MANAGING EXECUTION OF PROGRAMS BY MULTIPLE COMPUTING SYSTEMS

• US 20200007587A1
• Filed: 07/02/2019
• Published: 01/02/2020
• Est. Priority Date: 03/31/2006
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Hoole, Quinton R., Paterson-Jones, Roland, Pinkham, Christopher C., Tobler, Benjamin, van Biljon, Willem R., Smit, Gabriel, Brown, Christopher
• Granted Patent: US 10,791,149 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 12/1439 time-based
• CPC Class Codes: H04L 12/1442 at network operator level
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

Techniques are described for managing communications between multiple intercommunicating computing nodes, such as multiple virtual machine nodes hosted on one or more physical computing machines or systems. In some situations, users may specify groups of computing nodes and optionally associated access policies for use in the managing of the communications for those groups, such as by specifying which source nodes are allowed to transmit data to particular destinations nodes. In addition, determinations of whether initiated data transmissions from source nodes to destination nodes are authorized may be dynamically negotiated for and recorded for later use in automatically authorizing future such data transmissions without negotiation. This abstract is provided to comply with rules requiring an abstract, and it is submitted with the intention that it will not be used to interpret or limit the scope or meaning of the claims.

Claims

1-58. -58. (canceled)

59. A system comprising:

one or more computing systems that implement a network-accessible service, configured to;

host a plurality of virtual machines on behalf of clients of the network-accessible service deployed according to virtual machine images;

receive, from a client, a first request to register a virtual machine image with the network-accessible service, wherein the virtual machine image includes an image of an operating system, and first request indicates at least one geographic location selected from multiple geographic locations of the network-accessible service available to execute virtual machines according to the virtual machine image;

store the virtual machine image in a repository in the network-accessible service, along with information indicating a source of the virtual machine image;

distribute a copy of the virtual machine image to be stored locally at the at least one geographic location; and

responsive to a second request from the client, execute a virtual machine according to the copy of the virtual machine image at the at least one geographic location.

60. The system of claim 59, wherein the network-accessible service is configured to:

responsive to a third request from the client, de-register the virtual machine image from the network-accessible service.

61. The system of claim 59, wherein the virtual machine image includes one or more programs to be executed by the network-accessible service.

62. The system of claim 59, wherein the network-accessible service is configured to receive the first request via a graphical user interface of the network-accessible service.

63. The system of claim 59, wherein the network-accessible service is configured to receive the first request via a web services interface provided by the network-accessible service.

64. The system of claim 59, wherein the network-accessible service is configured to create user accounts on behalf of users, and the information indicating a source of the virtual machine image stored in the repository includes an identity of a user account that registered the virtual machine image.

65. The system of claim 59, wherein to store the virtual machine image in the repository, the network-accessible service is configured to store one or more execution restrictions associated with the virtual machine image, and the virtual machine is executed in accordance with the one or more execution restrictions.

66. The system of claim 59, wherein to distribute the copy of the virtual machine image to be stored locally at the at least one geographic location, the network-accessible service is configured to:

select a virtual machine host at the at least one geographic location to store the copy of virtual machine image, wherein the virtual machine is executed on the virtual machine host.

67. The system of claim 66, wherein the network-accessible service is configured to perform the selection of the virtual machine host and storing of the copy of the virtual machine image on the virtual machine host in response to the second request.

68. The system of claim 59, wherein network-accessible service is configured to assess a fee for the registration of virtual machine image, wherein the fee is based at least in part on an amount of storage used to store the virtual machine image.

69. A method comprising:

performing, by one or more computing systems that implement a network-accessible service;

hosting a plurality of virtual machines on behalf of clients of the network-accessible service deployed according to virtual machine images;

receiving, from a client, a first request to register a virtual machine image with the network-accessible service, wherein the virtual machine image includes an image of an operating system, and first request indicates at least one geographic location selected from multiple geographic locations of the network-accessible service available to execute virtual machines according to the virtual machine image;

storing the virtual machine image in a repository in the network-accessible service, along with information indicating a source of the virtual machine image;

distributing a copy of the virtual machine image to be stored locally at the at least one geographic location; and

responsive to a second request from the client, executing a virtual machine according to the copy of the virtual machine image at the at least one geographic location.

70. The method of claim 69, further comprising performing, by the network-accessible service:

responsive to a third request from the client, de-registering the virtual machine image from the network-accessible service.

71. The method of claim 69, wherein the first request is received via a graphical user interface of the network-accessible service.

72. The method of claim 69, wherein the first request is received via a web services interface provided by the network-accessible service.

73. The method of claim 69, wherein the storing of the information indicating a source of the virtual machine image comprises storing an identity of a user account that registered the virtual machine image.

74. The method of claim 69, wherein the storing the virtual machine image in the repository comprises storing one or more execution restrictions associated with the virtual machine image, and the virtual machine is executed in accordance with the one or more execution restrictions.

75. The method of claim 69, wherein distributing the copy of the virtual machine image to be stored locally at the at least one geographic location comprises:

selecting a virtual machine host at the at least one geographic location to store the copy of virtual machine image, wherein the virtual machine is executed on the virtual machine host.

76. The method of claim 69, wherein receiving the first request to register the virtual machine image with the network-accessible service comprises receiving a version of the virtual machine image.

77. One or more non-transitory computer-readable media storing program instructions when executed on one or more processors of a network-accessible service, cause the network-accessible service to:

receive, from a client, a first request to register a virtual machine image with the network-accessible service, wherein the virtual machine image includes an image of an operating system, and first request indicates at least one geographic location selected from multiple geographic locations of the network-accessible service available to execute virtual machines according to the virtual machine image;

cause the the virtual machine image to be stored in a repository in the network-accessible service, along with information indicating a source of the virtual machine image;

cause a copy of the virtual machine image to be distributed to and stored at the at least one geographic location; and

responsive to a second request from the client, cause a virtual machine to be executed according to the copy of the virtual machine image at the at least one geographic location.

78. The system of claim 77, wherein the program instructions when executed on the one or more processors cause the network-accessible service to:

responsive to a third request from the client, cause the virtual machine image to be de-registered from the network-accessible service.