公开(公告)号：US20150334054A1

公开(公告)日：2015-11-19

申请号：US14807752

申请日：2015-07-23

Applicant: Amazon Technologies, Inc.

Inventor： Kevin Christopher Miller ,  Eric Jason Brandwine ,  Andrew J. Doane

IPC: H04L12/947 ,  H04L12/931 ,  H04L12/933

CPC classification number: H04L49/252 ,  H04L29/06 ,  H04L29/08072 ,  H04L41/0803 ,  H04L41/12 ,  H04L45/02 ,  H04L49/15 ,  H04L49/70 ,  H04L65/1069

Abstract: Techniques are described for providing managed virtual computer networks whose configured logical network topology may have one or more virtual networking devices, such as by a network-accessible configurable network service, with corresponding networking functionality provided for communications between multiple computing nodes of a virtual computer network by emulating functionality that would be provided by the networking devices if they were physically present. The networking functionality provided for a managed computer network may include supporting a connection between that managed computer network and other managed computer networks, such as via a provided virtual peering router to which each of the managed computer networks may connect, with the functionality of the virtual peering router being emulated by modules of the configurable network service without physically providing the virtual peering router, including to manage data communications between computing nodes of the inter-connected managed computer networks in accordance with client-specified configuration information.

Abstract translation: 描述了用于提供被管理的虚拟计算机网络的技术，其被配置的逻辑网络拓扑可以具有一个或多个虚拟网络设备，诸如通过网络可访问的可配置网络服务，具有为虚拟计算机网络的多个计算节点之间的通信提供的相应的网络功能 通过模拟由网络设备提供的功能，如果它们是物理存在的。 为受管理的计算机网络提供的联网功能可以包括支持该被管理的计算机网络与其他被管理的计算机网络之间的连接，例如经由所提供的虚拟对等路由器，每个被管理的计算机网络可以连接到该虚拟对等路由器与虚拟的 对等路由器被可配置网络服务的模块仿真，而不物理地提供虚拟对等路由器，包括根据客户端指定的配置信息来管理连接在一起的被管理计算机网络的计算节点之间的数据通信。

公开(公告)号：US20150172104A1

公开(公告)日：2015-06-18

申请号：US14631675

申请日：2015-02-25

Applicant: Amazon Technologies, Inc.

Inventor： Eric Jason Brandwine

IPC: H04L12/24

CPC classification number: H04L41/0681 ,  H04L41/064 ,  H04L41/0654 ,  H04L41/147 ,  H04L45/22 ,  H04L45/28 ,  H04L69/40

Abstract: Techniques are described for providing managed computer networks. In some situations, the techniques include managing communications for computing nodes of a managed computer network by using one or more particular computing nodes of the managed computer network that are configured to operate as intermediate destinations to handle at least some communications that are sent by and/or directed to one or more other computing nodes of the managed computer network. In addition, the techniques may include managing the communications in accordance with configured failure behavior specified for one or more computing nodes of the computer network, such as specified failure behavior for a computing node configured to operate as an intermediate destination that indicates how communications that would otherwise be routed via the intermediate destination computing node are to be handled if the intermediate destination computing node fails or is otherwise unavailable (e.g., to block or allow such communications).

Abstract translation: 描述了提供托管计算机网络的技术。 在某些情况下，这些技术包括通过使用被管理计算机网络的一个或多个特定计算节点来管理被管理计算机网络的计算节点的通信，所述计算节点被配置为作为中间目的地来操作至少一些由 或被引导到被管理计算机网络的一个或多个其他计算节点。 另外，这些技术可以包括根据为计算机网络的一个或多个计算节点指定的配置的故障行为来管理通信，诸如被配置为作为中间目的地操作的计算节点的指定的故障行为， 否则如果中间目的地计算节点出现故障或不可用（例如，阻塞或允许此类通信），则通过中间目的地计算节点进行路由将被处理。

公开(公告)号：US20150134791A1

公开(公告)日：2015-05-14

申请号：US14599182

申请日：2015-01-16

Applicant: Amazon Technologies, Inc.

