Managing communications between computing nodes

• US 9,794,294 B2
• Filed: 08/17/2016
• Issued: 10/17/2017
• Est. Priority Date: 03/31/2006
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Hoole, Quinton R., Pinkham, Christopher C., Paterson-Jones, Roland, van Biljon, Willem R.
• Primary Examiner(s): Zhao, Wei
• Application Number:
  US15/239,675
• Publication Number:
  US 20160359919A1
• Time in Patent Office: 426 Days
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 12/1439 time-based
• CPC Class Codes: H04L 12/1442 at network operator level
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

Techniques are described for managing communications between multiple intercommunicating computing nodes, such as multiple virtual machine nodes hosted on one or more physical computing machines or systems. In some situations, users may specify groups of computing nodes and optionally associated access policies for use in the managing of the communications for those groups, such as by specifying which source nodes are allowed to transmit data to particular destinations nodes. In addition, determinations of whether initiated data transmissions from source nodes to destination nodes are authorized may be dynamically negotiated for and recorded for later use in automatically authorizing future such data transmissions without negotiation. This abstract is provided to comply with rules requiring an abstract, and it is submitted with the intention that it will not be used to interpret or limit the scope or meaning of the claims.

Claims

1. A computer-implemented method comprising:

obtaining, by one or more computing devices of an execution service, information from a client that specifies an access policy for use with a first computing node, wherein the access policy includes one or more rules for use in managing communications involving network addresses from an indicated range;

providing, by the execution service, the first computing node for the client using a virtual machine hosted by a computer system of the execution service; and

configuring the computer system to manage communications for the hosted virtual machine providing the first computing node, including storing at least a portion of the one or more rules on the computer system, to cause the computer system to use the one or more rules to implement the access policy and determine to allow or prevent a communication to or from the first computing node.

2. The computer-implemented method of claim 1, further comprising:

sending, the first computing node, a communication for a destination that is indicated using an indicated network address from the indicated range; and

managing, by the computer system, the communication based on the access policy, including preventing the communication from being forwarded to the destination of the communication.

3. The computer-implemented method of claim 1 wherein the obtaining of the information from the client that specifies the access policy further includes receiving information from the client to specify, for at least one of the one or more rules, access rights for communications using one or more indicated port numbers, and wherein the method further comprises managing the communication in accordance with the access policy based on at least on port number used by the communication.

4. The computer-implemented method of claim 1 wherein the obtaining of the information from the client that specifies the access policy further includes receiving information from the client to specify, for at least one of the one or more rules, access rights for communications using one or more indicated communication protocols, and wherein the method further comprises managing the communication in accordance with the access policy based on at least one communication protocol used by the communication.

5. The computer-implemented method of claim 1 wherein the obtaining of the information from the client that specifies the access policy further includes receiving information from the client to specify, for at least one of the one or more rules, access rights associated with one or more users that are allowed access to the first computing node, and wherein the method further comprises managing the communication in accordance with the access policy based on at least one user associated with the communication.

16. The computer-implemented method of claim 1 further comprising:

selecting, by the one or more computing devices and from a plurality of computing nodes provided by the execution service for use by multiple clients of the execution service, multiple computing nodes for use by the client;

provisioning, by the one or more computing devices, the multiple computing nodes for use by the client; and

providing the client with access to the provisioned multiple computing nodes,

and wherein the receiving of the information from the client that specifies the access policy further includes receiving information from the client to associate the access policy with the multiple computing nodes.

17. The computer-implemented method of claim 16 further comprising implementing, by the one or more computing devices and for the client, a network of the multiple computing nodes that exchanges communications in accordance with the access policy.

18. The computer-implemented method of claim 1 wherein the providing of the first computing node for the client includes configuring the virtual machine to operate as the first computing node.

19. The computer-implemented method of claim 1 further comprising allowing, based on the access policy, the communication to be received by the first computing node.

20. The computer-implemented method of claim 1 further comprising preventing, based on the access policy, the communication from being received by the first computing node.

21. The computer-implemented method of claim 1 further comprising:

sending, to the computer system, an additional communication for a destination that is indicated using an indicated network address from the indicated range; and

managing, by the computer system, the additional communication based on the access policy, including allowing the additional communication to be received by the destination.

22. The computer-implemented method of claim 1 further comprising:

updating, after using the one or more rules to determine to allow or prevent the communication, the access policy for use with the first computing node to modify further managing of additional communications for the first computing node; and

using the updated access policy to perform the further managing of the additional communications.

23. The computer-implemented method of claim 1 further comprising:

receiving information about one or more additional access policies for use with the first computing node; and

using a combination of the access policy and the one or more additional access policies to further manage one or more additional communications for the first computing node.

