Patents by Inventor Omer Hashmi

Omer Hashmi has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).

  • Patent number: 10797989
    Abstract: Metadata indicating that an action implementation node and a routing decision master node have been assigned to a virtual traffic hub programmatically associated with one or more isolated networks is stored. The routing decision master node determines a first action to be implemented for packets of a network flow using state information of the isolated networks, and provides a representation of a first action to the first action implementation node. Based on performing the first action at the action implementation node, contents of a data packet received from one isolated network are transmitted to another isolated network.
    Type: Grant
    Filed: September 19, 2018
    Date of Patent: October 6, 2020
    Assignee: Amazon Technologies, Inc.
    Inventors: Paul John Tillotson, Bashuman Deb, Thomas Spendley, Omer Hashmi, Baihu Qian, Alexander Justin Penney
  • Patent number: 10798179
    Abstract: A system includes a virtual private gateway (VGW) provisioning service that is configured to receive a request to establish a VGW. The request specifies a service accessible through the VGW and a customer-configurable policy. The policy restricts access to the specified service to requests sent via the VGW to the specified service. Responsive to the request, the VGW provisioning service instantiates a VGW virtual machine. The VGW virtual machine includes a VGW application configured to establish a secure tunnel over a public network to a remote node and to receive encrypted traffic from the remote node over the secure tunnel. The VGW provisioning service also causes route data for the specified service to be provided to the VGW virtual machine. The VGW application advertises the route data for the specified service over the secure tunnel. The VGW provisioning service provides the policy to the identified service for compliance thereon.
    Type: Grant
    Filed: February 1, 2017
    Date of Patent: October 6, 2020
    Assignee: Amazon Technologies, Inc.
    Inventor: Omer Hashmi
  • Patent number: 10785146
    Abstract: An isolated packet processing cell of a packet processing service, comprising an action implementation node and a decision master node, is assigned to an application. An indication of processing rules of the application is transmitted to the decision master node. In response to receiving a particular packet, the action implementation node obtains a representation of an action (which is based on the processing rules) from the decision master node and executes the action.
    Type: Grant
    Filed: September 19, 2018
    Date of Patent: September 22, 2020
    Assignee: Amazon Technologies, Inc.
    Inventors: Paul John Tillotson, Bashuman Deb, Thomas Spendley, Omer Hashmi, Baihu Qian, Alexander Justin Penney
  • Patent number: 10757009
    Abstract: Network pathways are identified to transfer packets between a pair of regional virtual traffic hubs of a provider network. At a first hub of the pair, a first action is performed, resulting in a transmission of a packet received from a first isolated network to the second hub along a pathway selected using dynamic routing parameters. At the second hub, a second action is performed, resulting in the transmission of the packet to a destination within a second isolated network.
    Type: Grant
    Filed: November 20, 2018
    Date of Patent: August 25, 2020
    Assignee: Amazon Technologies, Inc.
    Inventors: Bashuman Deb, Paul John Tillotson, Thomas Nguyen Spendley, Omer Hashmi, Baihu Qian, Mohamed Nader Farahat Hassan
  • Patent number: 10742554
    Abstract: At an action implementation layer of a virtual traffic hub, a packet is obtained from a first isolated network. A first action, generated at a decision making layer of the hub based on a first route table of the hub, is performed, resulting in transmission of at least one network packet to a first destination. In response to a second packet, obtained at the action implementation layer from a source outside the first isolated network, a second action is performed, resulting in transmission of at least one packet to a second destination. The second action is generated based on a second route table of the hub.
    Type: Grant
    Filed: November 20, 2018
    Date of Patent: August 11, 2020
    Assignee: Amazon Technologies, Inc.
