# US 11,451,589 B2 · Configurable application execution service for executing applications on virtual machines > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,589 B2 - Document ID: US11451589B2 - Status: Granted - Kind: B2 - Application number: 17/006,540 - Filed: 2020-08-28 - Published: 2021-02-18 - Granted: 2022-09-20 - Earliest claimed: 2006-03-31 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Quinton R. Hoole; Christopher C. Pinkham; Roland Paterson-Jones; Willem R. van Biljon - Web page: https://patentgrep.com/patent/US11451589B2 ## CPC - H04L 63/102: {Entity profiles} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 12/1439: {time-based} - H04L 12/1442: {at network operator level} - H04L 41/0813: characterised by the conditions triggering a change of settings - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques are described for managing communications between multiple intercommunicating computing nodes, such as multiple virtual machine nodes hosted on one or more physical computing machines or systems. In some situations, users may specify groups of computing nodes and optionally associated access policies for use in the managing of the communications for those groups, such as by specifying which source nodes are allowed to transmit data to particular destinations nodes. In addition, determinations of whether initiated data transmissions from source nodes to destination nodes are authorized may be dynamically negotiated for and recorded for later use in automatically authorizing future such data transmissions without negotiation. This abstract is provided to comply with rules requiring an abstract, and it is submitted with the intention that it will not be used to interpret or limit the scope or meaning of the claims. ## Claims ### Claim 1 A system, comprising: one or more computer systems that implement an application execution service (AES), configured to: provide a plurality of virtual machines hosted on one or more physical hosts to execute applications on behalf of a plurality of user accounts; receive indication of an application to be executed by the AES on behalf of a user account; create a group of virtual machines to execute the application; receive, via a browser-based interface, a request to reserve execution time on virtual machines used by the user account; and execute the application on behalf of the user account on one or more virtual machines in the group using the reserved execution time. ### Claim 2 (depends on 1) The system of claim 1, wherein the AES is configured to: modify the user account according to one or more requests received via the browser-based interface. ### Claim 3 (depends on 1) The system of claim 1, wherein the AES is configured to: manage a machine image associated with the user account via one or more requests received via the browser-based interface, wherein the machine image is used to provision virtual machines on behalf of the user account. ### Claim 4 (depends on 1) The system of claim 1, wherein the execution of the application includes to: initiate the application on the virtual machines in the group; monitor the application on the virtual machines; and terminate the application on the virtual machines. ### Claim 5 (depends on 1) The system of claim 1, wherein the AES is configured to manage the application during the execution of the application, wherein the management includes one or more of: log accesses or operations of the virtual machines; perform backups of data on the virtual machines; and generate billing information for the user account. ### Claim 6 (depends on 1) The system of claim 1, wherein the AES is configured to: provide an application programming interface (API) configured to receive requests from one or other computing systems to programmatically manage the application on the virtual machines. ### Claim 7 (depends on 1) The system of claim 1, wherein the AES is configured to: configure a group access policy for the group of virtual machines according to one or more requests received via the browser-based interface. ### Claim 8 (depends on 7) The system of claim 7, wherein the AES is configured to: configure the group access policy to allow or deny data transmissions from a particular IP address to the group. ### Claim 9 (depends on 7) The system of claim 7, wherein the AES is configured to: configure the group access policy to allow or deny data transmissions from another group of virtual machines hosted by the AES to the group. ### Claim 10 (depends on 7) The system of claim 7, wherein the AES is configured to: configure the group access policy to allow or deny data transmissions of particular transmission protocol to the group. ### Claim 11 (depends on 7) The system of claim 7, wherein: one or more virtual machines in the group are hosted on a particular physical host; and the physical host implements a transmission manager configured to: maintain one or more rules for allowing or denying incoming or outgoing data transmissions to or from the one or more virtual machines based on the group access policy; and manage the incoming and outgoing data transmissions in accordance with the one or more rules. ### Claim 12 (depends on 11) The system of claim 11, wherein the AES implements: a plurality of transmission managers on respective physical hosts; and at least one system manager configured to maintain global state information of the plurality of transmission managers. ### Claim 13 (depends on 12) The system of claim 12, wherein the plurality of transmission managers and the respective physical hosts are implemented across a plurality of data centers. ### Claim 14 A method, comprising: performing, by one or more computer systems that implement an application execution service (AES): providing a plurality of virtual machines hosted on one or more physical hosts to execute applications on behalf of a plurality of user accounts; receiving indication of an application to be executed by the AES on behalf of a user account; creating a group of virtual machines to execute the application; receiving, via a browser-based interface, a request to reserve execution time on virtual machines used by the user account; and executing the application on behalf of the user account on one or more virtual machines in the group using the reserved execution time. ### Claim 15 (depends on 14) The method of claim 14, further comprising: managing, by the AES, a machine image associated with the user account via one or more requests received via the browser-based interface, wherein the machine image is used to provision virtual machines on behalf of the user account. ### Claim 16 (depends on 14) The method of claim 14, further comprising managing, by the AES, the application during the execution of the application, wherein the management includes one or more of: logging accesses or operations of the virtual machines; performing backups of data on the virtual machines; and generating billing information for the user account. ### Claim 17 (depends on 14) The method of claim 14, further comprising: providing, by the AES, an application programming interface (API) configured to receive requests from one or other computing systems to programmatically manage the application on the virtual machines. ### Claim 18 (depends on 14) The method of claim 14, further comprising: configuring, by the AES, a group access policy for the group of virtual machines according to one or more requests received via the browser-based interface. ### Claim 19 One or more non-transitory computer-readable media storing program instructions that when executed on or across one or more processors implement an application execution service (AES) and cause the AES to: provide a plurality of virtual machines hosted on one or more physical hosts to execute applications on behalf of a plurality of user accounts; receive indication of an application to be executed by the AES on behalf of a user account; create a group of virtual machines to execute the application; receive, via a browser-based interface, a request to reserve execution time on virtual machines used by the user account; and execute the application on behalf of the user account on one or more virtual machines in the group using the reserved execution time. ### Claim 20 (depends on 19) The one or more non-transitory computer-readable media of claim 19, wherein to execute the application, the program instructions when executed on or across the one or more processors cause the AES to: initiate the application on the virtual machines in the group; monitor the application on the virtual machines; and terminate the application on the virtual machines.