Managing communications between computing nodes

• US 7,801,128 B2
• Filed: 03/31/2006
• Issued: 09/21/2010
• Est. Priority Date: 03/31/2006
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Pinkham, Christopher C., Van Biljon, Willem R., Hoole, Quinton R., Paterson-Jones, Roland
• Primary Examiner(s): Ton; Dang T
• Assistant Examiner(s): Zhao; Wei
• Application Number:
  US11/394,595
• Publication Number:
  US 20070239987A1
• Time in Patent Office: 1,635 Days
• Field of Search: 370/389, 370/316, 709/245, 709/206
• US Class Current: 370/389
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 12/1439 time-based
• CPC Class Codes: H04L 12/1442 at network operator level
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

Techniques are described for managing communications between multiple intercommunicating computing nodes, such as multiple virtual machine nodes hosted on one or more physical computing machines or systems. In some situations, users may specify groups of computing nodes and optionally associated access policies for use in the managing of the communications for those groups, such as by specifying which source nodes are allowed to transmit data to particular destinations nodes. In addition, determinations of whether initiated data transmissions from source nodes to destination nodes are authorized may be dynamically negotiated for and recorded for later use in automatically authorizing future such data transmissions without negotiation. This abstract is provided to comply with rules requiring an abstract, and it is submitted with the intention that it will not be used to interpret or limit the scope or meaning of the claims.

Claims

1. A computer-implemented method for managing data transmissions between a plurality of virtual machine nodes hosted on a network of multiple computing systems such that each of the computing systems hosts multiple of the virtual machine nodes, the method comprising:

receiving definitions of multiple groups of nodes such that each group has multiple members that are each authorized to communicate with the other members of the node group, the multiple members of each group being multiple related virtual machine nodes from the plurality of virtual machine nodes;

for each of multiple source virtual machine nodes that each initiate a transmission of data to a remote destination virtual machine node, and under control of the computing system hosting the source virtual machine node, permitting the transmission only if authorized by,

receiving an indication from the source node to transmit data to the remote destination node;

determining if authorization for current transmissions from the source node to the destination node already exists based on negotiations from any prior transmissions from the source node to the destination node;

if authorization for current transmissions from the source node to the destination node is determined to already exist, transmitting the data to the destination node; and

if authorization for current transmissions from the source node to the destination node is not determined to already exist,

communicating with a distinct computing system hosting the destination node to negotiate for authorization from the distinct computing system for the source node to transmit to the destination node, authorization for a source node to transmit to a destination node being based at least in part on the source node and the destination node each being members of a common node group; and

if the negotiated authorization is obtained from the distinct computing system, transmitting the data to the destination node on behalf of the source node, and storing an indication of the obtained authorization for use in authorizing future transmissions of data from the source node to the destination node without negotiation; and

for each of multiple destination virtual machine nodes to which a transmission of data is initiated from a remote source virtual machine node, and under control of the computing system hosting the destination virtual machine node, determining whether to authorize the transmission by;

receiving a request from the computing system hosting the source node for authorization to transmit data to the destination node;

determining a first set of one or more node groups of which the source node is a member;

determining a second set of one or more node groups of which the destination node is a member;

determining whether the source node is authorized to communicate with the destination node based at least in part on whether at least one group of the first set is also a group of the second set; and

sending a response to the computing system hosting the source node that indicates whether authorization is provided for the source node to communicate with the destination node,

and wherein each of the computing systems hosts a single privileged virtual machine node that executes a data transmission manager program to control transmissions to and from all other virtual machine nodes hosted by the computing system by intercepting those transmissions and by forwarding those transmissions to intended recipients only if those transmissions are determined to be authorized, such that the permitting of an initiated transmission from a source virtual machine node under the control of the computing system hosting the source virtual machine node is performed by the data transmission manager program for that computing system, and such that the determining whether to authorize an initiated transmission to a destination virtual machine node under the control of the computing system hosting the destination virtual machine node is performed by the data transmission manager program for that computing system.

