Providing cloud-based computing services

[0001] The present application claims priority under 35 U.S.C 119 to Indian application number 3216/CHE/2010, filed on Oct. 28, 2010, which is incorporated by reference in its entirety.

[0002] Many organizations rely heavily on a relatively large number of computers and other information technology (IT) equipment that are networked together in the performance of various computing services. As the technological requirements continue to increase, the monetary costs, as well as, the personnel required to maintain the equipment continue to increase dramatically. Oftentimes, however, the organizations are located in areas where there is no or limited IT staff available to operate the IT equipment and networks. In addition, the organizations are typically unable or unwilling to obtain the space required for the IT equipment as well as to set up and run the IT equipment.

[0003] One solution to meeting some of the needs of the organizations, while avoiding many of the costs associated with those needs, is for the organizations to purchase computing and networking services from a cloud-based networking service provider on an “as-needed” basis. Cloud-based networking service providers typically employ a number of data centers that house a number of IT equipment that run on shared virtualized resource pools that are accessible via Intranets or the Internet. In these arrangements, the cloud-based networking service providers often charge the organizations fees based solely upon the amount of bandwidth that the organizations reserve.

[0010] For simplicity and illustrative purposes, the present disclosure is described by referring mainly to examples thereof. In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present disclosure. It will be readily apparent however, that the present disclosure may be practiced without limitation to these specific details. In other instances, some methods and structures are not described in detail so as not to unnecessarily obscure the description of the present disclosure.

[0011] Disclosed herein are methods and apparatuses for providing cloud-based computing services to users. The methods and apparatuses disclosed herein provide users with a greater range of choices in requesting for computing services from a cloud-based service provider as compared with conventional cloud-based arrangements. For instance, in addition to bandwidth, the users are able to define the quality of service they would like to receive, the level of security applied to their computing services, etc. In one regard, the methods and apparatuses disclosed herein generally enable the users to build their application within an infrastructure over the cloud to basically mimic an infrastructure that they would build on their own premises. To the users, therefore, there is relatively little difference in the infrastructure over the cloud and an infrastructure that the users could build and manage themselves.

[0012] In addition, the methods and apparatuses disclosed herein enable users to select the various parameters associated with the performance of the requested computing services without having to know the underlying physical network details and/or detailed networking domain. In one regard, this is accomplished through a service entry request tool that provides a graphical user interface (GUI) through which the users may relatively easily select their desired parameters for the requested computing services.

[0013] Moreover, the methods and apparatuses disclosed herein enable cloud-based computing service providers to provide the requested services while substantially optimizing computing infrastructure usage and meeting of service level agreement guarantees.

[0014] Through implementation of the methods and apparatuses disclosed herein, therefore, users may request for and receive computing services over the cloud that meets many of the same parameters as computing services that the users could receive through building and managing an on-site infrastructure, without the cost and personnel required to perform the computing services themselves.

[0015] Throughout the present disclosure, the term “n” following a reference numeral is intended to denote an integer value that is greater than 1. In addition, the terms “a” and “an” are intended to denote at least one of a particular element. As used herein, the term “includes” means includes but not limited to, the term “including” means including but not limited to. The term “based on” means based at least in part on.

[0016] With reference first to FIG. 1, there is shown a block diagram of a service provisioning system 100, according to an example. In one regard, the methods disclosed herein below may be implemented in the system 100 as discussed in greater detail herein below. It should be understood that the system 100 may include additional elements and that some of the elements described herein may be removed and/or modified without departing from a scope of the system 100.

[0017] The service provisioning system 100 is depicted as including a cloud-based computing service providing apparatus 110, a computing infrastructure 140, a network 150, a user computing device 160, and a service entry interface 170. The cloud-based computing service providing apparatus 110 is also depicted as including a processor 112, an interface 114, a data store 116, and a provisioning apparatus 120. The computing infrastructure 140 is further depicted as including a plurality of infrastructure components 142a-142n. Generally speaking, the computing infrastructure 140 comprises a shared virtualized resource pool, which comprises a cloud computing environment where services run on shared virtualized resource pools that are accessible via the network 150, which may comprise Intranets and/or the Internet. By way of example, the computing infrastructure 140 comprises at least one data center and the infrastructure components 142a-142n comprise servers, firewalls, routers, switches, hard drives, etc., as well as other components for performing computing services.

