power Tool”, vol. 36, No. 1, Jan. 1, 1942, pp. 42-47.
Wood, Timothy, et al. “Cloud Net: dynamic pooling of cloud resources by live WAN migration of virtual machines.” ACM Sigplan Notices 46.7 (2011): 121-132. (Year: 2011).
Zhang et al., VMThunder: Fast Provisioning of Large-Scale Virtual Machine Clusters, IEEE Transactions on Parallel and Distributed Systems, vol. 25, No. 12, Dec. 2014, pp. 3328-3338.
Extended Search Report in European Application No. 19199402.9 dated Mar. 6, 2020.
Office Action in Canadian Application No. 2,962,633 dated May 21, 2020.
Office Action in Canadian Application No. 2,962,631 dated May 19, 2020.
International Search Report for Application No. PCT/US2019/038520 dated Aug. 14, 2019.
International Search Report and Written Opinion dated Oct. 15, 2019 for International Application No. PCT/US2019/039246 in 16 pages.
International Search Report for Application No. PCT/US2020/039996 dated Oct. 8, 2020.

Related Publications (1)

	Number	Date	Country
	20200412720 A1	Dec 2020	US

Authentication to network-services using hosted authentication information

Information

Patent Number

Date Filed

Date Issued

Inventors

Original Assignees

Examiners

Agents

CPC

Field of Search

CPC

International Classifications