Managed directory service connection

• US 10,375,013 B2
• Filed: 12/05/2013
• Issued: 08/06/2019
• Est. Priority Date: 11/11/2013
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Shah, Shon Kiran, Rai, Krithi, Rao, Guruprakash Bangalore, Rizzo, Thomas Christopher, Brace, Colin Harrison, Mehta, Gaurang Pankaj, Palande, Sameer, Suryanarayanan, Deepak
• Primary Examiner(s): Chang, Jungwon
• Application Number:
  US14/098,450
• Publication Number:
  US 20150134826A1
• Time in Patent Office: 2,070 Days
• Field of Search: 709217, 709201, 709226, 709248, 709227, 709203, 709223, 370401, 726 4, 726 25, 726 6, 726 12, 707831
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: G06F 16/9566 URL specific, e.g. using aliases, detecting broken or misspelled links
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 40/134 Hyperlinking
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 2101/30 Types of network names
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5041 characterised by the time relationship between creation and deployment of a service
• CPC Class Codes: H04L 41/5058 Service discovery by the service manager
• CPC Class Codes: H04L 41/5083 wherein the managed service relates to web hosting
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 61/10 of different types
• CPC Class Codes: H04L 61/4541 Directories for service discovery
• CPC Class Codes: H04L 61/4547 for personal communications, i.e. using a personal identifier
• CPC Class Codes: H04L 61/50 : Address allocation
• CPC Class Codes: H04L 61/5007 : Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/104 : Grouping of entities
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1095 : Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

Techniques for connecting computer system entities to local computer system resources are described herein. A computer system entity that requests access to a local computer system resource has that request fulfilled by a managed directory service, which receives the request and connects the computer system entity to the local computer system resource. While connected, the managed directory service receives commands to perform operations on the local computer system resource and, if the computer system entity is authorized to perform the operations on the local computer system resource, the managed directory service performs the operations on the local computer system resource.

Claims

1. A computer-implemented method, comprising:

connecting a directory node of a computing resource service provider to a customer computer system directory hosted outside of the computing resource service provider and referencing a set of data;

making the customer computer system directory available to a directory service of the computing resource service provider; and

processing one or more requests to perform directory operations by at least;

obtaining, from the directory service of the computing resource service provider, a system resource location that corresponds to a system resource, wherein the set of data comprises the system resource;

determining a uniform resource identifier based at least in part on the system resource location; and

forwarding the one or more requests from the directory service of the computing resource service provider to the customer computing system directory for fulfillment, the fulfillment of the one or more requests utilizing at least a portion of the set of data associated with the system resource, wherein access to the system resource is provided based at least in part on the uniform resource identifier.

2. The computer-implemented method of claim 1, further comprising:

obtaining a uniform resource identifier for the directory node; and

registering the uniform resource identifier with a domain name service so that the domain name service will resolve the uniform resource identifier to a network address of the directory node.

3. The computer-implemented method of claim 1, wherein the directory node is located within an isolated virtual network hosted in the computing environment of the computing resource service provider.

4. The computer-implemented method of claim 3, wherein the directory node is created within a sub-network of the isolated virtual network specified by a customer of the computing resource service provider.

5. The computer-implemented method of claim 1, wherein maintaining the directory node includes performing maintenance operations on a computer system that implements the directory node.

6. The computer-implemented method of claim 1, wherein the system resource comprises at least one of a directory, file system, file, security policy, network resource, or application.

7. A system, comprising:

one or more processors; and

memory to store executable instructions that, as a result of execution by the one or more processors, cause the system to;

connect a directory node in a computing resource service provider environment to a customer computer system directory, the customer computer system directory referencing a set of data stored outside of the computing resource service provider;

make the customer computer system directory available to a directory service of the computing resource service provider; and

enable performance of directory operations by at least;

obtaining, from the directory service of the computing resource service provider, a system resource location that corresponds to a system resource, wherein the set of data comprises the system resource;

creating a resource identifier based at least in part on the system resource location; and

forwarding one or more requests from the directory service to the customer computing system directory, wherein access to the system resource is based at least in part on the resource identifier.

8. The system of claim 7, wherein the customer computer system directory is hosted in a computing environment of the customer that is outside of the environment of the computing resource service provider.

9. The system of claim 7, wherein the instructions further comprise instructions that cause the system to configure a computer system instance to implement the directory node, the computer system instance configured to have a network address to which other computer system instances of a customer in the computing environment of the computing resource service provider are able to communicate.

10. The system of claim 7, wherein the directory node is created to forward the requests to perform directory operations to the customer computer system directory for fulfillment.

11. The system of claim 7, wherein the directory node enables computer systems to join the customer computer system directory via the directory node.

12. The system of claim 7, wherein the directory node is created in a virtual network hosted by the computing resource service provider.

13. The system of claim 12, wherein the directory node is created in a sub-network of the virtual network.

14. A non-transitory computer-readable storage medium comprising executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:

connect a directory node in a computing resource service provider environment to a customer computer system directory hosted outside of the computing resource service provider environment, the customer computer system directory referencing a set of data stored in the customer computing environment;

make the customer computer system directory available to a directory service of the computing resource service provider environment; and

process one or more requests to perform directory operations by forwarding the one or more requests from the directory service of the computing resource service provider to the customer computing system directory for fulfillment, the fulfillment of the requests utilizing at least a portion of the set of data associated with a system resource, wherein the one or more requests are processed by at least;

obtaining, from the directory service of the computing resource service provider, a system resource location that corresponds to the system resource; and

creating a resource identifier based at least in part on the system resource location, wherein access to the system resource is based at least in part on the resource identifier.

15. The non-transitory computer-readable storage medium of claim 14, wherein the directory node is configured to enable computing resources hosted in the computing environment to join the customer computer system directory via the directory node.

16. The non-transitory computer-readable storage medium of claim 14, wherein the customer computer system directory is hosted in a computing environment of the customer outside of the computing environment of the computing resource service provider.

17. The non-transitory computer-readable storage medium of claim 14, wherein the instructions that cause the computer system to create the directory node further include instructions that cause the computer system to create a replica of the directory node, the replica providing redundant access to the customer computer system directory.

18. The non-transitory computer-readable storage medium of claim 14, wherein the directory node is created with a network address in a sub-network, specified by a customer of the computing resource service provider, of a virtual network of the customer hosted by the computing resource service provider on behalf of the customer, the sub-network being inaccessible to resources of the computing resource service provider outside of the sub-network.

19. The non-transitory computer-readable storage medium of claim 14, wherein:

the instructions further include instructions that, if executed by the one or more processors, cause the computer system to provide a web service interface through which requests to perform management operations on the directory node are submittable; and

the directory node is created in response to a request submitted through the provided web service interface.

20. The non-transitory computer-readable storage medium of claim 14, wherein the instructions to process the one or more requests include instructions to use the directory node to forward the one or more requests to the customer computer system directory.