Source: https://patents.google.com/patent/US10225262B2/en
Timestamp: 2019-10-20 02:33:57
Document Index: 378860655

Matched Legal Cases: ['application No. 201080056327', 'application No. 201080049395', 'application No. 2013', 'application No. 201202502', 'application No. 201202870', 'application No. 201202868', 'application No. 201107040', 'application No. 2', 'application No. 201202967', 'application No. 201080015811', 'application No. 201107040', 'application No. 2012', 'application No. 201080015811', 'application No. 201080015811', 'application No. 201080015811', 'application No. 2', 'application No. 2', 'application No. 201080015811', 'application No. 201080015811', 'application No. 2012', 'application No. 2012', 'application No. 2013', 'application No. 10827392', 'application No. 201080056327', 'application No. 201080049395']

US10225262B2 - Managing security groups for data instances - Google Patents
US10225262B2
US10225262B2 US15/645,886 US201715645886A US10225262B2 US 10225262 B2 US10225262 B2 US 10225262B2 US 201715645886 A US201715645886 A US 201715645886A US 10225262 B2 US10225262 B2 US 10225262B2
US15/645,886
US20170318025A1 (en
2009-03-31 Priority to US12/416,017 priority Critical patent/US9705888B2/en
2017-07-10 Application filed by Amazon Technologies Inc filed Critical Amazon Technologies Inc
2017-07-10 Priority to US15/645,886 priority patent/US10225262B2/en
2017-11-02 Publication of US20170318025A1 publication Critical patent/US20170318025A1/en
2019-03-05 Publication of US10225262B2 publication Critical patent/US10225262B2/en
241001417527 Pempheridae Species 0 description 19
This application is a continuation of U.S. patent application Ser. No. 12/416,017, filed Mar. 31, 2009, now U.S. Pat. No. 9,705,888, which is hereby incorporated by reference herein in its entirety, and which is related to co-pending U.S. patent application Ser. No. 12/415,958, entitled “Control Service and Relational Data Management,” filed Mar. 31, 2009, now U.S. Pat. No. 8,713,060, which is hereby incorporated herein by reference.
When a data instance is created, customers can specify one or more security groups to restrict network access to the data instance. Customers can authorize access to the data instance by adding permission rules to the security group that are applied to the database via an AuthorizeDBSecurityGroupIngress or similar API. Customers can also add or remove security groups from a data instance at any time using a ModifyDatabase or similar API. Customers can create (or delete) security groups using a CreateDBSecurityGroup (or DeleteDBSecurityGroup) API.
rds-create-database --identifier customerprod --dbname customer - -size 80 -class small --engine mysqI5.1 --master master_username --password master_password --port 4030
The customer can grant access to the default security group, such as from the address range
205.192.0.0/16 by:
create-user --identifier customerprod --username develop1 -- password develop1 create-user --identifier customerprod --username analyst1-- password analyst1
The customer can, with respect to the data plane, perform an action such as granting read/write privileges to a develop 1 user for all tables owned by master_username, such as by submitting through an API of the control plane:
$ mysql-u master_username -h end_point_hostname --port 4030 -p master1 Mysql>grant select, insert, update, delete on master_username.* to ‘develop1 ‘@’%’;
$ mysql-u master_username -h end_point hostname --port 4030 -p master1 Mysql>grant select on master_username.*to‘analyst1 ‘@’%’;
There can be a number of other actions performed via the control plane relating to users and security groups. For example, a ResetUserPassword or similar API can be exposed via the Web service layer to allow users to change forgotten passwords. When a customer requests a database user password reset, the Web service layer can validate that the lifecycle allows such user operations (e.g., not in a “Creating” or “Deleting” state), and validate that the user lifecycle allows a password reset (e.g., set to “Available”). The record for the user can be updated in the Admin data store with a lifecycle of “Reset Password” and a change state of “Pending”. A sweeper discovering such a record can launch a workflow that updates the change state to “Applying,” and requests that the host manager modify the user password. The workflow then can update the record in the Admin data store to a lifecycle of “Available” and a change state of “None,” and can notify the customer.