2. A computer-implemented method for managing outgoing data transmissions from multiple virtual machine nodes, the method comprising:

receiving multiple indications of outgoing transmissions of data being initiated by multiple source nodes that are each one of multiple virtual machines hosted by a host computing system, each indicated data transmission being from one of the source nodes to a remote destination node; and

for each initiated outgoing transmission of data from a source node to a remote destination node,

determining if authorization already exists for transmissions from the source node to the destination node;

if authorization does not already exist for transmissions from the source node to the destination node, attempting to obtain authorization by automatically initiating a negotiation for authorization to transmit to the destination node, the initiating including sending a request with information regarding the source node to a recipient associated with the destination node; and

if the authorization is obtained from the negotiation, transmitting the data to the destination node on behalf of the source node and storing an indication of the obtained authorization for use in authorizing future transmissions of data from the source node to the destination node without negotiation,

and wherein, for each of one or more of the initiated outgoing transmissions of data from a source node to a remote destination node, the sent request that initiates the negotiation for authorization includes an indication of a transmission protocol to be used for the transmission, and the authorization for the transmission is based at least in part on the indicated transmission protocol.

3. The method of claim 2 further comprising, for each of one or more of the initiated outgoing transmissions of data from a source node to a remote destination node, if authorization is not obtained from an initiated negotiation, preventing transmitting of the data to the destination node and storing an indication of a lack of authorization for use in preventing authorization for future transmissions of data from the source node to the destination node.

4. The method of claim 3 wherein, for each of one or more of the initiated outgoing transmissions of data from a source node to a remote destination node, the determining if authorization already exists for transmissions from the source node to the destination node includes determining that authorization does not already exist if no stored indications exist from a prior initiated transmission from the source node to the remote destination node so as to indicate authorization or lack of authorization for future transmissions from the source node to the destination node, and further comprising preventing transmitting of the data to the destination node if it is determined that a stored indication from a prior initiated transmission indicates a lack of authorization for transmissions from the source node to the destination node.

5. The method of claim 3 wherein each stored indication of a lack of authorization from an initiated outgoing transmission of data from a source node to a remote destination node includes a created transmission management rule that indicates that future transmissions of data from the source node to the destination node are not authorized.

6. The method of claim 5 wherein each stored indication of obtained authorization from an initiated outgoing transmission of data from a source node to a remote destination node includes a created transmission management rule that indicates that future transmissions of data from the source node to the destination node are authorized.

7. The method of claim 6 wherein at least some of the stored transmission management rules each have an associated expiration time after which the rule is no longer used to determine whether transmissions are authorized.

8. The method of claim 2 wherein, for each of one or more of the initiated outgoing transmissions of data from a source node to a remote destination node, the stored indication of the obtained authorization includes an indication that future transmissions of response data from the destination node to the source node are authorized.

9. The method of claim 2 further comprising, for each of one or more of the multiple source nodes that initiated the outgoing transmissions of data, and after authorization is obtained for an initiated transmission of data from the source node to a remote destination node, receiving indications of one or more additional transmissions of data from the source node to the destination node and allowing the additional transmissions to occur without additional negotiation based on the obtained authorization.

10. The method of claim 9 further comprising, for each of one or more of the multiple source nodes that initiated the outgoing transmissions of data, and after authorization is obtained for an initiated transmission of data from the source node to a remote destination node, receiving indications of one or more additional transmissions of data from the source node to other remote destination nodes and preventing the additional transmissions of data from being sent to the other remote destination nodes while initiating negotiations to attempt to obtain authorization for the additional transmissions.

11. The method of claim 2 wherein, for each of one or more of the initiated outgoing transmissions of data from a source node to a remote destination node, the sent request that initiates the negotiation for authorization includes an indication of a network address of the source node, and wherein authorization for the transmission is based at least in part on the indicated network address being permitted to communicate with the destination node.

13. The method of claim 2 wherein, for each of one or more of the initiated outgoing transmissions of data from a source node to a remote destination node, the sent request that initiates the negotiation for authorization includes an indication of one or more groups of which the source node is a member.

14. The method of claim 13 wherein each of the groups include multiple virtual machine node members that are each authorized to communicate with the other members of the group.

15. The method of claim 13 wherein each of the groups include multiple virtual machine node members that are all authorized to communicate with one or more other virtual machine nodes.

16. The method of claim 13 further comprising, for each of one or more of the multiple virtual machine nodes from which outgoing data transmissions are managed, receiving an indication that the virtual machine node is a member of one or more of multiple defined node groups.

17. The method of claim 16 further comprising, for each of the one or more virtual machine nodes, receiving a request with information regarding a remote node that has initiated a transmission to the virtual machine node, and responding with an indication of whether the transmission to the virtual machine node is authorized based at least in part on the one or more defined node groups of which the virtual machine node is a member.

