Overlay network identity-based relay

• US 10,200,281 B1
• Filed: 08/31/2018
• Issued: 02/05/2019
• Est. Priority Date: 03/16/2018
• Status: Active Grant

• Current Assignee: Tyco Fire & Security GmbH (Johnson Controls International plc)
• Original Assignee: Tempered Networks, Inc. (Johnson Controls International plc)
• Inventors: Ahrenholz, Jeffrey Michael, Brewer, Jr., Orlie Thomas, Costlow, Jeff James
• Primary Examiner(s): Thompson, Jr., Otis L
• Application Number:
  US16/120,043
• Time in Patent Office: 158 Days
• Field of Search: None
• CPC Class Codes: H04L 45/026 Details of "hello" or keep-alive messages
• CPC Class Codes: H04L 45/64 using an overlay routing layer
• CPC Class Codes: H04L 45/74 Address processing for routing

Abstract

Embodiments are directed to a relay that receives packets from a source gateway associated with a source gateway identifier (GID) and a target GID associated with a target gateway where each GID is separate from a network address or a hostname of the source gateway or the target gateway. The relay determines a connection route based on an association between the connection route and an ingress identifier obtained from the packets. The relay provides the connection route based on the source GID and the target GID. The relay determines network address information associated with the target gateway based on the connection route. And, the relay forwards the packets provided by the source gateway to the target gateway based on the network address information.

Claims

1. A method for managing communication over a network using one or more network computers, wherein execution of instructions by the one or more network computers perform the method comprising:

instantiating a relay engine to perform actions including;

determining a connection route for one or more received packets based on a source gateway identifier (GID) corresponding to a source gateway and a target GID associated with a target gateway, wherein the connection route is associated with both the source GID and the target GID, and wherein each GID is separate from a network address of the source gateway or the target gateway; and

forwarding the one or more packets provided by the source gateway to the target gateway based on network address information associated with the target gateway.

2. The method of claim 1, wherein the network address information associated with the target gateway is based on the connection route.

3. The method of claim 1, wherein each GID is separate from a hostname of the source gateway or the target gateway.

4. The method of claim 1, wherein determining the connection route further comprises employing an association between the connection route and an ingress identifier, wherein the ingress identifier is obtained from the one or more packets from the source computer that is separate from the source GID.

5. The method of claim 1, further comprising, instantiating a platform engine to provide policy information to the source computer indicating whether a destination node computer corresponding to the one or more packets is associated with the target gateway computer.

6. The method of claim 1, further comprising, instantiating a platform engine that performs actions, including:

providing policy information to one or more of the source gateway computer or the target gateway computer indicating whether the connection route is allowed for forwarding the one or more packets from the source gateway computer to the target gateway computer; and

enabling the forwarding of the one or more packets from the source gateway computer to the target gateway computer over an allowed connection route.

7. The method of claim 1, further comprising, instantiating a platform engine that performs actions, including one or more of:

providing policy information to define one or more connection routes in an overlay network to one or more relay engines and to one or more gateway computers;

or

associating two or more GIDs with each defined connection route in the overlay network with two or more GIDs.

8. A system for managing communication over a network, comprising:

a relay computer, comprising;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including;

instantiating a relay engine to perform actions including;

determining a connection route for one or more received packets based on a source gateway identifier (GID) corresponding to a source gateway and a target GID associated with a target gateway, wherein the connection route is associated with both the source GID and the target GID, and wherein each GID is separate from a network address of the source gateway or the target gateway; and

forwarding the one or more packets provided by the source gateway to the target gateway based on network address information associated with the target gateway; and

a source gateway computer, comprising;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including;

providing the one or more packets that are associated with the source GID.

9. The system of claim 8, wherein the network address information associated with the target gateway is based on the connection route.

10. The system of claim 8, wherein each GID is separate from a hostname of the source gateway or the target gateway.

11. The system of claim 8, wherein determining the connection route further comprises employing an association between the connection route and an ingress identifier, wherein the ingress identifier is obtained from the one or more packets from the source computer that is separate from the source GID.

12. The system of claim 8, further comprising, instantiating a platform engine to provide policy information to the source computer indicating whether a destination node computer corresponding to the one or more packets is associated with the target gateway computer.