rotate-rds-key \ --stage One of Devo, Integ, QA, or Prod\ --type credential_type\ --publicKey value for public key \ --privateKey optional for some types; value for private key
receiving, via a control plane interface, a request to add or to update a control security group for a data instance in a data storage service that is associated with a native security group for the data instance, wherein the control plane interface provides a management interface for managing the data instance separate from a data plane interface for accessing data of the data instance;
creating or updating the control security group for the data instance with a permission in the control security group that determines an access level of each member of the control security group without modifying the native security group and while allowing client access to the data instance via the data plane interface in accordance with a permission in the native security group for the data instance;
storing the permission in the control security group created or updated according to the request for use in determining subsequent access to the data instance by a member of the control security group; and
controlling access to the data instance via the data plane interface based, at least in part, on the control security group.
2. The method of claim 1, wherein a plurality of control security groups are associated with the data instance, including the control security group, and wherein each of the control security groups have at least one of a different set of permissions and a different set of members.
3. The computer-implemented method of claim 1, wherein updating the control security group includes at least one of deleting the control security group, adding at least one user, deleting at least one user, updating a password for the control security group, or modifying an access level of the control security group to the data instance in the data environment.
4. The method of claim 1, wherein requests affecting the control security group are restricted to being processed by a control environment.
5. The method of claim 1, wherein the control plane interface is for a control environment operable to perform at least one task selected from the control security group comprising authenticating users based on credentials, authorizing users, throttling user requests, or marshalling or unmarshalling requests and responses.
in response to receiving the request, storing information for the request to a job queue; and
in response to detecting the information stored in the job queue, assembling and executing a workflow to manage creating or updating the control security group.
7. The method of claim 1, further comprising communicating information for the created or updated control security group to a host manager for the data instance in the data storage service.
a memory to store program instructions which, if performed by at least one processor, cause the at least one processor to perform a method to at least:
receive, via a control plane interface, a request to add or update a control security group for a data instance in a data storage service that is associated with a native security group for the data instance, wherein the control plane interface provides a management interface for managing the data instance separate from a data plane interface for accessing data of the data instance;
create or update the control security group for the data instance with a permission in the control security group that determines an access level of each member of the control security group without modifying the native security group and while allowing client access to the data instance with a permission in the native security group for the data instance;
store the permission in the control security group created or updated according to the request for use in determining subsequent access to the data instance by a member of the control security group; and
control access to the data instance via the data plane interface based, at least in part, on the control security group.
9. The system of claim 8, wherein requests affecting the control security group are restricted to being processed by a control environment.
10. The system of claim 8, wherein to update the control security group includes at least one of deleting the control security group, adding at least one user, deleting at least one user, updating a password for the control security group, or modifying an access level of the control security group to the data instance in the data environment.
11. The system of claim 8, wherein the program instructions further cause the at least one processor to perform the method to:
in response to the receipt of the request, store information for the request to a job queue.
12. The system of claim 11, wherein the program instructions further cause the at least one processor to perform the method to:
in response to a detection of the information stored in the job queue, assemble and execute a workflow to manage creating or updating the control security group.
13. The system of claim 8, wherein the program instructions further cause the at least one processor to perform the method to:
communicate information for the created or updated control security group to a host manager for the data instance in the data storage service.
14. The system of claim 8, wherein a plurality of control security groups, including the control security group, are associated with the data instance, and wherein each of the control security groups has at least one of a different set of permissions and a different set of members.
15. A non-transitory, computer-readable storage medium, storing program instructions that, when executed by at least one computing device, cause the at least one computing device to implement:
receiving, via a control plane interface, a request to add or update a control security group for a data instance in a data storage service that is associated with a native security group, wherein the control plane interface provides a management interface for managing the data instance separate from a data plane interface for accessing data of the data instance;
16. The non-transitory, computer-readable storage medium of claim 15, wherein a plurality of control security groups are associated with the data instance, including the control security group, and wherein each of the control security groups have at least one of a different set of permissions and a different set of members.