18. The method of claim 17 further comprising, for each of the one or more virtual machine nodes, if the transmission to the virtual machine node from the remote node is authorized, storing an indication for use in automatically authorizing future transmissions of data from the remote node to the virtual machine node.

19. The method of claim 2 further comprising partitioning at least some of the multiple virtual machine nodes into at least a first node group and a second node group each having multiple virtual machine node members such that none of the virtual machine node members of the first node group are also members of the second node group.

20. The method of claim 19 wherein the multiple virtual machine node members of the first node group are used for one of software development, software testing, and software deployment, and wherein the multiple virtual machine node members of the second node group are used for another of software development, software testing, and software deployment.

21. The method of claim 19 wherein the multiple virtual machine node members of the first node group are used to provide a first type of application and the multiple virtual machine node members of the second node group are used to provide a distinct second type of application, and wherein the members of the first node group interoperate with the members of the second node group to provide a multi-tiered business application.

22. The method of claim 19 wherein the multiple virtual machine node members of the first node group are utilized by a first structural subset of an organization and the multiple virtual machine node members of the second node group are utilized by a distinct second structural subset of the organization.

23. The method of claim 2 further comprising receiving one or more definitions of groups from a service that provides use of one or more applications to multiple customers, and wherein the service assigns a distinct group to each of its multiple customers.

24. The method of claim 2 wherein at least some of the multiple virtual machine nodes each belong to one or more groups of nodes, wherein negotiations for authorization for source nodes to transmit to destination nodes are based at least in part on groups to which the source and destination nodes belong, and wherein the method further comprises modifying the groups of nodes based on one or more received indications of group management operations, each indicated group management operation being one of an instruction to create a new group, an instruction to delete an existing group, and an instruction to change the virtual machine nodes that belong to an existing group.

25. The method of claim 24 wherein the negotiations for authorization for source nodes to transmit to destination nodes are further based at least in part on access policies associated with the groups to which the source and destination nodes belong, and wherein the method further comprises modifying access policies associated with groups based on one or more received indications of access policies, each indicated access policy including a specification of conditions under which a first group of one or more source nodes are authorized to communicate with members of a second group of destination nodes.

26. The method of claim 2 wherein, for each of one or more of the initiated outgoing transmissions of data from a source node to a remote destination node, the sent request that initiates the negotiation for authorization includes an indication of one or more groups with which the source node is authorized to communicate.

27. The method of claim 2 wherein, for each of one or more of the initiated outgoing transmissions of data from a source node to a remote destination node, the received indication of the data transmission includes one or more data packets addressed to the remote destination node that are sent from the source node.

28. The method of claim 27 wherein, for each of the one or more initiated outgoing data transmissions, the receiving of the indication of the data transmission includes intercepting the data packets sent by the source node and discarding the data packets if authorization does not already exist for transmissions from the source node to the destination node.

29. The method of claim 27 wherein, for each of the one or more initiated outgoing data transmissions, the receiving of the indication of the data transmission includes intercepting the data packets sent by the source node, and further comprising queuing the data packets during negotiation for authorization to transmit the data packets to the destination node for the data packets.

30. The method of claim 2 wherein, for each of one or more of the initiated outgoing transmissions of data from a source node to a remote destination node, the request that initiates negotiation is sent to a computing system that hosts the destination node.

31. The method of claim 30 wherein, for each of one or more of the initiated outgoing transmissions of data from a source node to a remote destination node, the request sent to the computing system that hosts the destination node is addressed to the destination node and is intercepted by the computing system that hosts the destination node.

32. The method of claim 2 wherein, for each of one or more of the initiated outgoing transmissions of data from a source node to a remote destination node, the data transmission includes a request to access a network service provided by the destination node.

33. The method of claim 2 wherein the method is performed by a traffic manager program executing on a virtual machine hosted by the host computing system that is distinct from the multiple hosted virtual machines that are the multiple source nodes.

34. The method of claim 33 wherein the distinct hosted virtual machine is a privileged virtual machine via which transmissions to and from the multiple hosted virtual machines pass.

35. The method of claim 33 wherein, for each of one or more of the initiated outgoing transmissions of data from a source node to a remote destination node, the request that initiates negotiation is received by a traffic manager program executing as part of a hosted virtual machine on a computing system that hosts the destination node as a distinct virtual machine, and further comprising, under control of the traffic manager program that receives the request, determining whether the source node is authorized to perform the transmission of data to the destination node and sending a reply indicating that authorization is provided if the source node is determined to be authorized.

