# US 10,375,013 B2 · Managed directory service connection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,013 B2 - Document ID: US10375013B2 - Status: Granted - Kind: B2 - Application number: 14/098,450 - Filed: 2013-12-05 - Published: 2015-05-14 - Granted: 2019-08-06 - Earliest claimed: 2013-11-11 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Shon Kiran Shah; Krithi Rai; Guruprakash Bangalore Rao; Thomas Christopher Rizzo; Colin Harrison Brace; Gaurang Pankaj Mehta; Sameer Palande; Deepak Suryanarayanan - Web page: https://patentgrep.com/patent/US10375013B2 ## CPC - G06F 9/455: Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/604: {Tools and structures for managing or administering access control systems} - H04L 41/5009: Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF] - H04L 47/70: Admission control; Resource allocation - H04L 61/4547: {for personal communications, i.e. using a personal identifier} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/102: {Entity profiles} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/1095: Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes - H04L 67/51: Discovery or management thereof, e.g. service location protocol [SLP] or web services - G06F 16/955: using information identifiers, e.g. uniform resource locators [URL] - G06F 16/9566: {URL specific, e.g. using aliases, detecting broken or misspelled links} - G06F 40/134: Hyperlinking - G06F 2009/45562: {Creating, deleting, cloning virtual machine instances} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - H04L 41/50: Network service management, e.g. ensuring proper service fulfilment according to agreements - H04L 41/5041: characterised by the time relationship between creation and deployment of a service - H04L 41/5058: {Service discovery by the service manager} - H04L 41/5083: {wherein the managed service relates to web hosting} - H04L 61/10: of different types - H04L 61/4541: Directories for service discovery - H04L 61/50: Address allocation - H04L 61/5007: Internet protocol [IP] addresses - H04L 63/104: {Grouping of entities} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 2101/30: Types of network names - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for connecting computer system entities to local computer system resources are described herein. A computer system entity that requests access to a local computer system resource has that request fulfilled by a managed directory service, which receives the request and connects the computer system entity to the local computer system resource. While connected, the managed directory service receives commands to perform operations on the local computer system resource and, if the computer system entity is authorized to perform the operations on the local computer system resource, the managed directory service performs the operations on the local computer system resource. ## Claims ### Claim 1 A computer-implemented method, comprising: connecting a directory node of a computing resource service provider to a customer computer system directory hosted outside of the computing resource service provider and referencing a set of data; making the customer computer system directory available to a directory service of the computing resource service provider; and processing one or more requests to perform directory operations by at least: obtaining, from the directory service of the computing resource service provider, a system resource location that corresponds to a system resource, wherein the set of data comprises the system resource; determining a uniform resource identifier based at least in part on the system resource location; and forwarding the one or more requests from the directory service of the computing resource service provider to the customer computing system directory for fulfillment, the fulfillment of the one or more requests utilizing at least a portion of the set of data associated with the system resource, wherein access to the system resource is provided based at least in part on the uniform resource identifier. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising: obtaining a uniform resource identifier for the directory node; and registering the uniform resource identifier with a domain name service so that the domain name service will resolve the uniform resource identifier to a network address of the directory node. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the directory node is located within an isolated virtual network hosted in the computing environment of the computing resource service provider. ### Claim 4 (depends on 3) The computer-implemented method of claim 3, wherein the directory node is created within a sub-network of the isolated virtual network specified by a customer of the computing resource service provider. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein maintaining the directory node includes performing maintenance operations on a computer system that implements the directory node. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the system resource comprises at least one of a directory, file system, file, security policy, network resource, or application. ### Claim 7 A system, comprising: one or more processors; and memory to store executable instructions that, as a result of execution by the one or more processors, cause the system to: connect a directory node in a computing resource service provider environment to a customer computer system directory, the customer computer system directory referencing a set of data stored outside of the computing resource service provider; make the customer computer system directory available to a directory service of the computing resource service provider; and enable performance of directory operations by at least: obtaining, from the directory service of the computing resource service provider, a system resource location that corresponds to a system resource, wherein the set of data comprises the system resource; creating a resource identifier based at least in part on the system resource location; and forwarding one or more requests from the directory service to the customer computing system directory, wherein access to the system resource is based at least in part on the resource identifier. ### Claim 8 (depends on 7) The system of claim 7, wherein the customer computer system directory is hosted in a computing environment of the customer that is outside of the environment of the computing resource service provider. ### Claim 9 (depends on 7) The system of claim 7, wherein the instructions further comprise instructions that cause the system to configure a computer system instance to implement the directory node, the computer system instance configured to have a network address to which other computer system instances of a customer in the computing environment of the computing resource service provider are able to communicate. ### Claim 10 (depends on 7) The system of claim 7, wherein the directory node is created to forward the requests to perform directory operations to the customer computer system directory for fulfillment. ### Claim 11 (depends on 7) The system of claim 7, wherein the directory node enables computer systems to join the customer computer system directory via the directory node. ### Claim 12 (depends on 7) The system of claim 7, wherein the directory node is created in a virtual network hosted by the computing resource service provider. ### Claim 13 (depends on 12) The system of claim 12, wherein the directory node is created in a sub-network of the virtual network. ### Claim 14 A non-transitory computer-readable storage medium comprising executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least: connect a directory node in a computing resource service provider environment to a customer computer system directory hosted outside of the computing resource service provider environment, the customer computer system directory referencing a set of data stored in the customer computing environment; make the customer computer system directory available to a directory service of the computing resource service provider environment; and process one or more requests to perform directory operations by forwarding the one or more requests from the directory service of the computing resource service provider to the customer computing system directory for fulfillment, the fulfillment of the requests utilizing at least a portion of the set of data associated with a system resource, wherein the one or more requests are processed by at least: obtaining, from the directory service of the computing resource service provider, a system resource location that corresponds to the system resource; and creating a resource identifier based at least in part on the system resource location, wherein access to the system resource is based at least in part on the resource identifier. ### Claim 15 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the directory node is configured to enable computing resources hosted in the computing environment to join the customer computer system directory via the directory node. ### Claim 16 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the customer computer system directory is hosted in a computing environment of the customer outside of the computing environment of the computing resource service provider. ### Claim 17 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the instructions that cause the computer system to create the directory node further include instructions that cause the computer system to create a replica of the directory node, the replica providing redundant access to the customer computer system directory. ### Claim 18 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the directory node is created with a network address in a sub-network, specified by a customer of the computing resource service provider, of a virtual network of the customer hosted by the computing resource service provider on behalf of the customer, the sub-network being inaccessible to resources of the computing resource service provider outside of the sub-network. ### Claim 19 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein: the instructions further include instructions that, if executed by the one or more processors, cause the computer system to provide a web service interface through which requests to perform management operations on the directory node are submittable; and the directory node is created in response to a request submitted through the provided web service interface. ### Claim 20 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the instructions to process the one or more requests include instructions to use the directory node to forward the one or more requests to the customer computer system directory.