Efficient and secure communication between computational instances of a remote network management platform

Patent metadata

Field	Value
Publication number	US-11729170-B2
Application number	US-201916359797-A
Country	US
Kind code	B2
Filing date	Mar 20, 2019
Priority date	Mar 20, 2019
Publication date	Aug 15, 2023
Grant date	Aug 15, 2023

Abstract

A remote network management platform may include a provider computing instance, a recipient computing instance, and a neutral computing instance including persistent storage that defines a table and fields therein, and where the neutral computing instance is configured to: (i) receive, by way of a first software interface, data from the provider computing instance, where the data is an update to a field within the table; (ii) validate that the provider computing instance is permitted to update the field; (iii) write a representation of the data to the field; (iv) receive, by way of a second software interface, a request from the recipient computing instance for the data; (v) validate that the recipient computing instance is permitted to access the field; and (vi) transmit the data as stored in the field to the recipient computing instance.

First claim

What is claimed is:

1. A remote network management platform comprising:
a provider computing instance disposed upon hardware dedicated to a first entity;
a recipient computing instance disposed upon hardware dedicated to a second entity, wherein each of the provider computing instance and the recipient computing instance represent one or more server devices, one or more databases, or both, configured to provide a set of web portals, services, and applications; and
a neutral computing instance including one or more processors and persistent storage, wherein the persistent storage stores a table comprising a plurality of fields, wherein the neutral computing instance is disposed upon hardware that is dedicated to neither the first entity nor the second entity, wherein each of the provider computing instance, the recipient computing instance, and the neutral computing instance are logically and physically separate from one another, wherein the provider computing instance and the recipient computing instance are configured to exchange data via the table of the neutral computing instance rather than directly with one another, and wherein the neutral computing instance is configured to:
receive, from the provider computing instance, by way of a first software interface, a request to create the table and the plurality of fields of the table;
validate that the provider computing instance is permitted to create the table;
in response to validating that the provider computing instance is permitted to create the table, create the table in the persistent storage;
receive, by way of the first software interface, a set of data from the provider computing instance, wherein the first software interface or the set of data indicates that the set of data is an update to a field of the plurality of fields within the table;
validate that the provider computing instance is permitted to update the field;
in response to validating that the provider computing instance is permitted to update the field, write a representation of the set of data to the field;
receive, by way of a second software interface, a request from the recipient computing instance to access the set of data as stored in the field;
validate that the recipient computing instance is permitted to access the field; and
in response to validating that the recipient computing instance is permitted to access the field, transmit the set of data as stored in the field to the recipient computing instance.

2. The remote network management platform of claim 1 , wherein only the provider computing instance is permitted to update the field, and wherein the recipient computing instance has read-only access to the field.

3. The remote network management platform of claim 1 , comprising:
a second recipient computing instance disposed upon hardware dedicated to a third entity, wherein the neutral computing instance is configured to:
receive, by way of the second software interface, a second request from the second recipient computing instance for the set of data as stored in the field;
validate that the second recipient computing instance is permitted to access the field; and
in response to validating that the second recipient computing instance is permitted to access the field, transmit the set of data as stored in the field to the second recipient computing instance.

4. The remote network management platform of claim 1 , wherein the neutral computing instance is configured to:
in response to writing the representation of the set of data to the field, transmit a notification to the recipient computing instance indicating that the field has been updated, wherein receipt of the notification causes the recipient computing instance to transmit the request for the set of data as stored in the field.

5. The remote network management platform of claim 1 , wherein the provider computing instance is permitted to delete tables within the persistent storage.

6. The remote network management platform of claim 1 , wherein the provider computing instance and the recipient computing instance are both permitted to update the table.

7. The remote network management platform of claim 1 , wherein the neutral computing instance is configured to:
receive, by way of a third software interface, a second set of data from the recipient computing instance, wherein the third software interface or the second set of data indicates that the second set of data is an update to a second field of the plurality of fields within the table;
validate that the recipient computing instance is permitted to update the second field;
in response to validating that the recipient computing instance is permitted to update the second field, write a representation of the second set of data to the second field;
receive, by way of a fourth software interface, a second request from the provider computing instance to access the second set of data as stored in the second field;
validate that the provider computing instance is permitted to access the second field; and
in response to validating that the provider computing instance is permitted to access the second field, transmit the second set of data as stored in the second field to the provider computing instance.

8. The remote network management platform of claim 1 , wherein the first software interface is different from the second software interface.

9. The remote network management platform of claim 1 , wherein the first software interface and the second software interface are representational state transfer (REST) or simple object access protocol (SOAP) interfaces.

10. The remote network management platform of claim 1 , wherein validating that the provider computing instance is permitted to update the field comprises validating that the provider computing instance is permitted to write to the field.

11. The remote network management platform of claim 1 , comprising an Application Platform as a Service (aPaaS) system, wherein the aPaaS system is configured to provide the set of web portals, services, and applications to the provider computing instance and the recipient computing instance via the one or more server devices, the one or more databases, or both.

12. The remote network management platform of claim 11 , wherein the aPaaS system is configured to support development and execution of model-view-controller (MVC) applications, and wherein the MVC applications comprise web-based applications configured to provide create, read, update, and delete (CRUD) capabilities.

13. A computer-implemented method, wherein a remote network management platform includes (i) a provider computing instance disposed upon hardware dedicated to a first entity, (ii) a recipient computing instance disposed upon hardware dedicated to a second entity, and (iii) a neutral computing instance including one or more processors and persistent storage, wherein the persistent storage stores a table comprising a plurality of fields, wherein the neutral computing instance is disposed upon hardware that is dedicated to neither the first entity nor the second entity, wherein each of the provider computing instance and the recipient computing instance represent one or more server devices, one or more databases, or both, configured to provide a set of web portals, services, and applications, wherein each of the provider computing instance, the recipient computing instance, and the neutral computing instance are logically and physically separate from one another, wherein the provider computing instance and the recipient computing instance are configured to exchange data via the table of the neutral computing instance rather than directly with one

Assignees

• Servicenow Inc

Inventors

• Jafari Amir Vakili
• Blakeman Colby Andrew
• Tripathy Meenakshi
• Damodaran Praveen Minnikaran
• Meonske Ryan
• Soundararajan Bharath

Classifications

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• G06F16/2379

  Updates performed during online database operations; commit processing · CPC title

• H04L41/20

  Network management software packages · CPC title

• H04L63/029 Primary

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04L63/0209

  Architectural arrangements, e.g. perimeter networks or demilitarized zones · CPC title