36. The method of claim 2 further comprising, for each of one or more of the multiple source nodes, in response to receiving an indication that the virtual machine source node has been terminated, removing all stored indications of authorizations for the source node.

37. The method of claim 2 further comprising, for one or more of the multiple source nodes, storing an indication that disallows transmission of data from the source node if a volume of data transmitted by the source node exceeds a pre-determined threshold.

38. The method of claim 2 wherein, for one of the one or more initiated outgoing transmissions of data from a source node to a remote destination node, the transmission protocol indicated in the sent request that initiates the negotiation for authorization is at least one of Hypertext Transfer Protocol (“

HTTP”

), File Transfer Protocol (“

FTP”

), and Simple Mail Transport Protocol (“

SMTP”

).

12. A computer-implemented method for managing outgoing data transmissions from multiple virtual machine nodes, the method comprising:

receiving multiple indications of outgoing transmissions of data being initiated by multiple source nodes that are each one of multiple virtual machines hosted by a host computing system, each indicated data transmission being from one of the source nodes to a remote destination node; and

for each initiated outgoing transmission of data from a source node to a remote destination node,

determining if authorization already exists for transmissions from the source node to the destination node;

if authorization does not already exist for transmissions from the source node to the destination node, attempting to obtain authorization by automatically initiating a negotiation for authorization to transmit to the destination node, the initiating including sending a request with information regarding the source node to a recipient associated with the destination node; and

if the authorization is obtained from the negotiation, transmitting the data to the destination node on behalf of the source node and storing an indication of the obtained authorization for use in authorizing future transmissions of data from the source node to the destination node without negotiation,

and wherein, for each of one or more of the initiated outgoing transmissions of data from a source node to a remote destination node, the sent request that initiates the negotiation for authorization includes an indication of one or more transmission properties of the initiated outgoing transmission, and authorization for the transmission is based at least in part on at least one of the indicated one or more transmission properties.

39. The method of claim 12 further comprising, for each of one or more of the initiated outgoing transmissions of data from a source node to a remote destination node, if authorization is not obtained from an initiated negotiation, preventing transmitting of the data to the destination node and storing an indication of a lack of authorization for use in preventing authorization for future transmissions of data from the source node to the destination node.

40. The method of claim 39 wherein each stored indication of a lack of authorization from an initiated outgoing transmission of data from a source node to a remote destination node includes a created transmission management rule that indicates that future transmissions of data from the source node to the destination node are not authorized, and wherein each stored indication of obtained authorization from an initiated outgoing transmission of data from a source node to a remote destination node includes a created transmission management rule that indicates that future transmissions of data from the source node to the destination node are authorized.

41. The method of claim 12 further comprising, for each of one or more of the multiple source nodes that initiated the outgoing transmissions of data, and after authorization is obtained for an initiated transmission of data from the source node to a remote destination node, receiving indications of one or more additional transmissions of data from the source node to the destination node and allowing the additional transmissions to occur without additional negotiation based on the obtained authorization, and receiving indications of one or more other additional transmissions of data from the source node to other remote destination nodes and preventing the other additional transmissions of data from being sent to the other remote destination nodes while initiating negotiations to attempt to obtain authorization for the other additional transmissions.

42. The method of claim 12 wherein, for each of the one or more initiated outgoing transmissions of data from a source node to a remote destination node, the one or more transmission properties indicated in the sent request that initiates the negotiation for authorization include multiple transmission properties, and wherein authorization for the transmission is further based at least in part on all of the multiple transmission properties.

43. The method of claim 12 wherein, for one of the one or more initiated outgoing transmissions of data from a source node to a remote destination node, the one or more transmission properties indicated in the sent request that initiates the negotiation for authorization include at least one of a type of packet, a connection limit, a packet size, a packet arrival time, a packet departure time, a packet time-to-live value, and information about packet payload contents.

44. The method of claim 12 wherein, for each of the one or more initiated outgoing transmissions of data from a source node to a remote destination node, the sent request that initiates the negotiation for authorization includes an indication of one or more groups of which the source node is a member, and wherein authorization for the transmission is further based at least in part on at least one of the indicated one or more groups.

