Trust-based resource allocation

Patent metadata

Field	Value
Publication number	US-11086648-B1
Application number	US-201916295594-A
Country	US
Kind code	B1
Filing date	Mar 7, 2019
Priority date	Oct 22, 2012
Publication date	Aug 10, 2021
Grant date	Aug 10, 2021

Abstract

Methods and systems for provisioning computing resource instances among implementation resources based on trust to reduce interference between computing resource instances implemented by the same implementation resources. In an embodiment, a trust rating is determined for a computing resource instance based at least in part on one or more trust factors. The suitability of an implementation resource to implement the given computing resource instance may be evaluated based at least in part on the trust rating of the computing resource instance and a trust rating of the implementation resource. In some embodiments, the trust rating of the implementation resource may be predefined or based on trust ratings of computing resource instances that are currently implemented by the implementation resource. An implementation resource may be selected to implement the computing resource instance based at least in part on its suitability thus determined.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
selecting an implementation resource within a computing system to implement a virtual computing instance based at least in part on a trust rating for the virtual computing instance and based at least in part on the a trust factor relating to a customer,
wherein the trust rating is determined for an implementation of the virtual computing instance by the implementation resource,
wherein the trust rating is stored prior to the implementation and represents a value or a level indicating a likelihood that the implementation would cause a security breach within the computing system,
wherein the trust rating for the virtual computing instance is adjusted based at least in part on a determination that a computer infrastructure of a customer complies with a security or audit standard; and
causing the virtual computing instance to be implemented by the selected implementation resource.

2. The computer-implemented method of claim 1 , further comprising:
receiving a request from the customer; and
determining the trust rating for the virtual computing instance based at least in part on one or more other trust factors related to the customer.

3. The computer-implemented method of claim 1 , wherein the likelihood of the security breach is based at least in part on a level of security associated with an internal computing infrastructure of the customer, wherein the customer provided a request to implement the virtual computing instance.

4. The computer-implemented method of claim 1 , wherein the likelihood of the security breach is determined upon auditing an internal computer infrastructure of the customer, wherein the customer provided a request to implement the virtual computing instance.

5. The computer-implemented method of claim 1 , wherein the likelihood of the security breach is based at least in part on a comparison with a version of an operating system with known security vulnerabilities.

6. The computer-implemented method of claim 1 , wherein the security breach is a denial of service (DoS).

7. The computer-implemented method of claim 1 , wherein the security or audit standard is different based at least in part on an industry of the customer.

8. The computer-implemented method of claim 1 , wherein the likelihood of the security breach is based at least in part on information provided by the customer or an auditing agency.

9. The computer-implemented method of claim 1 , wherein the likelihood of the security breach is based at least in part on historical resource usage patterns.

10. A computer-implemented method, comprising:
selecting an implementation resource to implement a virtual computing instance based at least in part on a trust rating for the virtual computing instance, wherein the trust rating is determined for an implementation of the virtual computing instance by the implementation resource,
wherein the trust rating is stored prior to the implementation and represents a value or a level indicating a likelihood that the implementation would exhibit non-abusive behavior towards a portion of the selected implementation resource that is shared with other virtual computing instances,
wherein the trust rating for the virtual computing instance is adjusted based at least in part on a determination that a computer infrastructure of a customer complies with a security or audit standard, and
wherein the security or audit standard is different based at least in part on an industry of the customer; and
causing the virtual computing instance to be implemented by the selected implementation resource.

11. The computer-implemented method of claim 10 , further comprising:
receiving a request from the customer; and
determining the trust rating for the virtual computing instance based at least in part on one or more trust factors related to the customer.

12. The computer-implemented method of claim 10 , wherein the likelihood that the virtual computing instance would exhibit non-abusive behavior is based at least in part on a level of security associated with an internal computing infrastructure of the customer, wherein the customer provided a request to implement the virtual computing instance.

13. The computer-implemented method of claim 10 , wherein the likelihood that the virtual computing instance would exhibit non-abusive behavior is determined upon auditing an internal computer infrastructure of the customer, wherein the customer provided a request to implement the virtual computing instance.

14. The computer-implemented method of claim 10 , wherein the likelihood that the virtual computing instance would exhibit non-abusive behavior is based at least in part on a comparison with a version of an operating system with known abusive usage patterns.

15. The computer-implemented method of claim 10 , wherein abusive behavior is taking a disproportionate amount of central processing unit (CPU) time.

16. The computer-implemented method of claim 10 , wherein the likelihood that the virtual computing instance would exhibit non-abusive behavior is based at least in part on information provided by the customer or an auditing agency.

17. The computer-implemented method of claim 10 , wherein the likelihood that the virtual computing instance would exhibit non-abusive behavior is based at least in part on historical resource usage patterns.

18. One or more non-transitory computer-readable media comprising computer-executable instructions that, when executed, by one or more processors, causes one or more computer systems to perform operations comprising:
selecting an implementation resource within a computing system to implement a virtual computing instance based at least in part on a trust rating for the virtual computing instance and based at least in part on the a trust factor relating to a customer,
wherein the trust rating is determined for an implementation of the virtual computing instance by the implementation resource,
wherein the trust rating is stored prior to the implementation and represents a value or a level indicating a likelihood that the implementation would cause a security breach within the computing system,
wherein the trust rating for the virtual computing instance is adjusted based at least in part on a determination that a computer infrastructure of a customer complies with a security or audit standard; and
causing the virtual computing instance to be implemented by the selected implementation resource.

19. The one or more non-transitory computer-readable media of claim 18 , wherein the likelihood of the security breach is based at least in part on a level of security associated with an internal computing infrastructure of the customer, wherein the customer provided a request to implement the virtual computing instance.

20. The one or more non-transitory computer-readable media of claim 18 , wherein the likelihood of the security breach is determined upon auditing an internal computer infrastructure of the customer, wherein the customer provided a request to implement the virtual computing instance.

Assignees

• Amazon Tech Inc

Inventors

• De Kadt Christopher Richard Jacques
• Greenfield James Alfred Gordon
• Mauer Gustav Karl

Classifications

• G06F21/57 Primary

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• H04L41/5051

  Service on demand, e.g. definition and deployment of services in real time · CPC title

• H04L41/5096

  wherein the managed service relates to distributed or central networked applications · CPC title

• G06F9/45533 Primary

  Hypervisors; Virtual machine monitors · CPC title

• G06F21/60

  Protecting data · CPC title