[0018] The provisioning apparatus 120 is further depicted as including a user interface module 122, a workload estimation module 124, a provisioning scheme determination module 126, and a provisioning scheme implementation module 128. The modules 122-128 may comprise modules with machine readable instructions, hardware modules, or a combination of modules with machine readable instructions and hardware modules. Thus, in one example, one or more of the modules 122-128 comprise circuit components, in which case, the provisioning apparatus 120 may comprise a circuit board. In another example, one or more of the modules 122-128 comprise machine readable instructions stored on a computer readable storage medium, which is executable by the processor 112, in which case the provisioning apparatus 120 may comprise a disk drive or other type of memory.

[0019] In any regard, the processor 112 is configured to implement and/or execute the provisioning apparatus 120. Thus, for instance, the cloud-based computing service providing apparatus 110 may comprise a computing device and the provisioning apparatus 120 may comprise an integrated and/or add-on hardware device of the computing device. As another example, the provisioning apparatus 120 may comprise a computer readable storage device upon which machine readable instructions for each of the modules 122-128 are stored and executed by the processor 112.

[0020] As further shown in FIG. 1, the processor 112 is configured to communicate with the computing infrastructure 140 through the interface 114. The interface 114 may comprise hardware and/or machine readable instructions for communication of data to and from the cloud-based computing service providing apparatus 110. Although the computing infrastructure 140 has been depicted as communicating directly with the interface 114, the computing infrastructure 140 may instead communicate with the interface 114 through the network 150. In this regard, the cloud-based computing service providing apparatus 110 may be remotely located from the computing infrastructure 140.

[0021] The processor 112 is to receive various information pertaining to the computing infrastructure 140 through the connection with the computing infrastructure 140. The various information may include, for instance, an identification of the infrastructure components 142a-142n contained in the computing infrastructure 140, a network topology of the infrastructure components 142a-142n contained in the computing infrastructure 140, various operating characteristics of the infrastructure components 142a-142a, various characteristics of the connections between the computing components 142a-142n, etc. The processor 112 may store the various information received from the computing infrastructure 140 in the data store 116, which may comprise volatile and/or non-volatile memory, such as DRAM, EEPROM, MRAM, phase change RAM (PCRAM), Memristor, flash memory, and the like. In addition, or alternatively, the data store 116 may comprise a device configured to read from and write to a removable media, such as, a floppy disk, a CD-ROM, a DVD-ROM, or other optical or magnetic media.

[0022] The processor 112 is also to receive information from the user computing device 160 through the interface 114, which may also be stored in the data store 116. The user computing device 160 comprises one of a personal computer, a laptop computer, a tablet computer, a personal digital assistant, a cellular telephone, etc., through which a user may access the service entry interface 170 to submit a request for cloud-based computing service from the cloud-based computing service providing apparatus 110. The service entry interface 170 may comprise, for instance, a web-based interface through which a user may define various aspects of the requested computing service. The service entry interface 170 may also comprise an application that may be locally stored or executed on the user computing device 160, in which the information that the service entry interface 170 collects is communicated to the cloud-based computing service providing apparatus 110 over the network 150. Various examples of the service entry interface 170 are provided below.

[0023] According to an example, the cloud-based computing service providing apparatus 110 supplies the user computing device 160 with the service entry interface 170 to therefore directly receive information pertaining to the requested computing service from the user computing device 160.

[0024] Various manners in which the cloud-based computing service 110, and more particularly, the modules 122-128 of the provisioning apparatus 120 may be implemented are described in greater detail with respect to FIG. 2, which depicts a flow diagram of a method 200 for providing a cloud-based computing service to a user, according to an example. It should be apparent that the method 200 represents a generalized illustration and that other steps may be added or existing steps may be removed, modified or rearranged without departing from a scope of the method 200.

