Using virtual networking devices to connect managed computer networks

• US 7,991,859 B1
• Filed: 12/28/2009
• Issued: 08/02/2011
• Est. Priority Date: 12/28/2009
• Status: Expired due to Fees

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Brandwine, Eric Jason, Miller, Kevin Christopher, Doane, Andrew J.
• Primary Examiner(s): Dinh; Khanh Q
• Application Number:
  US12/648,239
• Time in Patent Office: 582 Days
• Field of Search: 709/220, 709/224, 709/229, 370/252
• US Class Current: 709/220
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 49/15 Interconnection of switching modules
• CPC Class Codes: H04L 49/252 Store and forward routing
• CPC Class Codes: H04L 49/70 Virtual switches
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Techniques are described for providing managed virtual computer networks whose configured logical network topology may have one or more virtual networking devices, such as by a network-accessible configurable network service, with corresponding networking functionality provided for communications between multiple computing nodes of a virtual computer network by emulating functionality that would be provided by the networking devices if they were physically present. The networking functionality provided for a managed computer network may include supporting a connection between that managed computer network and other managed computer networks, such as via a provided virtual peering router to which each of the managed computer networks may connect, with the functionality of the virtual peering router being emulated by modules of the configurable network service without physically providing the virtual peering router, including to manage data communications between computing nodes of the inter-connected managed computer networks in accordance with client-specified configuration information.

Claims

1. A non-transitory computer-readable storage medium whose contents configure a computing system to perform a method, the method comprising:

under control of the configured computing system,

receiving information from a first client for use in configuring a first virtual computer network for the first client, the configuring including specifying inter-connections between multiple first computing nodes of the first virtual computer network, the configuring further including specifying a first connection between the multiple first computing nodes and a virtual peering router that enables interactions with one or more other second virtual computer networks, the received information from the first client being configuration information for the first virtual computer network that specifies one or more first networking devices that are part of the specified inter-connections for the first virtual computer network; and

automatically providing the configured first virtual computer network in accordance with the configuring by overlaying the first virtual computer network on a distinct substrate network without physically providing the specified first networking devices, the providing of the first virtual computer network including;

establishing the first connection between the first virtual computer network and the virtual peering router, the establishing of the first connection including establishing a logical connection between at least one of the specified first networking devices of the first virtual computer network and the virtual peering router; and

after the one or more second virtual computer networks have established one or more second connections to the virtual peering router, the one or more second virtual computer networks having multiple second computing nodes, forwarding a plurality of communications over the substrate network that are each sent from one of the first and second computing nodes and that are each delivered to at least one of the first and second computing nodes, the forwarding of the plurality of communications including forwarding multiple communications between the first virtual computer network and the one or more second virtual computer networks via the established first and second connections without physically providing the virtual peering router and including emulating functionality that would be provided by the virtual peering router if the virtual peering router was physically provided,

and wherein the configured computing system is part of a configurable network service that provides multiple virtual computer networks to multiple remote clients, the provided multiple virtual computer networks including the first virtual computer network and the one or more second virtual computer networks.

2. The non-transitory computer-readable storage medium of claim 1 wherein the one or more second virtual computer networks are provided to the first client, and wherein the method further comprises automatically providing the one or more second virtual computer networks in accordance with information received from the first client by overlaying the one or more second virtual computer networks on the substrate network.

3. The non-transitory computer-readable storage medium of claim 1 wherein the computer-readable medium is a memory of the configured computing system that stores the contents, and wherein the contents are instructions that when executed program the computing system to perform the method.

4. The non-transitory computer-readable storage medium of claim 1 wherein the establishing of the first connection includes facilitating configurations that enable the multiple first computing nodes of the first virtual computer network to direct communications to the multiple second computing nodes of the second virtual computer networks, and wherein the forwarded multiple communications are each forwarded from one of the multiple first computing nodes to at least one of the multiple second computing nodes.

5. The non-transitory computer-readable storage medium of claim 4 wherein the facilitating of the configurations is performed in accordance with peering configuration information supplied by the first client for the virtual peering router and includes configuring one or more modules of the configurable network service.

6. The non-transitory computer-readable storage medium of claim 5 wherein the peering configuration information prevents communications from any virtual computer networks to be sent to the first computing nodes of the first virtual computer network via the virtual peering router.

