Overlay networks for application groups

• US 10,129,353 B2
• Filed: 03/20/2017
• Issued: 11/13/2018
• Est. Priority Date: 06/20/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Allen, Nicholas Alexander
• Primary Examiner(s): Powers, William S
• Application Number:
  US15/464,096
• Publication Number:
  US 20170195443A1
• Time in Patent Office: 603 Days
• Field of Search: 713153
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 45/64 using an overlay routing layer
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 61/25 of the same type
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54

Abstract

A communication to a network location is detected at a computing device. The communication to the network location is encrypted dependent at least in part on whether the network location is at a different computing device from the computing device.

Claims

1. A computer-implemented method, comprising:

detecting, at a computing device, a communication to a network location via a first communications channel, the network location associated with an encryption configuration for communications from the computing device to the network location;

determining at least in part on whether the network location is at a different computing device from the computing device, that the communication is to be encrypted;

generating an encrypted communication by encrypting the communication according to the encryption configuration of the network location; and

routing the encrypted communication via a different second communications channel.

2. The computer-implemented method of claim 1, further comprising, in response to detecting the network location is located on the computing device, using a proxy entity to route the communication via the first communications channel.

3. The computer-implemented method of claim 1, further comprising routing the communication to the network location via an overlay network.

4. The computer-implemented method of claim 1, further comprising:

performing address translation for transmission of the communication; and

routing the communication to the network location in accordance with the address translation.

5. The computer-implemented method of claim 1, wherein:

the first communications channel is usable for routing the communication to the network location via an overlay network entity on the same computing device; and

the second communications channel is usable for routing the communication to the network location at the different computing device via a network that is communicatively coupled between the computing device and the different computing device.

6. The computer-implemented method of claim 1, wherein:

the computing device hosts a virtual computing device and a virtualization layer that supports the virtual computing device; and

the first communications channel utilizes the virtualization layer.

7. The computer-implemented method of claim 6, further comprising determining, based at least in part on whether the network location is accessible to the virtualization layer, whether the network location is at the different computing device from the computing device.

8. A system, comprising:

memory to store computer-executable instructions, which, if performed by one or more processors, cause the system to at least;

detect, at a computing device, a communication to a network location associated with an encryption configuration for communications from the computing device to the network location;

select a communications channel based at least in part on whether the network location is at a different computing device from the computing device;

generate an encrypted communication by encrypting the communication according to the encryption configuration of the network location; and

route the encrypted communication via the communications channel.

9. The system of claim 8, wherein the computer-executable instructions further include instructions that cause the system to:

detect a second communication; and

decrypt the second communication dependent at least in part on detecting the second communication was directed to the different computing device from the computing device.

10. The system of claim 8, wherein the computer-executable instructions further include instructions that cause the system to instantiate a virtual network adapter to facilitate transmission of the communication from a source network address to a destination network address.

11. The system of claim 8, wherein:

the communication is associated with;

a first network address corresponding to a computing device performing a first application; and

a second network address corresponding to a computing device performing a second application; and

the first and second applications are configured to exchange data between each other.

12. The system of claim 11, wherein the first network address and the second network address are incorporated into a data packet that includes at least a portion of the communication.

13. The system of claim 8, wherein:

the communication is between a first and second application; and

the computer-executable instructions include instructions that further cause the system to encrypt the communication using credentials information associated with first and second applications.

14. The system of claim 13, wherein the credentials information is provided by an application deployment entity for use in encryption of data exchanged between the first and second application.

15. A non-transitory computer-readable storage medium that stores executable instructions, which, if executed by one or more processors of a computer system, cause the computer system to at least:

detect, at a computing device, a communication to a network location associated with an encryption configuration for communications from the computing device to the network location;

select a communications channel based at least in part on whether the network location is at a different computing device from the computing device; and

route the communication via the communications channel.

16. The non-transitory computer-readable storage medium of claim 15, wherein the executable instructions that route the communication cause the system to route the communication in unencrypted form.

17. The non-transitory computer-readable storage medium of claim 15, wherein the communication is between members of a group of software applications that exchange data between each other.

18. The non-transitory computer-readable storage medium of claim 17, wherein the executable instructions that cause the computer system to route the communication via the communications channel on a condition that the network location is at a same computing device as the computing device.

19. The non-transitory computer-readable storage medium of claim 18, wherein the executable instructions further include instructions that cause the computer system to:

on the condition that the network location is at the same computing device as the computing device, route the communication to the network location via an overlay network entity on the same computing device; and

on the condition that the network location is at the different computing device from the computing device, route the communication to the network location via a network that is communicatively connected to the different computing device.

20. The non-transitory computer-readable storage medium of claim 19, wherein the executable instructions that cause the computer system to route the communication via the overlay network entity further cause the computer system to route the communication in accordance with a route for an overlay network, the route being associated with an address of a virtual network adapter.