45. The method of claim 44 wherein, for one of the one or more initiated outgoing transmissions of data from a source node to a remote destination node, the negotiation for authorization for the source node to transmit to the destination node for the one initiated outgoing transmission of data is further based at least in part on one or more access policies associated with the one or more groups to which the source node belongs and on one or more access policies associated with one or more groups to which the destination node belongs.

46. The method of claim 12 further comprising partitioning at least some of the multiple virtual machine nodes into at least a first node group and a second node group each having multiple virtual machine node members such that none of the virtual machine node members of the first node group are also members of the second node group, and wherein the multiple virtual machine node members of the first node group are configured to perform one or more types of functionality distinct from the multiple virtual machine node members of the second node group.

47. The method of claim 12 wherein the method is performed by a traffic manager program executing on a virtual machine hosted by the host computing system that is distinct from the multiple hosted virtual machines that are the multiple source nodes, the distinct hosted virtual machine being a privileged virtual machine via which transmissions to and from the multiple hosted virtual machines pass.

48. A computing system configured to manage outgoing data transmissions from multiple virtual machine nodes, the computing system comprising:

a memory; and

multiple hosted virtual machines that each act as an independent computing node and each execute at least one application program in a portion of the memory allocated to that virtual machine, one of the hosted virtual machine computing nodes being configured to manage data transmissions from the other hosted virtual machine computing nodes by;

receiving an indication of an outgoing transmission of data initiated from a source one of the other hosted virtual machine computing nodes, the indicated data transmission being intended for a remote destination node; and

managing the initiated outgoing transmission of data to the remote destination node by,

determining if authorization already exists for transmissions from the source virtual machine computing node to the destination node;

if authorization does not already exist for transmissions from the source virtual machine computing node to the destination node, attempting to obtain authorization by initiating a negotiation for authorization to transmit to the destination node, the initiating including sending a request with information regarding the source virtual machine computing node to a recipient associated with the destination node, the sent request including an indication of a transmission protocol to be used for the transmission; and

if the authorization is obtained from the negotiation, transmitting the data to the destination node on behalf of the source virtual machine computing node and storing an indication of the obtained authorization for use in authorizing future transmissions of data from the source virtual machine computing node to the destination node without negotiation, the authorization for the transmission being based at least in part on the indicated transmission protocol in the sent request.

49. The computing system of claim 48 wherein the one hosted virtual machine computing node is further configured to, if a reply is received indicating that the authorization is obtained from the negotiation, store a transmission management rule to authorize future transmissions of data from the source virtual machine computing node to the destination node without request, and to, if a reply is received indicating that the authorization from the negotiation is denied, store a transmission management rule to indicate a lack of authorization for future transmissions of data from the source virtual machine computing node to the destination node.

50. The computing system of claim 48 wherein the destination node is a virtual machine hosted on a remote host computing system, and wherein the request sent as part of initiating the negotiation for authorization to transmit to the destination node is intercepted by another virtual machine computing node hosted on the remote host computing system to manage data transmissions involving the destination node, the another virtual machine computing node being configured to reply to the intercepted request on behalf of the destination node.

51. The computing system of claim 48 wherein the one hosted virtual machine computing node is a data transmission manager component that includes software instructions for execution in the memory.

52. The computing system of claim 48 wherein each of the multiple virtual machines hosted on the computing system has a distinct network address.

53. The computing system of claim 48 wherein the one hosted virtual machine computing node consists of a means for managing data transmissions from the other hosted virtual machine computing nodes by:

receiving an indication of an outgoing transmission of data initiated from a source one of the other hosted virtual machine computing nodes, the indicated data transmission being intended for a remote destination node; and

managing the initiated outgoing transmission of data to the remote destination node by,

determining if authorization already exists for transmissions from the source virtual machine computing node to the destination node;

if authorization does not already exist for transmissions from the source virtual machine computing node to the destination node, attempting to obtain authorization by initiating a negotiation for authorization to transmit to the destination node, the initiating including sending a request with information regarding the source virtual machine computing node to a recipient associated with the destination node, the sent request including an indication of a transmission protocol to be used for the transmission; and

if the authorization is obtained from the negotiation, transmitting the data to the destination node on behalf of the source virtual machine computing node and storing an indication of the obtained authorization for use in authorizing future transmissions of data from the source virtual machine computing node to the destination node without negotiation, the authorization for the transmission being based at least in part on the indicated transmission protocol in the sent request.