    Inventors: Bashuman Deb, Paul John Tillotson, Thomas Nguyen Spendley, Omer Hashmi, Baihu Qian, Mohamed Nader Farahat Hassan
  • Patent number: 10742446
    Abstract: Configuration operations to enable connectivity, using a virtual traffic hub, between a plurality of isolated networks including a first isolated network with a first private address range, are initiated. The hub includes a plurality of nodes including a decision master node responsible for determining routing actions for packets received at the hub. At the decision master node, a translation mapping is obtained for a second private address range of a second isolated network, which overlaps with the first private address range. At a particular node of the hub, using the mapping, a header of a network packet received from the second isolated network and directed to a destination outside the second isolated network is modified.
    Type: Grant
    Filed: September 19, 2018
    Date of Patent: August 11, 2020
    Assignee: Amazon Technologies, Inc.
    Inventors: Paul John Tillotson, Bashuman Deb, Thomas Spendley, Omer Hashmi, Baihu Qian, Alexander Justin Penney
  • Publication number: 20200252375
    Abstract: A request to establish an encrypted VPN connection between a network external to a provider network connected to the provider network via a dedicated direct physical link and a set of resources of the provider network is received. A new isolated virtual network (IVN) is established to implement an encryption virtual private gateway to be used for the connection. One or more protocol processing engines (PPEs) are instantiated within the IVN, address information of the one or more PPEs is exchanged with the external network and a respective encrypted VPN tunnel is configured between each of the PPEs and the external network. Routing information pertaining to the set of resources is provided to the external network via at least one of the encrypted VPN tunnels, enabling routing of customer data to the set of resources within the provider network from the external network via an encrypted VPN tunnel implemented over a dedicated direct physical link between the external network and the provider network.
    Type: Application
    Filed: February 7, 2020
    Publication date: August 6, 2020
    Applicant: Amazon Technologies, Inc.
    Inventors: Po-Chun Chen, Omer Hashmi, Sanjay Bhal
  • Publication number: 20200162383
    Abstract: At an action implementation layer of a virtual traffic hub, a packet is obtained from a first isolated network. A first action, generated at a decision making layer of the hub based on a first route table of the hub, is performed, resulting in transmission of at least one network packet to a first destination. In response to a second packet, obtained at the action implementation layer from a source outside the first isolated network, a second action is performed, resulting in transmission of at least one packet to a second destination. The second action is generated based on a second route table of the hub.
    Type: Application
    Filed: November 20, 2018
    Publication date: May 21, 2020
    Applicant: Amazon Technologies, Inc.
    Inventors: Bashuman Deb, Paul John Tillotson, Thomas Nguyen Spendley, Omer Hashmi, Baihu Qian, Mohamed Nader Farahat Hassan
  • Publication number: 20200162362
    Abstract: Network pathways are identified to transfer packets between a pair of regional virtual traffic hubs of a provider network. At a first hub of the pair, a first action is performed, resulting in a transmission of a packet received from a first isolated network to the second hub along a pathway selected using dynamic routing parameters. At the second hub, a second action is performed, resulting in the transmission of the packet to a destination within a second isolated network.
    Type: Application
    Filed: November 20, 2018
    Publication date: May 21, 2020
    Applicant: Amazon Technologies, Inc.
    Inventors: Bashuman Deb, Paul John Tillotson, Thomas Nguyen Spendley, Omer Hashmi, Baihu Qian, Mohamed Nader Farahat Hassan
  • Publication number: 20200092138
    Abstract: Configuration operations to enable connectivity, using a virtual traffic hub, between a plurality of isolated networks including a first isolated network with a first private address range, are initiated. The hub includes a plurality of nodes including a decision master node responsible for determining routing actions for packets received at the hub. At the decision master node, a translation mapping is obtained for a second private address range of a second isolated network, which overlaps with the first private address range. At a particular node of the hub, using the mapping, a header of a network packet received from the second isolated network and directed to a destination outside the second isolated network is modified.
    Type: Application
    Filed: September 19, 2018
    Publication date: March 19, 2020
    Applicant: Amazon Technologies, Inc.