Inventor： Daniel T. Cohn ,  Eric Jason Brandwine ,  Andrew J. Doane

IPC: H04L12/24 ,  G06F9/455

CPC classification number: H04L41/0816 ,  G06F9/45533 ,  H04L41/50 ,  H04L61/103 ,  H04L61/251 ,  H04L69/167 ,  H04W4/02 ,  H04W80/045

Abstract: Techniques are described for managing communications between multiple computing nodes, such as computing nodes that are part of a virtual computer network. In some situations, various types of modifications may be made to one or more computing nodes of an existing virtual computer network, and the described techniques include managing ongoing communications for those computing nodes so as to accommodate the modifications. Such modifications may include, for example, migrating or otherwise moving a particular computing node that is part of a virtual network to a new physical network location, or modifying other aspects of how the computing node participates in the virtual network (e.g., changing one or more virtual network addresses used by the computing node). In some situations, the computing nodes may include virtual machine nodes hosted on one or more physical computing machines or systems, such as by or on behalf of one or more users.

Abstract translation: 描述了用于管理多个计算节点（例如作为虚拟计算机网络的一部分的计算节点）之间的通信的技术。 在一些情况下，可以对现有虚拟计算机网络的一个或多个计算节点进行各种类型的修改，并且所描述的技术包括管理那些计算节点的持续通信，以便适应这些修改。 这样的修改可以包括例如将作为虚拟网络的一部分的特定计算节点迁移或以其他方式移动到新的物理网络位置，或修改计算节点如何参与虚拟网络的其他方面（例如，改变一个或多个 计算节点使用更多的虚拟网络地址）。 在一些情况下，计算节点可以包括托管在一个或多个物理计算机或系统上的虚拟机节点，诸如由一个或多个用户代表或代表一个或多个用户。

公开(公告)号：US20150089233A1

公开(公告)日：2015-03-26

申请号：US14037282

申请日：2013-09-25

Applicant: Amazon Technologies, Inc.

Inventor： Gregory Branchek Roth ,  Eric Jason Brandwine

IPC: H04L9/32

CPC classification number: H04L63/0428 ,  H04L9/321 ,  H04L9/3247 ,  H04L63/10 ,  H04L63/102 ,  H04L63/123 ,  H04L63/168 ,  H04L67/02

Abstract: Requests are pre-generated to include a cryptographic key to be used in fulfilling the requests. The requests may be encoded in uniform resource locators and may include authentication information to enable a service provider to whom the requests are submitted to determine whether the requests are authorized. The requests may be passed to various entities who can then submit the requests to the service provider. The service provider, upon receipt of a request, can verify the authentication information and fulfill the request using a cryptographic key encoded in the request.

Abstract translation: 请求被预先生成以包括用于满足请求的加密密钥。 请求可以在统一资源定位符中编码，并且可以包括认证信息，以使能够提交请求的服务提供商确定请求是否被授权。 请求可以被传递给各种实体，然后可以将请求提交给服务提供商。 服务提供商在接收到请求后，可以使用在请求中编码的加密密钥验证认证信息并完成请求。

公开(公告)号：US20140380461A1

公开(公告)日：2014-12-25

申请号：US14479124

申请日：2014-09-05

Applicant: Amazon Technologies, Inc.

Inventor： Andrew J. Doane ,  Eric Jason Brandwine

IPC: H04L29/06

CPC classification number: H04L63/0272 ,  H04L61/2069 ,  H04L63/10 ,  H04L67/18 ,  H04L67/34 ,  H04L67/36

Abstract: Techniques are described for providing users with access to computer networks, such as to enable users to interact with a remote configurable network service to create and configure computer networks that are provided by the configurable network service for use by the users. Secure private access between a computer network provided for a user by the configurable network service and one or more other remote computing systems of the user (e.g., a remote private network) may be enabled in various ways. For example, a user may programmatically invoke an API provided by the configurable network service to obtain assistance in establishing remote access from a remote location to a provided computer network of the configurable network service, such as to establish a VPN connection from the remote location to the provided computer network using hardware and/or software supplied to the remote location in response to the API invocation.

Abstract translation: 描述了用于向用户提供对计算机网络的访问的技术，例如使得用户能够与远程可配置网络服务交互以创建和配置由可配置网络服务提供以供用户使用的计算机网络。 通过可配置网络服务为用户提供的计算机网络与用户的一个或多个其他远程计算系统（例如，远程专用网络）之间的安全私人访问可以以各种方式启用。 例如，用户可以以编程方式调用可配置网络服务提供的API，以获得建立从远程位置到所提供的可配置网络服务的计算机网络的远程访问的帮助，例如建立从远程位置到 提供的计算机网络使用响应于API调用提供给远程位置的硬件和/或软件。

公开(公告)号：US20140283045A1

公开(公告)日：2014-09-18

申请号：US14292545

申请日：2014-05-30

Applicant: Amazon Technologies, Inc.