[0025] The description of the method 200 is made with particular reference to the provisioning apparatus 120 depicted in FIG. 1. It should, however, be understood that the method 200 may be implemented in an apparatus that differs from the provisioning apparatus 120 without departing from the scope of the method 200.

[0026] At block 202, a service entry interface 170 through which a user may input a request for a cloud-based computing service is supplied to a user, for instance, by the user interface module 122. The supply of the service entry interface 170 may be optional in various instances, for instance, when the user computing device 160 includes or implements a locally operated application that provides an interface through which the user may input information pertaining to the request. A flow diagram of a method 300, according to an example, in which a service entry interface tool 422 (FIG. 4) may be implemented to receive the user request is provided in FIG. 3A. In addition, a screenshot 320 of the service entry interface 170, which may be provided by the service entry interface tool 422 and is depicted as a graphical user interface (GUI), is depicted in FIG. 3B, according to an example.

[0027] With particular reference to FIG. 3A, and as shown at block 302, a plurality of parameter options are supplied, for instance, as shown in the screenshot 320 (FIG. 3B). As shown in the screenshot 320, the plurality of parameter options may include, for instance, various types of servers, various networking component options, various storage component options, various bandwidth options, various encryption/decryption options, etc. The screenshot 320, more particularly, depicts an options window 322 that displays various options available to a user in setting up an application and an options window 324 that displays various other options and costs associated with the selection of the options. The screenshot 320 has also been depicted as displaying various other elements, such as, various file naming and status information, various file management options, file logs, etc.

[0028] The options window 322 is depicted as displaying a wide area network (WAN), a firewall, a server for providing cryptographic functions (CRYPTO), a server load balancer (SLB), and a hose slice. It should, however, be clearly understood that the user may be provided with any number of additional networking options without departing from a scope of the service entry interface tool 422 disclosed herein. In addition to the networking options, the options window 322 may include options for various types of severs and server clusters, as well as options for storage, as indicated by the tabs labeled as “Servers” and “Storage” in the options 322 window.

[0029] The options window 324 is depicted as displaying an uplink bandwidth selection, a intrusion detection system selection, an encryption/decryption selection, a load balancer selection, and a hose-slice selection, along with their related costs. Although particular options have been depicted in the options window 324, it should be clearly understood that additional options may be added and existing options may be modified and/or removed without departing from a scope of the service entry interface tool 422.

[0030] At block 304, the plurality of parameter options that have been selected are identified, in which, the plurality of parameter options includes at least one flow-slice. A flow-slice may generally be defined as a network abstraction of network pay-per-use unit. More particularly, a flow-slice may comprise a definable unit of network use that includes one or more parameters associated with the network use for which the user is willing to pay, such as, but not limited to network bandwidth consumed by that particular flow-slice and an associated monetary cost that depends on bandwidth usage. For instance, the flow-slice defines the bandwidth, if encryption properties are required, if load balancing properties are required, whether the flow-slice will connect groups of servers, etc. According to an example, the service entry interface tool 422 automatically defines the flow-slices based upon the selected parameter options. In this example, and with reference to FIG. 3B, the user may select the parameter options as indicated in the window 326, which shows an arrangement of the selected options.

[0031] Flow-slices may also have various secondary properties tied to them, such as, service level agreement (SLA) guarantees (which may include QoS-levels, downtime guarantees, loss-rates, bandwidth guarantees, delay guarantees), encryption (which may include that all of the communication for the flow-slice is encrypted), load-balancing (which may include that the network load will be equally shared across the server-group that binds to it), firewalling (which may include that the flow-slice traffic will be filtered against a firewall ruleset) with an additional cost beyond base network bandwidth cost associated with each property, etc. In this regard, the flow-slice is a level of abstraction that captures the middlebox services, such as, load-balancers, encryption boxes, intrusion detection systems (IDS's), etc.