    Inventors: Paul John Tillotson, Bashuman Deb, Thomas Spendley, Omer Hashmi, Baihu Qian, Alexander Justin Penney
  • Publication number: 20200092194
    Abstract: Metadata indicating that a virtual traffic hub enabling connectivity between a plurality of isolated networks has been established is stored. A determination is made that a first entry of a first isolated network attached to the hub is to be represented in a second routing table of a second isolated network attached to the hub, e.g., to enable network packets originating at resources of the second isolated network to be transmitted via the hub to the first isolated network. A new entry corresponding to the first entry is included in the second routing table.
    Type: Application
    Filed: September 19, 2018
    Publication date: March 19, 2020
    Applicant: Amazon Technologies, Inc.
    Inventors: Paul John Tillotson, Bashuman Deb, Thomas Spendley, Omer Hashmi, Baihu Qian, Alexander Justin Penney
  • Publication number: 20200092201
    Abstract: An isolated packet processing cell of a packet processing service, comprising an action implementation node and a decision master node, is assigned to an application. An indication of processing rules of the application is transmitted to the decision master node. In response to receiving a particular packet, the action implementation node obtains a representation of an action (which is based on the processing rules) from the decision master node and executes the action.
    Type: Application
    Filed: September 19, 2018
    Publication date: March 19, 2020
    Applicant: Amazon Technologies, Inc.
    Inventors: Paul John Tillotson, Bashuman Deb, Thomas Spendley, Omer Hashmi, Baihu Qian, Alexander Justin Penney
  • Publication number: 20200092193
    Abstract: Metadata indicating that an action implementation node and a routing decision master node have been assigned to a virtual traffic hub programmatically associated with one or more isolated networks is stored. The routing decision master node determines a first action to be implemented for packets of a network flow using state information of the isolated networks, and provides a representation of a first action to the first action implementation node. Based on performing the first action at the action implementation node, contents of a data packet received from one isolated network are transmitted to another isolated network.
    Type: Application
    Filed: September 19, 2018
    Publication date: March 19, 2020
    Applicant: Amazon Technologies, Inc.
    Inventors: Paul John Tillotson, Bashuman Deb, Thomas Spendley, Omer Hashmi, Baihu Qian, Alexander Justin Penney
  • Publication number: 20200092252
    Abstract: Connectivity is enabled between a first and second isolated network using a virtual traffic hub that includes a decision master node responsible for determining a routing action for a packet received at the hub. At the hub, a determination is made that a particular domain name system (DNS) message being directed to a first resource in the first isolated network is to include an indication of a second resource in the second isolated network. The second resource is assigned a network address within a private address range of the second isolated network, which overlaps with a private address range being used in the first isolated network. The hub causes a transformed version of the network address to be included in the DNS message delivered to the first resource.
    Type: Application
    Filed: September 19, 2018
    Publication date: March 19, 2020
    Applicant: Amazon Technologies, Inc.
    Inventors: Paul John Tillotson, Bashuman Deb, Thomas Spendley, Omer Hashmi, Baihu Qian, Alexander Justin Penney
  • Patent number: 10560431
    Abstract: A request to establish an encrypted VPN connection between a network external to a provider network connected to the provider network via a dedicated direct physical link and a set of resources of the provider network is received. A new isolated virtual network (IVN) is established to implement an encryption virtual private gateway to be used for the connection. One or more protocol processing engines (PPEs) are instantiated within the IVN, address information of the one or more PPEs is exchanged with the external network and a respective encrypted VPN tunnel is configured between each of the PPEs and the external network. Routing information pertaining to the set of resources is provided to the external network via at least one of the encrypted VPN tunnels, enabling routing of customer data to the set of resources within the provider network from the external network via an encrypted VPN tunnel implemented over a dedicated direct physical link between the external network and the provider network.
    Type: Grant
    Filed: December 5, 2016
    Date of Patent: February 11, 2020
    Assignee: Amazon Technologies, Inc.
