Overlay networks for application groups

• US 10,313,465 B2
• Filed: 03/20/2017
• Issued: 06/04/2019
• Est. Priority Date: 06/20/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Allen, Nicholas Alexander
• Primary Examiner(s): Powers, William S
• Application Number:
  US15/464,102
• Publication Number:
  US 20170195444A1
• Time in Patent Office: 806 Days
• Field of Search: 713168
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 45/64 using an overlay routing layer
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 61/25 of the same type
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54

Abstract

A communication to a network location is detected at a computing device. The communication is transmitted to the network location in a manner dependent at least in part on whether the network location is at the computing device or at a different computing device.

Claims

1. A computer-implemented method, comprising:

detecting, at a computing device, a communication of data to a network location via a first communications channel, the network location associated with one or more operations;

determining, at least in part on whether the network location is at the computing device or at a different computing device, that the data is to be transformed;

performing the one or more operations to generate transformed data; and

routing the transformed data via a different second communications channel.

2. The computer-implemented method of claim 1, wherein performing the one or more operations includes decrypting the communication dependent at least in part on whether the network location is at the different computing device.

3. The computer-implemented method of claim 1, further comprising instantiating a virtual network adapter to facilitate routing of the transformed data from a source network address to a destination network address.

4. The computer-implemented method of claim 1, wherein:

the communication is associated with;

a first network address corresponding to a computing device performing a first application; and

a second network address corresponding to a computing device performing a second application; and

the first and second applications are configured to exchange data between each other.

5. The computer-implemented method of claim 4, wherein the first network address and the second network address are incorporated into a data packet that includes at least a portion of the communication.

6. The computer-implemented method of claim 1, wherein:

the communication is between a first and second application; and

transmitting the communication further includes encrypting the communication using credentials information associated with first and second applications.

7. The computer-implemented method of claim 6, wherein the credentials information is provided by an application deployment entity for use in performing cryptographic operations to data exchanged between the first and second application.

8. A system, comprising:

memory to store computer-executable instructions, which, if performed by one or more processors, cause the system to at least;

detect, at a computing device, a communication of data to a network location, the network location associated with one or more operations for transforming communications between the computing device and the network location;

select a communications channel based at least in part on whether the network location is at the computing device or at a different computing device;

perform the one or more operations to generate transformed data; and

route the transformed data via the selected communications channel.

9. The system of claim 8, wherein:

the computer-executable instructions further include instructions that cause the system to perform the one or more operations and route the transformed data in response to determining the network location is at different computing device from the computing device.

10. The system of claim 8, wherein the communication is between members of a group of software applications that exchange data between each other.

11. The system of claim 10, wherein the computer-executable instructions that cause the system to perform the one or more operations further cause the system to perform the one or more operations in accordance with credentials information usable for securing the communication between applications of the group.

12. The system of claim 8, wherein the computer-executable instructions further include instructions that cause the system to:

if the network location is at a same computing device as the computing device, use the communications channel to route the data to the network location via an overlay network entity on the same computing device; and

if the network location is at the different computing device from the computing device, use the communications channel to route the transformed data to the network location via a network that is communicatively connected to the different computing device.

13. The system of claim 12, wherein the computer-executable instructions that cause the system to use the communications channel to route the data via the overlay network entity further cause the system to route the communication in accordance with a route for an overlay network, the route being associated with an address of a virtual network adapter.

14. The system of claim 13, wherein:

the communication is between a first application and a second application; and

the computer-executable instructions include instructions that cause the system to terminate the virtual network adapter as a result of termination of the first application or the second application.

15. A non-transitory computer-readable storage medium that stores executable instructions, which, if executed by one or more processors of a computer system, cause the computer system to at least:

detect, at a computing device, a communication to a network location associated with one or more operations for transforming communications between the computing device and the network location;

select a communications channel based at least in part on whether the network location is at the computing device or at a different computing device; and

route the communication via the communications channel.

16. The non-transitory computer-readable storage medium of claim 15, wherein the executable instructions that cause the computer system to route the communication via the communications channel further include instructions that cause the computer system to route the communication via a proxy entity dependent at least in part on whether the network location is located on the computing device.

17. The non-transitory computer-readable storage medium of claim 15, wherein the executable instructions that cause the computer system to route the communication via the communications channel further include instructions that cause the computer system to route the communication to the network location via an overlay network.

18. The non-transitory computer-readable storage medium of claim 15, wherein:

the executable instructions include instructions that cause the computer system to perform address translation for routing of the communication; and

the executable instruction that cause the computer system to route the communication further include instructions that cause the computer system to route the communication to the network location in accordance with the address translation.

19. The non-transitory computer-readable storage medium of claim 15, wherein the executable instructions that cause the computer system to transmit the communication include instructions that cause the computer system to:

if the network location is at a same computing device as the computing device, use the communications channel to route the communication to the network location via an overlay network entity on the same computing device; and

if the network location is at the different computing device from the computing device, use the communications channel to route the communication to the network location at the different computing device via a network that is communicatively coupled between the computing device and the different computing device.

20. The non-transitory computer-readable storage medium of claim 15, wherein:

the computing device hosts a virtual computing device and a virtualization layer that supports the virtual computing device; and

the executable instructions are performed within the virtualization layer.