Inventor： Eric Jason Brandwine ,  Donald L. Bailey, JR.

IPC: H04L29/06

CPC classification number: H04L63/1408 ,  H04L43/50 ,  H04L45/42 ,  H04L45/54 ,  H04L67/125

Abstract: Systems, methods, and interfaces for the management of virtual machine networks and other programmatically controlled networks are provided. Hosted virtual networks are configured in a manner such that a virtual machine manager of the virtual network may monitor activity such as user requests, network traffic, and the status and execution of various virtual machine instances to determine possible security assessments. A security assessment may be performed before, after, or simultaneous to the execution of the activity associated with the security assessment event. The execution of an activity may further be synchronous with the results of the security assessment. The timing of the assessment may correspond to the type of assessment or type of activity that is requested or detected.

Abstract translation: 提供了用于管理虚拟机网络和其他编程控制网络的系统，方法和接口。 托管的虚拟网络被配置为使得虚拟网络的虚拟机管理器可以监视诸如用户请求，网络流量以及各种虚拟机实例的状态和执行之类的活动以确定可能的安全评估。 可以在执行与安全评估事件相关联的活动之前，之后或同时执行安全性评估。 活动的执行可以进一步与安全性评估的结果同步。 评估的时间可能对应于要求或检测到的评估类型或活动类型。

公开(公告)号：US20140237100A1

公开(公告)日：2014-08-21

申请号：US14265159

申请日：2014-04-29

Applicant: Amazon Technologies, Inc.

Inventor： Daniel T. Cohn ,  Eric Jason Brandwine ,  Andrew J. Doane

IPC: H04L12/24

CPC classification number: H04L41/0816 ,  G06F9/45533 ,  H04L41/50 ,  H04L61/103 ,  H04L61/251 ,  H04L69/167 ,  H04W4/02 ,  H04W80/045

Abstract: Techniques are described for managing communications between multiple computing nodes, such as computing nodes that are part of a virtual computer network. In some situations, various types of modifications may be made to one or more computing nodes of an existing virtual computer network, and the described techniques include managing ongoing communications for those computing nodes so as to accommodate the modifications. Such modifications may include, for example, migrating or otherwise moving a particular computing node that is part of a virtual network to a new physical network location, or modifying other aspects of how the computing node participates in the virtual network (e.g., changing one or more virtual network addresses used by the computing node). In some situations, the computing nodes may include virtual machine nodes hosted on one or more physical computing machines or systems, such as by or on behalf of one or more users.

Abstract translation: 描述了用于管理多个计算节点（例如作为虚拟计算机网络的一部分的计算节点）之间的通信的技术。 在一些情况下，可以对现有虚拟计算机网络的一个或多个计算节点进行各种类型的修改，并且所描述的技术包括管理那些计算节点的持续通信，以便适应这些修改。 这样的修改可以包括例如将作为虚拟网络的一部分的特定计算节点迁移或以其他方式移动到新的物理网络位置，或修改计算节点如何参与虚拟网络的其他方面（例如，改变一个或多个 计算节点使用更多的虚拟网络地址）。 在一些情况下，计算节点可以包括托管在一个或多个物理计算机或系统上的虚拟机节点，诸如由一个或多个用户代表或代表一个或多个用户。

公开(公告)号：US20140226492A1

公开(公告)日：2014-08-14

申请号：US14257312

申请日：2014-04-21

Applicant: Amazon Technologies, Inc.

Inventor： Eric Jason Brandwine ,  Swaminathan Sivasubramanian ,  Bradley Eugene Marshall ,  Tate Andrew Certain

IPC: H04L12/24 ,  H04L12/26

CPC classification number: H04L41/5019 ,  H04L12/1489 ,  H04L41/5006 ,  H04L41/5009 ,  H04L41/5029 ,  H04L43/04

Abstract: The behavior of multiple users with access to a multi-tenant resource can be monitored and compliance enforced by monitoring state information for each user. The state information can be captured across a level of a network environment, such that any activity across that layer can be monitored and the data aggregated to give a global view of user behavior. If user behavior is determined to fall outside an acceptable range of behavior, any of a number of remedial actions can be taken, which can include notifying the user, billing the user for the inappropriate behavior, or modifying that behavior outside of the control of the user.