[0032] The window 324 shows an example in which the user selected a WAN, a firewall, a CRYPTO, an SLB, a hose slice, a particular amount of computing performance represented by the four sets of three servers, and a particular amount of memory usage represented by the six hard drives. In this example, the service entry interface tool 422 may define a first flow-slice as the connection between the WAN and the load balancer. In addition, the service entry interface tool 422 may define a second flow-slice as the shared connections between the groups of servers, the load-balancer, and the hard drives. In this example, the first flow-slice may be construed as a first type of flow-slice called a pipe-slice and the second flow-slice may be construed as a second type of flow-slice called a hose-slice. Pipe-slices connect pairs of end-point networking components to each other and thus represent resources that are typically not shared. Hose-slices connect groups of end-point networking components together and thus represent resources that are typically shared. Since the hose-slices require greater network resources, such as, but not limited to bandwidth, the hose-slices may be associated with a higher monetary cost as compared with the pipe-slices. While the secondary properties associated with flow-slices are generally dictated by the use-scenarios (for instance, whether the application requires encryption or load-balancing), the primary property of network bandwidth depends on the application workload patterns.

[0033] The service entry interface tool 422 may also profile and plot the bandwidth consumed by the identified flow-slices and the selected infrastructure components 142a-142n. The profiling and plotting of the network bandwidth consumed may be performed using, for instance, sFlow packet sampling technology to measure inter-server communications. It should be noted that since generally each server instance is associated with a unique media access control (MAC) address and each virtual machine (VM) with a Virtual MAC, the communication between pairs of MAC addresses may be tracked. As shown in the screenshot 320, the window 326 may also depict the topology of the network containing the user-selected networking options 322.

[0034] Flow-slices are bound to physical servers, virtual machine (VM) instances, server group instances, storage instances, etc. In addition, and flow-slices may specify network-policy associated with a particular server, such as, for instance, Access Control List (ACL) rules that denote which devices are allowed to talk to the particular server, quality of service (QoS) levels, etc. Flow-slice parameters generally follow VM-server instances to which they are bound when VMs move around.

[0035] As further shown in FIG. 3, the screenshot 320 includes a window 328 that includes options for the user to customize levels of QoS. More particularly, the user may customize the desired level of QoS to be met in performing the computing service for the user, which have been depicted as including a gold level and a silver level. It should be understood that other levels of QoS may be displayed in the window 328, such as a bronze level, or additional levels. In any regard, the levels of QoS depicted in the window 328 generally comprise QoS levels that are associated with different flows between the same set of servers. It should be noted that the QoS codepoint may generally be tagged to the packet by the upstream switch connected to the server depending on some attribute, such as, destination TCP port.

[0036] According to an example, the graphs depicted in the window 328 pertaining to the different QoS levels may be generated through the plotting of the 95th percentile cumulative distribution functions (CDF) of the measured bandwidth consumption between server pairs. The user may then use the observed CDF patterns to select the bandwidth parameters for the flow-slice(s). For simple unimodal scenarios, the knee of the CDF curve decides the bandwidth consumption of the flow-slice(s). This value may be multiplied with an over-provisioning ratio, for instance, a number between 1 and 10, to accommodate traffic burstiness and unpredictability.

[0037] As shown in the window 328, the gold CDF distribution is tri-modal in nature. Thus, for such a distribution, the user may choose two threshold points to divide the total bandwidth of the hose-slice among three pipe-slices rather than using a single hose-slice and thereby reduce the monetary cost of the hose-slice. Therefore, for instance, based on observed data-patterns, the flow-slice bandwidth may be reprovisioned by dividing existing flow-slices into multiple smaller flow-slices to reduce the monetary cost associated with selected components and configurations. It should be noted that pipe-slices may instead be used between special server nodes, for instance, for back-up purposes, for VMotion, etc. Thus, for the best price-performance ratio, a combination of pipe and hose slices that best suit the application requirements may be recommended. When the number of customer VM instances cannot be measured directly due to the constraints imposed by the test-environment, flow-slice bandwidths may be scaled commensurately based on the ratio of VM's of each type of the test setup to the production setup.