7. The non-transitory computer-readable storage medium of claim 5 wherein the peering configuration information indicates one or more filters to limit communications that are allowed to be sent to the first computing nodes of the first virtual computer network via the virtual peering router from other virtual computer networks.

8. The non-transitory computer-readable storage medium of claim 5 wherein the peering configuration information is supplied as part of the received configuration information from the first client.

9. The non-transitory computer-readable storage medium of claim 5 wherein the received configuration information from the first client includes an instruction from the first client to create the virtual peering router on behalf of the first client, and wherein the emulating of the functionality of the virtual peering router is performed in response to the instruction from the first client.

10. The non-transitory computer-readable storage medium of claim 4 wherein the method further comprises establishing one or more additional logical connections from one or more third virtual computer networks to the virtual peering router, the establishing of the one or more additional logical connections including performing configurations to enable the multiple first computing nodes of the first virtual computer network to direct communications to multiple third computing nodes of the one or more third virtual computer networks, to enable the multiple third computing nodes of the one or more third virtual computer networks to direct communications to the multiple first computing nodes of the first virtual computer network and to the multiple second computing nodes of the second virtual computer networks, and wherein the forwarding of the plurality of communications further includes forwarding multiple additional communications that are each between at least two of the first, second and third virtual computer networks.

11. The non-transitory computer-readable storage medium of claim 4 wherein the method further comprises establishing a second logical connection between the virtual peering router and the one or more second virtual computer networks and performing additional configurations to enable the multiple second computing nodes of the second virtual computer networks to direct communications to the multiple first computing nodes of the first virtual computer network.

12. The non-transitory computer-readable storage medium of claim 11 wherein the one or more second virtual computer networks are provided for a second client of the configurable network service that is distinct from the first client, and wherein the additional configurations are performed in accordance with additional peering configuration information supplied by the second client for the virtual peering router, the additional peering configuration information indicating one or more filters to limit communications that are allowed to be sent to the second computing nodes of the second virtual computer networks via the virtual peering router from the first virtual computer network.

13. The non-transitory computer-readable storage medium of claim 11 wherein the automatic providing of the first virtual computer network further includes:

receiving one or more routing communications via the established second logical connection that are directed to the virtual peering router and include network routing information for the second virtual computer networks, the one or more routing communications being specified in accordance with one or more predefined network routing protocols; and

using the network routing information included in the received one or more routing communications as part of the facilitating of the configurations that enable the multiple first computing nodes of the first virtual computer network to direct communications to the multiple second computing nodes of the second virtual computer networks.

14. The non-transitory computer-readable storage medium of claim 13 wherein the network routing information included in the received one or more routing communications indicates at least some of the multiple second computing nodes, wherein the computing nodes to which the multiple communications are forwarded are one or more of the at least some second computing nodes, and wherein the receiving of the one or more routing communications includes intercepting the one or more routing communications before the one or more routing communications are forwarded over the substrate network, and inhibiting forwarding of the intercepted routing communications to the virtual peering router.

15. The non-transitory computer-readable storage medium of claim 4 wherein the establishing of the first connection includes receiving one or more routing communications that include routing information about at least some of the multiple second computing nodes, and wherein the computing nodes to which the multiple communications are forwarded are one or more of the at least some second computing nodes.

16. The non-transitory computer-readable storage medium of claim 1 wherein the forwarding of the plurality of communications includes forwarding multiple first communications for the first virtual computer network between the multiple first computing nodes over the substrate network in a manner that emulates functionality that would be provided by the one or more specified first networking devices if the specified first networking devices were physically provided.

17. The non-transitory computer-readable storage medium of claim 16 wherein the configurable network service provides a plurality of computing nodes for use in provided virtual computer networks, wherein the multiple first computing nodes and the multiple second computing nodes are each a distinct subset of the plurality of computing nodes, wherein the configurable network service provides multiple modules that manage the multiple first communications by modifying outgoing communications from sending computing nodes to be encoded with information specific to the substrate network before transmission over the substrate network and by modifying incoming communications to destination computing nodes to remove the encoded information specific to the substrate network after the transmission over the substrate network.