17. The non-transitory, computer-readable storage medium of claim 15, wherein updating the control security group includes at least one of deleting the control security group, adding at least one user, deleting at least one user, updating a password for the control security group, or modifying an access level of the control security group to the data instance in the data environment.
18. The non-transitory, computer-readable storage medium of claim 15, requests affecting the control security group are restricted to being processed by a control environment.
19. The non-transitory, computer-readable storage medium of claim 15, wherein the control plane interface is for a control environment operable to perform at least one task selected from the control security group comprising authenticating users based on credentials, authorizing users, throttling user requests, or marshalling or unmarshalling requests and responses.
20. The non-transitory, computer-readable storage medium of claim 15, wherein the program instructions cause the one or more computing devices to further implement communicating information for the currently or updated control security group to a host manager for the data instance in the data storage service.
US15/645,886 2009-03-31 2017-07-10 Managing security groups for data instances Active US10225262B2 (en)
US12/416,017 US9705888B2 (en) 2009-03-31 2009-03-31 Managing security groups for data instances
US15/645,886 US10225262B2 (en) 2009-03-31 2017-07-10 Managing security groups for data instances
US16/290,421 US20190268347A1 (en) 2009-03-31 2019-03-01 Managing security groups for data instances
US12/416,017 Continuation US9705888B2 (en) 2009-03-31 2009-03-31 Managing security groups for data instances
US16/290,421 Continuation US20190268347A1 (en) 2009-03-31 2019-03-01 Managing security groups for data instances
US20170318025A1 US20170318025A1 (en) 2017-11-02
US10225262B2 true US10225262B2 (en) 2019-03-05
US12/416,017 Active 2032-03-23 US9705888B2 (en) 2009-03-31 2009-03-31 Managing security groups for data instances
US15/645,886 Active US10225262B2 (en) 2009-03-31 2017-07-10 Managing security groups for data instances
US16/290,421 Pending US20190268347A1 (en) 2009-03-31 2019-03-01 Managing security groups for data instances
US (3) US9705888B2 (en)
NL2008643C2 (en) * 2012-04-16 2013-10-17 Clinct Holding B V Computer network for services retrieval, method for managing such network and a computer system for such network.
2009-03-31 US US12/416,017 patent/US9705888B2/en active Active
2017-07-10 US US15/645,886 patent/US10225262B2/en active Active
2019-03-01 US US16/290,421 patent/US20190268347A1/en active Pending
English translation of the First Office Action dated Apr. 21, 2014; in corresponding Chinese patent application No. 201080056327.0.
English translation of the Notice of the First Office Action dated Jun. 12, 2014; in corresponding Chinese patent application No. 201080049395.4.
English translation of the Office Action dated Sep. 16, 2014; in corresponding Japanese patent application No. 2013-262835.
Examination Report dated Dec. 11, 2012; in corresponding Singaporean patent application No. 201202502-9.
Examination Report dated Oct. 19, 2012; in Singaporean patent application No. 201202870-0.
Examination Report dated Oct. 29, 2012; in corresponding Singaporean patent application No. 201202868-4.
Examination Report dated Oct. 30, 2012; in corresponding Singaporean patent application No. 201107040-6.
Examiner's Report dated Jul. 25, 2014; in corresponding Canadian patent application No. 2,778,723.
Invitation to Respond to Written Opinion dated Sep. 14, 2012; in corresponding Singaporean patent application No. 201202967-4.
Notice on the Third Office Action dated Jan. 19, 2015; in corresponding Chinese patent application No. 201080015811.9.
NPL_51_English abstract for JP2004206694; published Jul. 22, 2004 and retrieved on Feb. 6, 2015.