[0038] Although not explicitly depicted in FIG. 3B, the service entry interface tool 422 may also monitor the selected configurations for potential SLA violations. Thus, for instance, the service entry interface tool 422 may compare various selected characteristics, such as, security features, bandwidth considerations, storage, etc., with the provisions set forth in an SLA to determine whether the provisions are likely to be violated. In addition, in response to a determination that one or more of the provisions in the SLA are likely to be violated, the service entry interface tool 422 may inform the user that the selected configuration is likely to violate the provisions. The service entry interface tool 422 may thus be considered as a test environment through which a user may test various server and network configurations to determine a configuration that results in the desired network characteristics, while substantially minimizing monetary costs associated with obtaining the desired network characteristics and while meeting the provisions of the SLA. In addition, the service entry interface tool 422 enables the bandwidth requirements of the flow-slices to the extracted from the selected network configuration. It should be noted that, in general, the application architecture and requirements determine the secondary properties of the flow-slices while profiling enables the user to judge the network consumption of the application.

[0039] At step 306, a monetary cost associated with the selected plurality of parameter options, including the flow-slices, is estimated. As shown in the window 324, the total monetary cost per hour resulting from the selected options and configurations may be displayed to the user. The window 324 also shows a breakdown of the costs associated with various parameters, some of which the user may vary to modify the total cost.

[0040] At step 308, an instruction pertaining to whether the request for computing service having the identified parameter options and monetary cost has been accepted is received. As shown in the window 324, a commit button is provided for the user to select in response to a determination that the user wishes to submit the request with the selected parameter options. As such, if the user accepts the total monetary cost that results from the selected options, the user may select the commit button and submit the request for the computing service to be performed. Otherwise, the user may vary one or more of the selected options to arrive at a different total monetary cost. In this regard, the user may vary the selected options over a number of iterations until the user selects a configuration that results in an acceptable or desired monetary cost.

[0041] With reference back to FIG. 2, at block 204, a service request including a flow-slice selection is received, for instance, by the user interface module 122. Thus, for instance, block 204 may follow submission of the service request by the service entry interface tool 422. The service entry interface tool 422 may be configured to communicate the selected parameter options to the cloud-based computing service providing apparatus 100 through the network 150.

[0042] At block 206, workloads to be performed by a plurality of infrastructure components 142a-142n to satisfy the selected configuration and the flow-slice(s) are estimated, for instance, by the workload estimation module 124. The workload estimation module 124 may determine the workloads to be performed by the infrastructure components 142a-142n through an analysis of the provisions resulting from the user-selected options. Thus, for instance, the workload estimation module 124 may determine at least one of the number of servers, the number of disk drives, the type of server load balancer to be implemented, etc., required to perform the requested computing service.

[0043] At step 208, a provisioning scheme for the infrastructure components 142a-142n is determined, for instance, by the provisioning scheme determination module 126. The provisioning scheme determination module 126 may, for instance, determine which of the servers, hard drives, network switches, etc., are to be implemented to implement the estimated workloads on the infrastructure components 142a-142n based upon the configuration of the computing infrastructure 140. In this regard, the provisioning scheme determination module 126 may identify various paths between end-point infrastructure components 142a-142n that are to be employed in implementing the estimated workloads.

[0044] The provisioning scheme determination module 126 may determine the provisioning scheme by mapping the flow-slice(s) to the infrastructure components 142a-142n. More particularly, for instance, the provisioning scheme determination module 126 may map the pipe-slices and the hose-slices to respective virtual local area networks (VLAN) in the plurality of infrastructure components 142a-142n. As another example, the provisioning scheme determination module 126 may employ virtual routing and forwarding (VRF) instances to map the pipe-slices and the hose-slices to respective infrastructure components 142a-142n. In any regard, the provisioning scheme determination module 126 may find the shortest paths among the infrastructure components 142a-142n that substantially match a network bandwidth consumption parameter of the flow-slices.

[0045] According to another example, the provisioning scheme determination module 126 maps the pipe-slices by finding paths in a network topology of the infrastructure components 142a-142n that connect two end-point infrastructure components 142a-142n that meet a network bandwidth constraint of the infrastructure components while minimizing total capacity utilization of the infrastructure components. In addition, the provisioning scheme determination module 126 may map the hose-slices finding trees in the network topology that connect at least two groups of end-point infrastructure components 142a-142n.