24. The computer-implemented method of claim 1 wherein the receiving of the information from the client that specifies the access policy further includes receiving indications of one or more Internet Protocol (IP) addresses and one or more actions to take for communications using the one or more IP addresses, and wherein the method further comprises:

storing the access policy;

receiving a request to apply the access policy to the first computing node; and

applying, based at least in part on the request, the access policy to the first computing node.

25. The computer-implemented method of claim 24 wherein the receiving of the information from the client that specifies the access policy further includes receiving a name defined by the client for one or more computing nodes that include the first computing node, and associating the access policy with the name.

6. A non-transitory computer-readable medium having stored contents that cause a computing device of an execution service to:

receive, by the computing device of the execution service, information from a client of the execution service that specifies an access policy for use with a group of multiple computing nodes that is provided by the execution service for the client and that includes a first virtual machine hosted on a computer system of the execution service, wherein the access policy indicates multiple network addresses and includes one or more rules for use in managing communications involving the multiple network addresses;

provide, by the execution service, the multiple computing nodes to the client, including providing the first virtual machine hosted on the computer system; and

manage, by the computing device of the execution service and based on the access policy, a communication that is to or from the first virtual machine and that uses at least one network address from the multiple network addresses, including using the one or more rules to allow or prevent the communication.

7. The non-transitory computer-readable medium of claim 6 wherein the execution service provides an interface for use by client, and wherein the receiving of the information from the client specifying the access policy is received from one or more interactions of the client with the interface.

8. The non-transitory computer-readable medium of claim 6, wherein the stored contents include software instruction that further cause the computing device to, after the managing of the communication:

receive additional information from the client that specifies a modification to the access policy for use with the first virtual machine, and modifying the access policy based on the specified modification; and

manage additional communications for the multiple computing nodes of the group in accordance with the modified access policy, including to allow at least one of the additional communications to reach its indicated destination and to prevent at least one other of the additional communications from reaching its indicated destination.

12. The non-transitory computer-readable medium of claim 6 wherein the stored contents further cause the computing device to:

select, from a plurality of virtual machines that are hosted on computer systems provided by the execution service for use by multiple clients of the execution service, multiple virtual machines for use as the multiple computing nodes of the client; and

provision the multiple virtual machines for use by the client,

and wherein the receiving of the information from the client that specifies the access policy further includes receiving information from the client to associate the access policy with the multiple computing nodes.

13. The non-transitory computer-readable medium of claim 6 wherein the communication is sent by one of the multiple computing nodes to a destination that is indicated using the at least one network address, and wherein the managing of the communication based on the access policy includes preventing the communication from being received by the destination.

14. The non-transitory computer-readable medium of claim 6 wherein the communication is sent to one of the multiple computing nodes from a sending node that uses the at least one network address, and wherein the managing of the communication based on the access policy includes preventing the communication from being received by the one computing node.

15. The non-transitory computer-readable medium of claim 6 wherein the receiving of the information from the client that specifies the access policy further includes receiving information from the client to specify, for at least one of the one or more rules, at least one of access rights for communications using one or more indicated port numbers, access rights for communications using one or more indicated communication protocols, or access rights associated with one or more users, and wherein the managing of the communication is further performed based on at least one of a port number used by the communication, a communication protocol used by the communication, or a user associated with the communication.

9. A computing system, comprising:

one or more hardware processors; and

one or more memories with stored instructions that, upon execution by at least one hardware processor of the one or more hardware processors, cause the computing system to;

provide a group of multiple computing nodes for use by a client, including a hosted virtual machine;

receive instructions from the client that specify an access policy for use with the group of multiple computing nodes, wherein the access policy includes one or more rules for use in managing communications that satisfy one or more specified criteria involving at least one network address; and

manage, based on the access policy, a communication that is to or from the virtual machine and that satisfies the one or more specified criteria, including using the one or more rules to allow or prevent forwarding of the communication, and wherein the virtual machine executes at least one application program for the client in memory allocated to the virtual machine.

10. The computing system of claim 9 wherein the stored instructions include software instructions of an execution service that further cause the computing system to execute the at least one application program on the virtual machine for the client, and to provide the client with access to the multiple computing nodes, and wherein the one or more specified criteria include multiple network addresses.

11. The computing system of claim 9 further comprising one or more server machines that host multiple virtual machines, wherein the multiple computing nodes are each one of the multiple virtual machines, and wherein the stored instructions further cause the computing system to store information on the one or more server machines to configure the one or more server machines to implement the access policy for the multiple virtual machines.