Intelligent network service provisioning and maintenance

• US 9,450,967 B1
• Filed: 05/01/2012
• Issued: 09/20/2016
• Est. Priority Date: 05/01/2012
• Status: Expired due to Fees

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Ganguly, Arijit, Dickinson, Andrew B., Lefelhocz, Christopher J., Agarwal, Manish, Searle, Ian R., Brandwine, Eric Jason
• Primary Examiner(s): Patel, Hitesh
• Application Number:
  US13/461,596
• Time in Patent Office: 1,603 Days
• Field of Search: 709/221, 709224-226, 709/246, 726/11, 726/22
• US Class Current: 1/1
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/0823 characterised by the purposes of a change of settings, e.g. optimising configuration for enhancing reliability for optimising operational conditions of wireless networks H04W24/02
• CPC Class Codes: H04L 41/5041 characterised by the time relationship between creation and deployment of a service
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A network gateway is implemented on behalf of a customer entity. The network gateway may be implemented using a distributed computer system and the network gateway may connect a network of the customer entity to a public communications network. The network gateway may include network-related services without the need for adding specialized hardware. The network gateway may be provisioned programmatically in response to instructions received from the customer entity. The network gateway may be provisionable and accessible over several different types of data connections. The network gateway, by virtue of being implemented on a distributed computer system, is scalable upon demand without additional input by the customer entity.

Claims

1. A computer-implemented method for maintaining network-related services, comprising:

receiving, by one or more computer systems of a computing resource provider, information relevant to an operation of at least one network-related service operating on network traffic received through a network gateway operated by the computing resource provider on behalf of an entity different from the computing resource provider, the at least one network-related service being implemented by a virtual computing system on a subset of the one or more computer systems, the network gateway enabling network traffic between the entity different from the computing resource provider and a public network;

detecting, from the received information, a demand relating to the network-related service;

determining a current capability of the one or more computer systems with respect to the network-related service;

determining, based at least in part on the demand and the current capability, that the demand is greater than or less than the current capability of the one or more computer systems to provide the network-related service;

determining an optimization plan for improving the network-related service based at least in part on the detected demand, the determined optimization plan comprising at least one change selected from a group including a change to a number of virtual machines of the one or more computer systems that are provisioned and a change from a first type of virtual machine currently being used by the network-related service to a second type of virtual machine, the second type of virtual machine having a greater ability to meet the demand; and

reconfiguring the subset of the one or more computer systems in accordance with the optimization plan.

2. The computer-implemented method of claim 1, wherein the received information includes information indicating that the one or more computer systems is functioning abnormally.

3. The computer-implemented method of claim 1, wherein the at least one network-related service extends the network gateway using the one or more computer systems to provide at least one service to the entity different from the computing resource provider.

4. The computer-implemented method of claim 3, wherein extending the network gateway includes operating on network traffic received through the network gateway.

5. The computer-implemented method of claim 1, wherein the demand is a performance-related demand on the at least one network-related service.

6. The computer-implemented method of claim 1, wherein the demand is based at least in part on one or more financial metrics, the one or more financial metrics being associated with at least one aspect of operating the network-related service.

7. The computer-implemented method of claim 5, wherein the performance-related demand relates to the volume of network traffic processed by the at least one network-related service.

27. The computer-implemented method of claim 1, wherein the optimization plan includes an indication of a replacement resource for a poorly performing computing resource, and reconfiguring the subset of the one or more computer systems in accordance with the optimization plan includes replacing the poorly performing computing resource with the replacement resource.

28. The computer-implemented method of claim 1, wherein the optimization plan includes an indication of a replacement resource type, and reconfiguring the subset of the one or more computer systems in accordance with the optimization plan includes replacing at least one of the subset of the one or more computer systems with a computer system of the replacement resource type.

29. The computer-implemented method of claim 1, wherein the virtual computing system is directly connected to the entity different from the computing resource provider.

8. A computer-implemented method for maintaining network-related services, comprising:

receiving, by one or more computer systems of a computing resource provider, information relevant to an operation of one of the one or more computer systems and at least one network-related service, the at least one network-related service being implemented by a virtual computer system on a subset of the one or more computer systems, the at least one network-related service operating on network traffic received by the one or more computer systems on behalf of a customer entity remote from the one or more computer systems, at least a portion of the network traffic received at the virtual computer system being relayed to the customer entity via a direct connection;

detecting, from the received information, a demand related to a utilization of the subset of the one or more computer systems with respect to the ability of the network-related service;

determining a current capability of the one or more computer systems with respect to the network-related service;

determining, based at least in part on the demand and the current capability, that the demand is greater than or less than the current capability of the one or more computer systems to provide the network related service; and

reconfiguring the one or more computer systems to modify at least one of the subset of the one or more computer systems or the at least one implemented network-related service based at least in part on the detected demand, the reconfiguring of the one or more computer systems including making at least one change selected from a group including a change to a number of virtual machines in the subset of the one or more computer systems and making a change from a first type of virtual machine currently being used by the network-related service to a second type of virtual machine, the second type of provisioned virtual machine having a greater ability to meet the demand.