[0046] According to a further example in which the infrastructure components 142a-142n include network switches, the provisioning scheme determination module 126 dedicates each of the VLANs (or VRF instances) to the mapped pipe-slices and the mapped hose-slices. In addition, the provisioning scheme determination module 126 tags ports of a plurality of the network switches corresponding to the path and tree onto the dedicated VLANs (or VRF instances) to configure the infrastructure components 142a-142n to perform the requested service.

[0047] At step 210, the determined provisioning scheme is implemented in the infrastructure components 142a-142n, for instance, by the provisioning scheme implementation module 128, to perform the requested computing service for the user. The results of the performed computing service may also be forwarded to the user.

[0048] Some or all of the operations set forth in the figures may be contained as a utility, program, or subprogram, in any desired computer readable storage medium. In addition, the operations may be embodied by computer programs, which may exist in a variety of forms both active and inactive. For example, they may exist as machine readable instruction(s) comprised of program instructions in source code, object code, executable code or other formats. Any of the above may be embodied on a computer readable storage medium, which include storage devices.

[0049] Exemplary computer readable storage media include conventional computer system RAM, ROM, EPROM, EEPROM, and magnetic or optical disks or tapes. Concrete examples of the foregoing include distribution of the programs on a CD ROM or via Internet download. It is therefore to be understood that any electronic device capable of executing the above-described functions may perform those functions enumerated above.

[0050] Turning now to FIG. 4, there is shown a schematic representation of a computing device 400 that may be used as a platform for implementing or executing the processes depicted in either or both of FIGS. 2 and 3A, according an example. The device 400 includes one or more processors 402, such as a central processing unit; one or more display devices 404, such as a monitor; one or more network interfaces 408, such as a Local Area Network LAN, a wireless 802.11x LAN, a 3G mobile WAN or a WiMax WAN; and one or more computer-readable mediums 410 and 420. Each of these components is operatively coupled to one or more buses 412. For example, the bus 412 may be an EISA, a PCI, a USB, a FireWire, a NuBus, or a PDS.

[0051] The computer readable mediums 410 and 420 may be any suitable medium that participates in providing instructions to the processor 402 for execution. For example, the computer readable mediums 410 and 420 may be non-volatile media, such as an optical or a magnetic disk; volatile media, such as memory; and transmission media, such as coaxial cables, copper wire, and fiber optics. Transmission media can also take the form of acoustic, light, or radio frequency waves. The computer readable medium 410 has been depicted as also storing other machine readable instruction applications, including word processors, browsers, email, Instant Messaging, media players, and telephony machine readable instructions.

[0052] The computer-readable medium 410 has also been depicted as storing an operating system 414, such as Mac OS, MS Windows, Unix, or Linux; network applications 416; and a computing service providing application 418. The operating system 414 may be multi-user, multiprocessing, multitasking, multithreading, real-time and the like. The operating system 414 may also perform basic tasks, such as recognizing input from input devices, such as a keyboard or a keypad; sending output to the display 404 and the design tool 406; keeping track of files and directories on medium 410; controlling peripheral devices, such as disk drives, printers, image capture device; and managing traffic on the one or more buses 412. The network applications 416 include various components for establishing and maintaining network connections, such as machine readable instructions for implementing communication protocols including TCP/IP, HTTP, Ethernet, USB, and FireWire.

[0053] The computing service providing application 418 provides various components with machine readable instructions for providing computing services to users, as described above. In certain examples, some or all of the processes performed by the application 418 may be integrated into the operating system 414. The computer readable medium 420 has been depicted as storing a service entry interface tool 422, which provides various components with machine readable instructions for providing an interface through which users input computing service requests. In certain examples, the processes may be at least partially implemented in digital electronic circuitry, or in computer hardware, machine readable instructions (including firmware and/or software) or in any combination thereof.

[0054] What has been described and illustrated herein are various examples of the disclosure along with some of their variations. The terms, descriptions and figures used herein are set forth by way of illustration only and are not meant as limitations. Many variations are possible within the spirit and scope of the subject matter, which is intended to be defined by the following claims—and their equivalents—in which all terms are meant in their broadest reasonable sense unless otherwise indicated.