Flexibly configurable data modification services

• US 10,084,818 B1
• Filed: 06/07/2012
• Issued: 09/25/2018
• Est. Priority Date: 06/07/2012
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roth, Gregory B., Baer, Graeme D., Brandwine, Eric Jason
• Primary Examiner(s): Joo, Joshua
• Application Number:
  US13/491,403
• Time in Patent Office: 2,301 Days
• Field of Search: 709226
• CPC Class Codes: G06F 15/173 using an interconnection network, e.g. matrix, shuffle, pyramid, star, snowflake
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Techniques for processing data according to customer-defined rules are disclosed. In particular, methods and systems for implementing a data alteration service using one or resources of a distributed computing system are described. The data alteration service is flexibly configurable by entities using the distributed computing system, and may be used to augment, compress, filter or otherwise modify data crossing a customer boundary.

Claims

1. A computer-implemented method comprising:

receiving, through a programmatic interface, a request to apply customer-defined rules on at least a subset of data transiting between at least a first set of computing resources programmatically managed by a customer of a computing resource provider and a second set of computing resources outside of control of the customer, the first set of computing resources being from a plurality of sets of computing resources, at least some of which are remotely and programmatically managed by different customers;

receiving a request to apply upon transiting data at least one data transformation technique provided by a managed data transformation provider that is external to the computing resource provider; and

configuring at least the first set of computing resources to implement a policy derived based at least in part on the received customer-defined rules, to cause the transiting subset of data to pass to a third set of computing resources of the computing resource provider that applies the customer-defined rules to the subset of data prior to reaching the second set of computing resources which are outside of control of the customer, with at least a portion of the transiting subset of data processed in accordance with at least one rule provided by the managed data transformation provider and the rule associated with the requested data transformation technique.

2. The computer-implemented method of claim 1, wherein the third set of computing resources is programmatically managed by the computing resource provider.

3. The computer-implemented method of claim 1, further comprising:

providing, to the customer, a plurality of predefined selectable rules; and

receiving, from the customer, information identifying at least;

a selection of rules from the plurality of predefined rules, the information thereby identifying customer-defined rules; and

the request to apply the customer-defined rules.

4. The computer-implemented method of claim 1, wherein at least one of the second set of computing resources includes one or more devices that are physically separate from. the computing resource provider.

5. The computer-implemented method of claim 1, wherein the customer- defined rules are composed by the customer using a rule notation supported by a rule definition platform provided by the computing resource provider.

6. me computer-implemented method of claim 1, further comprising applying the customer-defined rules to the subset of data at a time after determining that the subset of data is transiting between the first set of computing resources and the second set of computing resources.

7. A computer-implemented method to modify data streams, comprising:

receiving, through a programmatic interface, a request to apply customer-defined rules on data transiting across a customer-defined boundary that is between at least a first resource under control of a customer of a computing resource provider and a second resource that is outside of control of the customer, the first resource programmatically managed by the customer and being from a plurality of resources at least some of which are remotely and programmatically managed by different customers of the computing resource provider;

receiving a request to apply upon transiting data at least one data transformation technique provided by a managed data transformation provider that is external to the computing resource provider; and

configuring at least the first resource to implement a policy derived based at least in part on the customer-defined rules to cause at least a portion of the transiting data to be processed by a third resource in accordance with the customer-defined rules prior to reaching the second resource, and at least a second portion of the transiting data processed in accordance with at least one rule provided by the managed data transformation provider associated with the requested data transformation technique and the computing resource provider.

8. The computer-implemented method of claim 7, wherein the customer-defined rules are received from the customer that selects the rules from a predetermined plurality of rule sets using at least one of a user interface (UI) or an application programming interface (API) exposed to the customer.

9. The computer-implemented method of claim 7, wherein the second resource is under control of a second customer of the computing resource provider.

10. The computer-implemented method of claim 7, wherein:

at least one of the first resource or the second resource comprises one or more devices of the computing resource provider; and

at least one of the first resource or the second resource is a device that is physically separate from the computing resource provider.

11. The computer-implemented method of claim 7, wherein the third resource is a subset of the first resource.

12. The computer implemented method of claim 7, further comprising configuring the first resource to implement a policy derived at least in part from the received customer-defined rules, the policy being implemented to configure a plurality of customer-controlled resources associated with the transiting data.

13. The computer-implemented method of claim 7, wherein the managed data transformation provider-provided rules include at least one rule that, when processed, causes at least a portion of customer-charged costs to be remitted to the managed data transformation provider, the customer-charged costs accruing to the customer in accordance with a pricing structure associated with the managed data transformation provider-provided rules.