    Inventors: Po-Chun Chen, Omer Hashmi, Sanjay Bhal
  • Patent number: 10516652
    Abstract: A system (and method) includes a plurality of compute devices configured to execute an endpoint node and a provisioning service. The endpoint node is configured to establish an encrypted communication channel over a public network. The provisioning service is configured to retrieve configuration parameters from a database. The configuration parameters define a security association for the encrypted communication channel and include an encryption key and an identifier of an encryption algorithm. The provisioning service is configured to transmit the configuration parameters to the endpoint node for use in implementation of a security association for the encrypted communication channel.
    Type: Grant
    Filed: February 28, 2017
    Date of Patent: December 24, 2019
    Assignee: Amazon Technologies, Inc.
    Inventors: Omer Hashmi, Andrew Hemstreet Redmon
  • Publication number: 20190379672
    Abstract: Techniques are described for providing users with access to perform commands on network-accessible computing resources. In some situations, permissions are established for user(s) to execute command(s) on computing node(s) provided by an online service, such as by maintaining various permission information externally to those provided computing nodes for use in controlling users' ability to access, use, and/or modify the provided computing nodes. An interface component may use such external permissions information to determine if a particular user is authorized to execute one or more particular commands on one or more particular computing nodes, and to initiate simultaneous and independent execution of the command(s) on the computing node(s) when authorized. The interface component may further aggregate results from each computing node that executed the command(s), prior to providing the results to the user.
    Type: Application
    Filed: August 23, 2019
    Publication date: December 12, 2019
    Applicant: Amazon Technologies, Inc.
    Inventors: Omer Hashmi, Katherine Yichen Chung
  • Patent number: 10498529
    Abstract: A virtual private network (VPN) endpoint node is implemented on multiple virtual machines in a provider network. One or more virtual machines execute a packet aggregator. One or more other virtual machines implement cryptographic units. The packet aggregator is configured to distribute incoming encrypted packets from a secure tunnel across the plurality of cryptographic units. Each cryptographic unit is configured to decrypt incoming encrypted packets from the packet aggregator and to encrypt outgoing plaintext packets for transmission across the secure tunnel. The packet aggregator also may assign a sequence number to an outgoing plaintext packet, create a tunneled packet including the sequence number in a header of the tunneled packet and including the plaintext packet in tunneled packet, select one of the cryptographic units, and forward the tunneled packet to the selected cryptographic unit.
    Type: Grant
    Filed: December 5, 2016
    Date of Patent: December 3, 2019
    Assignee: Amazon Technologies, Inc.
    Inventors: Omer Hashmi, Bashuman Deb
  • Patent number: 10397232
    Abstract: Techniques are described for providing users with access to perform commands on network-accessible computing resources. In some situations, permissions are established for user(s) to execute command(s) on computing node(s) provided by an online service, such as by maintaining various permission information externally to those provided computing nodes for use in controlling users' ability to access, use, and/or modify the provided computing nodes. An interface component may use such external permissions information to determine if a particular user is authorized to execute one or more particular commands on one or more particular computing nodes, and to initiate simultaneous and independent execution of the command(s) on the computing node(s) when authorized. The interface component may further aggregate results from each computing node that executed the command(s), prior to providing the results to the user.
    Type: Grant
    Filed: June 25, 2015
    Date of Patent: August 27, 2019
    Assignee: Amazon Technologies, Inc.
    Inventors: Omer Hashmi, Katherine Yichen Chung
  • Patent number: 10397189
    Abstract: A provider network includes a service that creates virtual private network (VPN) endpoint nodes. Application programming interfaces are available that the creation of VPN endpoint nodes, peer them together, and attach them to respective virtual private networks to thereby establish communication tunnels between pairs of virtual private networks. Each VPN endpoint node may be implemented as a fault tolerant endpoint node in which the node is created as a plurality of virtual machines. Each of the virtual machines is configured from a common machine image that includes software capable of causing the respective virtual machine to configure a tunnel such as an IPSec tunnel. One of the virtual machines, however, is operated in an active mode, while another virtual machine is configured to operate in a standby mode.
    Type: Grant
    Filed: September 27, 2016
    Date of Patent: August 27, 2019
    Assignee: Amazon Technologies, Inc.
    Inventor: Omer Hashmi