OVERLAY NETWORKS FOR APPLICATION GROUPS

• US 20170195444A1
• Filed: 03/20/2017
• Published: 07/06/2017
• Est. Priority Date: 06/20/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Allen, Nicholas Alexander
• Granted Patent: US 10,313,465 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 45/64 using an overlay routing layer
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 61/25 of the same type
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54

Abstract

A communication to a network location is detected at a computing device. The communication is transmitted to the network location in a manner dependent at least in part on whether the network location is at the computing device or at a different computing device.

Claims

1. A computer-implemented method, comprising:

detecting, at a computing device, a communication to a network location; and

transmitting the communication to the network location in a manner dependent at least in part on whether the network location is at the computing device or at a different computing device.

2. The computer-implemented method of claim 1, wherein transmitting the communication in the manner includes decrypting the communication dependent at least in part on whether the network location is at the different computing device.

3. The computer-implemented method of claim 1, further comprising instantiating a virtual network adapter to facilitate transmission of the communication from a source network address to a destination network address.

4. The computer-implemented method of claim 1, wherein:

the communication is associated with;

a first network address corresponding to a computing device performing a first application; and

a second network address corresponding to a computing device performing a second application; and

the first and second applications are configured to exchange data between each other.

5. The computer-implemented method of claim 4, wherein the first network address and the second network address are incorporated into a data packet that includes at least a portion of the communication.

6. The computer-implemented method of claim 1, wherein:

the communication is between a first and second application; and

transmitting the communication further includes encrypting the communication using credentials information associated with first and second applications.

7. The computer-implemented method of claim 6, wherein the credentials information is provided by an application deployment entity for use in performing cryptographic operations to data exchanged between the first and second application.

8. A system, comprising:

memory to store computer-executable instructions, which, if performed by one or more processors, cause the system to at least;

detect, at a computing device, a communication to a network location; and

transmit the communication to the network location in a manner dependent at least in part on whether the network location is at the computing device or at a different computing device.

9. The system of claim 8, wherein:

the computer-executable instructions further include instructions that cause the system to determine whether the network location is at a same computing device as the computing device or at different computing device from the computing device; and

the computer-executable instructions that transmit the communication further cause the system to route the communication in unencrypted form if the network location is at the same computing device as the computing device.

10. The system of claim 8, wherein the communication is between members of a group of software applications that exchange data between each other.

11. The system of claim 10, wherein the computer-executable instructions that cause the system to transmit the communication further cause the system to transmit the communication in accordance with credentials information usable for securing the communication between applications of the group.

12. The system of claim 8, wherein the computer-executable instructions further include instructions that cause the system to:

if the network location is at a same computing device as the computing device, route the communication to the network location via an overlay network entity on the same computing device; and

if the network location is at the different computing device from the computing device, route the communication to the network location via a network that is communicatively connected to the different computing device.

13. The system of claim 12, wherein the computer-executable instructions that cause the system to route the communication via an overlay network entity further cause the system to route the communication in accordance with a route for an overlay network, the route being associated with an address of a virtual network adapter.

14. The system of claim 13, wherein:

the communication is between a first application and a second application; and

the computer-executable instructions include instructions that cause the system to terminate the virtual network adapter as a result of termination of the first application or the second application.

15. A non-transitory computer-readable storage medium that stores executable instructions, which, if executed by one or more processors of a computer system, cause the computer system to at least:

detect, at a computing device, a communication to a network location; and

transmit the communication to the network location in a manner dependent at least in part on whether the network location is at the computing device or at a different computing device.

16. The non-transitory computer-readable storage medium of claim 15, wherein the executable instructions that cause the computer system to transmit the communication further include instructions that cause the computer system to route the communication via a proxy entity dependent at least in part on whether the network location is located on the computing device.

17. The non-transitory computer-readable storage medium of claim 15, wherein the executable instructions that cause the computer system to provide the communication further include instructions that cause the computer system to route the communication to the network location via an overlay network.

18. The non-transitory computer-readable storage medium of claim 15, wherein:

the executable instructions include instructions that cause the computer system to perform address translation for transmission of the communication; and

the executable instruction that cause the computer system to transmit the communication further include instructions that cause the computer system to route the communication to the network location in accordance with the address translation.

19. The non-transitory computer-readable storage medium of claim 15, wherein the executable instructions that cause the computer system to transmit the communication include instructions that cause the computer system to:

if the network location is at a same computing device as the computing device, route the communication to the network location via an overlay network entity on the same computing device; and

if the network location is at the different computing device from the computing device, route the communication to the network location at the different computing device via a network that is communicatively coupled between the computing device and the different computing device.

20. The non-transitory computer-readable storage medium of claim 15, wherein:

the computing device hosts a virtual computing device and a virtualization layer that supports the virtual computing device; and

the executable instructions are performed within the virtualization layer.