Secure transfer of virtualized resources between entities

• US 10,104,163 B1
• Filed: 07/28/2015
• Issued: 10/16/2018
• Est. Priority Date: 07/28/2015
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Stickle, Thomas Charles, Holland, Ryan Christopher
• Primary Examiner(s): Walsh, John B
• Application Number:
  US14/811,609
• Time in Patent Office: 1,176 Days
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

Technology is described for providing a secure transfer of a virtual computing resource between at least two entities in a computing environment. An ownership transfer account is created and configured to enable a transfer of virtual computing resources between a first customer account and a second customer account of a service provider network hosted within a service provider environment, using one or more computing systems. Virtual computing resources owned by the first customer account are tagged using the one or more computer systems. The ownership of the virtual computing resources that are tagged is transferred to the ownership transfer account, using the one or more computer systems. The transfer of the virtual computing resources to the ownership transfer account is verified. The ownership of the virtual computing resources is transferred from the ownership transfer account to the second customer account.

Claims

1. A method for a secure transfer of cloud resources, the method comprising:

under control of at least one processor and memory configured with executable instructions;

creating an ownership transfer account configured to enable a transfer of virtual computing resources between a first customer account and a second customer account within a service provider network hosted within a service provider environment, using the at least one processor and memory;

tagging virtual computing resources that are executable in the service provider environment and owned by the first customer account, using the at least one processor and memory;

transferring ownership of the virtual computing resources that are tagged to the ownership transfer account, using the at least one processor and memory;

verifying the transfer of the ownership of the virtual computing resources to the ownership transfer account, using the at least one processor and memory;

transferring ownership of the virtual computing resources from the ownership transfer account to the second customer account, using the at least one processor and memory; and

executing the virtual computing resources in the service provider environment, using the at least one processor and memory.

2. The method of claim 1, further comprises receiving a transfer request for the virtual computing resources owned by the first customer account, wherein the first customer account includes a first customer computing environment and the second customer account includes a second customer computing environment.

3. The method of claim 1, further comprises configuring the virtual computing resources for the second customer account subsequent to transferring ownership of the virtual computing resources from the ownership transfer account to the second customer account, wherein the ownership transfer account is a single-tenant account.

4. A computer-implemented method, the method comprising:

under control of at least one processor and memory configured with executable instructions;

tagging virtual computing resources owned by a first party ownership account within a computing service environment, using the at least one processor and memory;

transferring ownership of the virtual computing resources that have been tagged from the first party ownership account to an ownership transfer account, using the at least one processor and memory;

transferring ownership of the virtual computing resources from the ownership transfer account to a second party ownership account, using the at least one processor and memory, wherein the first party ownership account is inaccessible to the second party ownership account; and

executing the virtual computing resources in the computing service environment, using the at least one processor and memory.

5. The method of claim 4, further comprising issuing a transfer request for the virtual computing resources owned by a first customer to the ownership transfer account, using the at least one processor and memory.

6. The method of claim 4, further comprising creating the ownership transfer account to receive a transfer of virtual computing resources between the first party ownership account and the second party ownership account within a service provider environment, using the at least one processor and memory.

7. The method of claim 4, further comprises transferring ownership records of the virtual computing resources that have been tagged from the first party ownership account to the ownership transfer account and recording the transferring of ownership of transfer records in a control plane, using the at least one processor and memory.

8. The method of claim 4, further comprises transferring ownership of the virtual computing resources by sending configuration data to the ownership transfer account to enable virtual computing resource to be re-instantiated in the second party ownership account, using the at least one processor and memory.

9. The method of claim 4, wherein the ownership transfer account is a single-tenant account.

10. The method of claim 4, further comprises verifying the transfer of the ownership of the virtual computing resources by comparing the virtual computing resources that are transferred to a list of the virtual computing resources that were tagged previously for transfer, using the at least one processor and memory.

11. The method of claim 9, further comprises removing access permissions from the first party ownership account to the ownership transfer account to enable access to the ownership transfer account by the second party ownership account, using the at least one processor and memory.

12. The method of claim 4, wherein the virtual computing resources include at least one of computing instances, computing service images, networking resources, storage resources, or a combination thereof.

13. The method of claim 4, further comprises dynamically transferring ownership of the virtual computing resources according to a hot transfer where the virtual computing resources are still executing in the computing service environment while the ownership of the virtual computing resources is being transferred, using the at least one processor and memory.

14. The method of claim 4, further comprises transferring ownership of the virtual computing resources while the virtual computing resources are static where the virtual computing resources are not executing in the computing service environment while the ownership of the virtual computing resources is being transferred, using the at least one processor and memory.

15. The method of claim 14, further comprises terminating or suspending execution of each of the virtual computing resources on the first party ownership account prior to transferring ownership of the virtual computing resources, using the at least one processor and memory.

16. The method of claim 4, further comprises maintaining an audit trail for transfer of ownership of the virtual computing resources, using the at least one processor and memory.

17. The method of claim 16, further comprises providing an audit trail notification to the first party ownership account or the second party ownership account, using the at least one processor and memory.

18. The method of claim 14, further comprises sending a notification to the second party ownership account to accept or deny the transferring of ownership of the virtual computing resources from the first party ownership account, using the at least one processor and memory.

19. A method for providing secure transfer of virtual computing resources within a computing environment, the method comprising:

under control of at least one processor and memory configured with executable instructions that;

create an ownership transfer account to facilitate transfer of virtual computing resources between a first customer account and a second customer account within a service provider network hosted within a service provider environment, using the at least one processor and memory;

tag virtual computing resources that are executable in the service provider environment and owned by the first customer account, using the at least one processor and memory;

determine whether to transfer the tagged virtual computing resources that are owned by the first computing environment to the ownership transfer account by a transfer type that is at least one of;

a hot transfer, a suspended execution of the virtual computing resources, or a configuration transfer where configuration data is transferred to the ownership transfer account, using the at least one processor and memory;

transfer ownership of the virtual computing resources that are tagged to the ownership transfer account according to the transfer type, using the at least one processor and memory;

verify the transfer of the ownership of the virtual computing resources to the ownership transfer account, using the at least one processor and memory;

transfer ownership of the virtual computing resources from the ownership transfer account to the second customer account by sending configuration data to the ownership transfer account; and

execute the virtual computing resources in the service provider environment, using the at least one processor and memory.

20. The method of claim 19, further comprising executable instructions that transfer ownership of the virtual computing resources from the ownership transfer account to the second customer account by sending at least a portion of the configuration data to the ownership transfer account to enable virtual computing resources to be re-instantiated in the second customer account, using the at least one processor and memory.