Abstract translation: 可以通过监视每个用户的状态信息来监控具有对多租户资源的访问权限的多个用户的行为，并执行合规性。 可以跨网络环境级别捕获状态信息，从而可以监控跨该层的任何活动，并且聚合数据以给出用户行为的全局视图。 如果确定用户行为超出了可接受的行为范围，则可以采取许多补救措施中的任何一种，其可以包括通知用户，为不适当的行为计费用户，或者将该行为修改为在 用户。

公开(公告)号：US20140181677A1

公开(公告)日：2014-06-26

申请号：US14195382

申请日：2014-03-03

Applicant: Amazon Technologies, Inc.

Inventor： Eric Jason Brandwine ,  Marvin M. Theimer

IPC: H04L12/24

CPC classification number: H04L41/22 ,  G06F9/46 ,  G06F9/5072 ,  G06F17/30 ,  G06Q10/0633 ,  G06Q30/06

Abstract: Control planes of virtual resource providers may be customized in a secure, stable and efficient manner with virtual control planes. Control planes may be modularized. Control plane modules may be supplied with data from standardized sensors, and required to generate standardized resource configuration requests responsive to solicitations with specified response latencies. Custom control plane modules may be selected to replace or complement default control plane modules. Financial and computational costs associated with control plane modules may be tracked. Competing resource configurations may be mediated by a control plane supervisor. Such mediation may be based on control plane module reputation scores. Reputation scores may be based on customer feedback ratings and/or measured performance with respect to module goals. Mediated configuration parameter values may be based on a combination of competing configuration parameter values weighted according to reputation. Contribution of individual modules to goal achievement may be tracked and rewarded accordingly.

Abstract translation: 可以使用虚拟控制平面以安全，稳定和有效的方式定制虚拟资源提供商的控制平面。 控制平面可以模块化。 控制平面模块可以从标准化传感器提供数据，并且需要响应于具有指定响应延迟的请求来生成标准化的资源配置请求。 可以选择自定义控制平面模块来替换或补充默认控制平面模块。 可跟踪与控制平面模块相关的财务和计算成本。 竞争资源配置可能由控制平面主管介导。 这种调解可以基于控制平面模块的信誉评分。 信誉分数可以基于客户反馈评级和/或与模块目标相关的测量性能。 介入的配置参数值可以基于根据声誉加权的竞争配置参数值的组合。 个别模块对目标实现的贡献可以相应地跟踪和奖励。

公开(公告)号：US20140181278A1

公开(公告)日：2014-06-26

申请号：US14195379

申请日：2014-03-03

Applicant: Amazon Technologies, Inc.

Inventor： Eric Jason Brandwine ,  Marvin M. Theimer

IPC: H04L12/24

CPC classification number: H04L41/0806 ,  G06F9/5061 ,  H04L41/5054 ,  H04L41/5096

Abstract: Control planes of virtual resource providers may be customized in a secure, stable and efficient manner with virtual control planes. Control planes may be modularized. Control plane modules may be supplied with data from standardized sensors, and required to generate standardized resource configuration requests responsive to solicitations with specified response latencies. Custom control plane modules may be selected to replace or complement default control plane modules. Financial and computational costs associated with control plane modules may be tracked. Competing resource configurations may be mediated by a control plane supervisor. Such mediation may be based on control plane module reputation scores. Reputation scores may be based on customer feedback ratings and/or measured performance with respect to module goals. Mediated configuration parameter values may be based on a combination of competing configuration parameter values weighted according to reputation. Contribution of individual modules to goal achievement may be tracked and rewarded accordingly.

Abstract translation: 可以使用虚拟控制平面以安全，稳定和有效的方式定制虚拟资源提供商的控制平面。 控制平面可以模块化。 控制平面模块可以从标准化传感器提供数据，并且需要响应于具有指定响应延迟的请求来生成标准化的资源配置请求。 可以选择自定义控制平面模块来替换或补充默认控制平面模块。 可跟踪与控制平面模块相关的财务和计算成本。 竞争资源配置可能由控制平面主管介导。 这种调解可以基于控制平面模块的信誉评分。 信誉分数可以基于客户反馈评级和/或与模块目标相关的测量性能。 介入的配置参数值可以基于根据声誉加权的竞争配置参数值的组合。 个别模块对目标实现的贡献可以相应地跟踪和奖励。