13. The system of claim 8, further comprising, instantiating a platform engine that performs actions, including:

providing policy information to one or more of the source gateway computer or the target gateway computer indicating whether the connection route is allowed for forwarding the one or more packets from the source gateway computer to the target gateway computer; and

enabling the forwarding of the one or more packets from the source gateway computer to the target gateway computer over an allowed connection route.

14. The system of claim 8, further comprising, instantiating a platform engine that performs actions, including one or more of:

providing policy information to define one or more connection routes in an overlay network to one or more relay engines and to one or more gateway computers;

or

associating two or more GIDs with each defined connection route in the overlay network with two or more GIDs.

15. A processor readable non-transitory storage media that includes instructions for managing communication over a network, wherein execution of the instructions by the one or more network computers perform the method comprising:

instantiating a relay engine to perform actions including;

instantiating a relay engine to perform actions including;

determining a connection route for one or more received packets based on a source gateway identifier (GID) corresponding to a source gateway and a target GID associated with a target gateway, wherein the connection route is associated with both the source GID and the target GID, and wherein each GID is separate from a network address of the source gateway or the target gateway; and

forwarding the one or more packets provided by the source gateway to the target gateway based on network address information associated with the target gateway.

16. The media of claim 15, wherein the network address information associated with the target gateway is based on the connection route.

17. The media of claim 15, wherein each GID is separate from a hostname of the source gateway or the target gateway.

18. The media of claim 15, wherein determining the connection route further comprises employing an association between the connection route and an ingress identifier, wherein the ingress identifier is obtained from the one or more packets from the source computer that is separate from the source GID.

19. The media of claim 15, further comprising, instantiating a platform engine to provide policy information to the source computer indicating whether a destination node computer corresponding to the one or more packets is associated with the target gateway computer.

20. The media of claim 15, further comprising, instantiating a platform engine that performs actions, including:

providing policy information to one or more of the source gateway computer or the target gateway computer indicating whether the connection route is allowed for forwarding the one or more packets from the source gateway computer to the target gateway computer; and

enabling the forwarding of the one or more packets from the source gateway computer to the target gateway computer over an allowed connection route.

21. The media of claim 15, further comprising, instantiating a platform engine that performs actions, including one or more of:

providing policy information to define one or more connection routes in an overlay network to one or more relay engines and to one or more gateway computers;

or

associating two or more GIDs with each defined connection route in the overlay network with two or more GIDs.

22. A network computer for managing communication over a network, comprising:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including;

instantiating a relay engine to perform actions including;

determining a connection route for one or more received packets based on a source gateway identifier (GID) corresponding to a source gateway and a target GID associated with a target gateway, wherein the connection route is associated with both the source GID and the target GID, and wherein each GID is separate from a network address of the source gateway or the target gateway; and

forwarding the one or more packets provided by the source gateway to the target gateway based on network address information associated with the target gateway.

23. The network device of claim 22, wherein the network address information associated with the target gateway is based on the connection route.

24. The network device of claim 22, wherein each GID is separate from a hostname of the source gateway or the target gateway.

25. The network device of claim 22, wherein determining the connection route further comprises employing an association between the connection route and an ingress identifier, wherein the ingress identifier is obtained from the one or more packets from the source computer that is separate from the source GID.

26. The network device of claim 22, further comprising, instantiating a platform engine to provide policy information to the source computer indicating whether a destination node computer corresponding to the one or more packets is associated with the target gateway computer.

27. The network device of claim 22, further comprising, instantiating a platform engine that performs actions, including:

providing policy information to one or more of the source gateway computer or the target gateway computer indicating whether the connection route is allowed for forwarding the one or more packets from the source gateway computer to the target gateway computer; and

enabling the forwarding of the one or more packets from the source gateway computer to the target gateway computer over an allowed connection route.

28. The method of claim 22, further comprising, instantiating a platform engine that performs actions, including one or more of:

providing policy information to define one or more connection routes in an overlay network to one or more relay engines and to one or more gateway computers;

or

associating two or more GIDs with each defined connection route in the overlay network with two or more GIDs.