18. The non-transitory computer-readable storage medium of claim 1 wherein the multiple first computing nodes are each a virtual machine hosted on one of multiple physical computing systems of the configurable network service, wherein the providing of the first virtual computer network includes configuring one or more virtual machine communication manager modules that execute on one or more of the physical computing systems to manage communications for the hosted virtual machines, and wherein the establishing of the first connection and the forwarding of the multiple communications are performed dynamically while the first virtual computer network is operational and without stopping use of the first virtual computer network based at least in part on management of communications by the virtual machine communication manager modules.

19. A computer-implemented method, comprising:

receiving information from a first client for use in configuring a first virtual computer network for the first client, the configuring including specifying inter-connections between multiple first computing nodes of the first virtual computer network, the configuring further including specifying a first connection between the multiple first computing nodes and a virtual peering router that enables interactions with one or more other second virtual computer networks, the received information from the first client being configuration information for the first virtual computer network that specifies one or more first networking devices that are part of the specified inter-connections for the first virtual computer network, the receiving of the information being performed by a configured computing system that is part of a configurable network service that provides multiple virtual computer networks to multiple remote clients, the provided multiple virtual computer networks including the first virtual computer network and the one or more second virtual computer networks; and

automatically providing the configured first virtual computer network in accordance with the configuring by overlaying the first virtual computer network on a distinct substrate network without physically providing the specified first networking devices, the providing of the first virtual computer network being performed by the configured computing system and including;

establishing the first connection between the first virtual computer network and the virtual peering router, the establishing of the first connection including establishing a logical connection between at least one of the specified first networking devices of the first virtual computer network and the virtual peering router; and

after the one or more second virtual computer networks have established one or more second connections to the virtual peering router, the one or more second virtual computer networks having multiple second computing nodes, forwarding a plurality of communications over the substrate network that are each sent from one of the first and second computing nodes and that are each delivered to at least one of the first and second computing nodes, the forwarding of the plurality of communications including forwarding multiple communications between the first virtual computer network and the one or more second virtual computer networks via the established first and second connections without physically providing the virtual peering router and including emulating functionality that would be provided by the virtual peering router if the virtual peering router was physically provided.

20. The method of claim 19 wherein the one or more second virtual computer networks are provided to the first client, and wherein the method further comprises automatically providing the one or more second virtual computer networks in accordance with information received from the first client by overlaying the one or more second virtual computer networks on the substrate network.

21. A configured computing system, comprising:

one or more processors; and

a manager module that is configured to, when executed by at least one of the processors;

receive information from a first client for use in configuring a first virtual computer network for the first client, the configuring including specifying inter-connections between multiple first computing nodes of the first virtual computer network, the configuring further including specifying a first connection between the multiple first computing nodes and a virtual peering router that enables interactions with one or more other second virtual computer networks, the received information from the first client being configuration information for the first virtual computer network that specifies one or more first networking devices that are part of the specified inter-connections for the first virtual computer network; and

automatically provide the configured first virtual computer network in accordance with the configuring by overlaying the first virtual computer network on a distinct substrate network without physically providing the specified first networking devices, the providing of the first virtual computer network including;

establishing the first connection between the first virtual computer network and the virtual peering router, the establishing of the first connection including establishing a logical connection between at least one of the specified first networking devices of the first virtual computer network and the virtual peering router; and

after the one or more second virtual computer networks have established one or more second connections to the virtual peering router, the one or more second virtual computer networks having multiple second computing nodes, forwarding a plurality of communications over the substrate network that are each sent from one of the first and second computing nodes and that are each delivered to at least one of the first and second computing nodes, the forwarding of the plurality of communications including forwarding multiple communications between the first virtual computer network and the one or more second virtual computer networks via the established first and second connections without physically providing the virtual peering router and including emulating functionality that would be provided by the virtual peering router if the virtual peering router was physically provided,

and wherein the manager module is part of a configurable network service that provides multiple virtual computer networks to multiple remote clients, the provided multiple virtual computer networks including the first virtual computer network and the one or more second virtual computer networks.

22. The computing system of claim 21 wherein the one or more second virtual computer networks are provided to the first client, and wherein the manager module is further configured to automatically provide the one or more second virtual computer networks in accordance with information received from the first client by overlaying the one or more second virtual computer networks on the substrate network.

23. The computing system of claim 21 wherein the manager module includes software instructions for execution by the at least one processor.