9. The computer-implemented method of claim 8, wherein the at least one network-related service includes a network gateway.

10. The computer-implemented method of claim 8, wherein the received information indicates an amount of resources available to the one or more computer systems.

11. The computer-implemented method of claim 8, wherein the received information includes information that at least one of the one or more computer systems and the at least one network-related services is functioning abnormally.

12. The computer-implemented method of claim 11, wherein the reconfiguration of the one or more computer systems is temporary, and further comprising reconfiguring the one or more computer systems to revert the at least one network-related service to a normal operational state after receiving further information that indicates that at least one of the one or more computer systems or the at least one network-related services is functioning normally.

13. The computer-implemented method of claim 12, further comprising alerting a technician with at least a subset of the information, the subset enabling the technician to address an abnormality in at least one of the one or more computer systems or the at least one network-related services.

14. A computer system for maintaining network-related services, comprising:

one or more processors; and

memory, including instructions executable by the one or more processors to cause the computer system to at least;

receive operational data for network-related services implemented via a virtual computer system using at least a first subset of resources of the computer system, the network-related services operating on data received by the computer system on behalf of one or more users remote to the computer system, at least a portion of the data being relayed to a corresponding user via a direct connection, the operational data including a demand for the network-related services;

determine a capability of the first subset of resources of the computer system to meet the demand for the network-related services;

upon determining that the capability of the first subset of resources of the computer system is greater than or less than the demand for the network-related services, calculate a second subset of resources to implement corresponding network-related services based on information in the operational data related to resource utilization, the calculated second subset of resources including a number of resources needed to implement the network-related services and a type of resource needed to implement the network-related services; and

reconfigure the computer system to implement, using the second subset of resources, the corresponding network-related services, the second subset of resources being different from the first subset of resources.

15. The computer system of claim 14, wherein the network-related services include at least one of a network gateway, a distributed denial of service mitigation service, an unsolicited message (spam) filtering service, a data encryption service, or a data firewalling service.

16. The computer system of claim 14, wherein the reconfiguration of the computer system is achieved transparently to users of the network-related services.

17. The computer system of claim 14, wherein the information in the operational data includes a response latency of at least one of the network-related services.

18. The computer system of claim 14, wherein the operational data includes information that at least one of the computer system or at least one of the network-related services is functioning abnormally.

19. The computer system of claim 14, wherein the operational data is received from an entity separate from the computer system.

20. One or more non-transitory computer-readable storage media having collectively stored thereon executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:

receive operational data relevant at least one of the computer system or at least one network-related service, the at least one network-related service being implemented via a virtual computer system by a subset of resources of the computer system, the at least one network-related service operating on network traffic received by the computer system on behalf of a customer entity remote to the computer system, at least a portion of the network traffic being relayed to the customer entity via a direct connection;

determine, from the received operational data, a demand related to a resource utilization with respect to a resource availability of the subset of resources;

determine, based at least in part on the determined demand, a capability of the subset of resources to meet the determined demand; and

reconfigure, based at least in part on a determination that the capability of the subset of resources is unaligned with the determined demand, the computer system to modify at least one of the subset of resources, the reconfiguring of the computer system including making a change to at least one change selected from a group including a change to a number of resources in the subset of resources and a change to a type of resource in the subset of resource, the change to the type of resource being a change from a current resource type to a new resource type more aligned with the determined demand.

21. The one or more non-transitory computer-readable storage media of claim 20, wherein the modification of the subset of resources includes decreasing an allocation to the at least one network-related service of a capability of the computer system.

22. The one or more non-transitory computer-readable storage media of claim 20, further including executable instructions that, when executed by one or more processors of the computer system, cause the computer system to at least send additional data to a source of the operational data, the additional data including an indication that the reconfiguration has occurred.

23. The one or more non-transitory computer-readable storage media of claim 20, wherein the operational data includes information that at least one of the computer system or the at least one network-related services is functioning abnormally.

24. The one or more non-transitory computer-readable storage media of claim 23, further including executable instructions that, when executed by one or more processors of the computer system, cause the computer system to alert a technician with at least a subset of the information, the subset enabling the technician to address at least one abnormality in at least one of the computer system or the at least one network-related services.

25. The one or more non-transitory computer-readable storage media of claim 20, wherein the operational data includes response latency of the at least one network-related services.

26. The one or more non-transitory computer-readable storage media of claim 20, wherein the at least one network-related service includes at least a network gateway.