14. A computer system comprising:

one or more processors; and

memory, including instructions executable by the one or more processors to cause the computer system to at least;

configure resources of the computer system such that the resources are capable of being simultaneously associated with a plurality of customer devices that are programmatically managed by respective customers of a computing resource provider;

process customer-specified rules, defined through a programmatic interface, to generate a policy, the customer-specified rules defining at least one alteration to be applied to data transferred between at least one customer device among the plurality of customer devices, and an external device that is outside of control of the customer;

provide the policy to the at least one customer device such that the system is configured to implement the customer-specified rules using at least a subset of the configured resources; and

.

implement the customer-specified rules to cause the at least one alteration to be applied to the transferred data by another device prior to the transferred data reaching the external device.

15. The computer system of claim 14, wherein the customer-specified rules are implementable to alter at least a subset of the transferred data such that the transferred data complies with one or more content requirements of a recipient of the data.

16. The computer system of claim 14, wherein the customer-specified rules, when implemented, cause at least one action to be taken by the system upon at least a subset of the plurality of customer devices.

17. The computer system of claim 14, wherein the external device is connected to the customer device across a public network.

18. The computer system of claim 14, wherein the customer-specified rules include at least one subset of rules that, when implemented, restrict the transferred data based at least in part on a geographic location of the external device.

19. The computer system of claim 14, wherein the instructions cause the computer system to further:

process the policy to determine, among the plurality of customer devices, the at least one customer device that is subject to the at least one restriction; and

at a time after providing the policy to the at least one customer device, redirect the transferred data to the at least the subset of configured resources such that the at least the subset implements the customer-specified rules.

20. The computer system of claim 14, wherein:

the subset of the configured resources is a first subset of configured resources;

the alteration is a first alteration that is applied by the first subset of configured resources; and

the customer-specified rules include a subset of rules that, when implemented, cause a second subset of configured resources to implement the subset of rules such that a second alteration is applied to the transferred data, the second subset of configured resources being recognized by the computer system as operable to apply the subset of rules.

21. The computer system of claim. 20, wherein the second alteration includes at least one of augmenting the transferred data with an executable instruction or implementing an additional customer-specified rule using the second subset of configured resources.

22. The computer system of claim 20, wherein:

the second subset of resources caches at least a subset of the transferred data to result in cached data;

the first subset of resources replaces at least a portion of the subset of transferred data with at least one cache identifier; and

the second subset of resources replaces the at least one cache identifier with at least a portion of the cached data.

23. The computer system of claim 14, wherein the instructions cause the computer system to further generate metrics associated with the transferred data subject to the customer-specified rules.

24. The computer system of claim 14, wherein the instructions cause the computer system to further accrue costs associated with the processing of the customer-specified rules to the customer.

25. The computer system of claim 24, wherein the costs are accrued based at least in part on a level of resources of the computer system used to process the transferred data.

26. The computer system of claim 24, wherein the costs are accrued based at least in part on an amount of the transferred data subject to the customer-specified rules.

27. The computer system of claim 24, wherein the costs are accrued based at least in part on a quantity of the customer-specified rules applied to the transferred data.

28. One or more non-transitory computer-readable storage media having collectively stored thereon executable instructions that, if executed by one or more processors of a computer system, cause the computer system to at least:

adapt resources of the computer system such that the adapted resources are capable of at least being simultaneously connected to a plurality of customer devices, the plurality of customer devices including at least some customer devices remotely and programmatically managed by different customers of a computing resource provider;

in response to receiving, through a programmatic interface, information specifying customer-defined rules for modifying a subset of network traffic transiting between at least one customer device programmatically managed by a customer of the computing resource provider and at least one external device outside of control of the customer, determine the at least one customer device associated with the subset of network traffic;

configure the at least one customer device to cause the subset of network traffic to be redirected to at least one adapted resource among the adapted resources; and

process, using the at least one adapted resource, the redirected subset of network traffic such that the traffic is modified in accordance with the customer-defined rules prior to reaching the at least one external device.

29. The non-transitory computer-readable storage media of claim 28, Wherein the executable instructions further cause the computer system to process the subset of network traffic at a time after determining that the subset of network traffic either originates from or is destined to the external device.

30. The non-transitory computer-readable storage media of claim 28, wherein the executable instructions further cause the computer system to, in accordance with a subset of the received customer-defined rifles, process the subset of network traffic in accordance with determined characteristics of the external device.

31. The non-transitory computer-readable storage media of claim 28, wherein:

the customer device includes a first adapted resource among the adapted resources, the first adapted resource being under control of a first customer of the computer system; and

the external device includes a second adapted resource among the adapted resources, the second adapted resource being under control of a second customer of the computer system.

32. The non-transitory computer-readable storage media of claim 28, wherein the processing of the redirected subset of network traffic compresses the network traffic.

33. The non-transitory computer-readable storage media of claim 28, wherein the executable instructions further cause the computer system to process only a portion of the redirected subset of network traffic that is relevant to the customer-defined rules.