NPL_52_English abstract for JP2004362596; published Dec. 24, 2004 and retrieved on Feb. 6, 2015.
NPL_53_English abstract for JP2005267056; published Sep. 29, 2005 and retrieved on Feb. 6, 2015.
NPL_54 McNett; Usher: An Extensible Framework for Managing Clusters of Virtual Machines; pp. 167-181 of the Proceedings of the 21st Large Installation System Administration Conference (LISA '07) Nov. 11-16, 2007.
NPL_55_English abstract for JP2003330781; published Nov. 21, 2003 and retrieved on Jan. 8, 2015.
NPL_56 Certificate of Grant issued May 21, 2014; in corresponding Singaporean patent application No. 201107040.6.
NPL_57 Amazon HQ Wiki, "RDSMySQLConfigManagement/ConfigExecSummary", RDS/EDS/DesignDocs/RDSMygQLConfigManagement/ConfigExecSummary from https://w.amazon.com/index.php/RDS/EDS/ConfigExecSummary; downloaded Aug. 11, 2009.
NPL_58_English translation Notice of Allowance and Fee(s) Due dated Sep. 2, 2014; in corresponding Japanese patent application No. 2012-503674.
NPL_59_Office Action dated Jul. 7, 2014; in corresponding Chinese patent application No. 201080015811.9.
NPL_60_English translation of the Office Action dated Jul. 7, 2014; in corresponding Chinese patent application No. 201080015811.9.
NPL_62_English translation Notice on the Third Office Action dated Jan. 19, 2015; in corresponding Chinese patent application No. 201080015811.9.
NPL_63_Candan, K. Selcuk; Frontiers in Information and Software as Services; 2009 IEEE international Conference on Data Engineering.
NPL_64_Cases for E-Business Application Using Web Services Technology and Research and Study of Problems, 1st Edition, Mar. 31, 2004, pp. 1-5.
NPL_65_AMAZON HQ Wiki, "RDSMySQLConfigManagement/ConfigWorkflowDesign", RDS/EDS/DesignDocs/RDSMySQLConfigManagement/ConfigWorkflowDesign from hhtps://w.amazon.com/index.php/RDS/EDS/DesignDocs/ RDSMySQLConfigManagement/ConfigWorkflowDesign; downloaded Feb. 11, 2009.
NPL_66_Office Action dated Oct. 3, 2013; in corresponding Canadian patent application No. 2,755,913.
NPL_67_Non-Final Office Action dated Mar. 14, 2013; in corresponding U.S. Appl. No. 12/606,093.
NPL_68_Office Action dated Aug. 22, 2014; in corresponding Canadian patent application No. 2,755,913.
NPL_69_English translation of the First Office Action dated Oct. 21, 2013; in corresponding Chinese patent application No. 201080015811.9.
NPL_70_The First Office Action dated Oct. 21, 2013; in corresponding Chinese patent application No. 201080015811.9.
NPL_71 The Office Action dated Dec. 3, 2013; in corresponding Japanese patent application No. 2012-503674.
NPL_72_English translation of the Office Action dated Dec. 3, 2013; in corresponding Japanese patent application No. 2012-503674.
Office Action dated Sep. 16, 2014; in corresponding Japanese patent application No. 2013-262835.
Supplementary European Search Report dated Oct. 9, 2013; in corresponding European patent application No. 10827392.1.
The First Office Action dated Apr. 21, 2014; in corresponding Chinese patent application No. 201080056327.0.
The Notice of the First Office Action dated Jun. 12, 2014; in corresponding Chinese patent application No. 201080049395.4.
z/VM and Linux on IBM System z ' The virtualization cookbook for Red hat Enterprise Linux 5.2.; Oct. 2008.
US9705888B2 (en) 2017-07-11
US20190268347A1 (en) 2019-08-29
US20100251339A1 (en) 2010-09-30
US20170318025A1 (en) 2017-11-02