Using virtual networking devices to manage substrate devices

• US 8,117,289 B1
• Filed: 04/21/2011
• Issued: 02/14/2012
• Est. Priority Date: 12/07/2009
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Miller, Kevin Christopher, Brandwine, Eric Jason, Doane, Andrew J.
• Primary Examiner(s): Nguyen, Tammy
• Application Number:
  US13/091,986
• Time in Patent Office: 299 Days
• Field of Search: 709/220, 709/224, 709/227, 709/238, 455/445, 342/457
• US Class Current: 709/220
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/02 Topology update or discovery

Abstract

Techniques are described for providing managed virtual computer networks that may have a configured logical network topology with one or more virtual networking devices, with corresponding networking functionality provided for communications between multiple computing nodes of the virtual computer network by emulating functionality that would be provided by the networking devices if they were physically present. In some situations, the emulating of networking device functionality includes receiving routing communications directed to the networking devices and using included routing information to update the configured network topology for the managed computer network. In addition, the techniques may further include supporting interactions with devices that are external to the virtual computer network, including remote physical networking devices that are part of a remote computer network configured to interoperate with the virtual computer network, and/or specialized network devices that are accessible via a substrate network on which the virtual computer network is overlaid.

Claims

1. A non-transitory computer-readable storage medium whose contents configure a computing system to perform a method, the method comprising:

under control of the configured computing system,

receiving information from a first client for use in configuring a first virtual computer network for the first client, the configuring including specifying interconnections between multiple computing nodes of the first virtual computer network and including providing an indicated type of functionality for handling at least some communications between the multiple computing nodes; and

automatically providing the configured first virtual computer network in accordance with the configuring by overlaying the first virtual computer network on a distinct substrate network, the providing of the first virtual computer network including;

selecting one or more network devices that are accessible via the substrate network and that are configured to provide the indicated type of functionality; and

forwarding multiple communications between the multiple computing nodes in accordance with the configuring, the forwarding including routing at least one of the multiple communications to at least one of the selected devices to enable the at least one selected device to provide the indicated type of functionality for the at least one communication.

2. The non-transitory computer-readable storage medium of claim 1 wherein the configured computing system is part of a configurable network service that provides multiple virtual computer networks to multiple remote clients, wherein the selected network devices are provided by the configurable network service for use in supporting at least some of the provided multiple virtual computer networks, and wherein the method further comprises, for a second of the multiple virtual computer networks provided to a second remote client, receiving information from the second client for use in configuring the second virtual computer network by providing the indicated type of functionality for handling at least some communications between computing nodes of the second virtual computer network, automatically determining to provide the indicated type of functionality for handling the at least some communications for the second virtual computer network using one or more configured software modules in lieu of the one or more accessible network devices, and automatically providing the second virtual computer network by overlaying the second virtual computer network on the substrate network and forwarding multiple communications between the computing nodes of the second virtual computer network using the one or more configured software modules to provide the indicated type of functionality.

3. The non-transitory computer-readable storage medium of claim 2 wherein the selecting of the one or more network devices to use for the forwarding of the at least one communications for the first virtual computer network includes determining to use the one or more network devices based at least in part on a quantity of the at least one communications for the first virtual computer network exceeding a determined threshold, and wherein the determining to provide the indicated type of functionality for handling the at least some communications for the second virtual computer network using the one or more configured software modules in lieu of the one or more accessible network devices is based at least in part on a quantity of the at least one communications for the second virtual computer network not exceeding the determined threshold.

4. The non-transitory computer-readable storage medium of claim 1 wherein the configured computing system is part of a configurable network service that provides multiple virtual computer networks to multiple remote clients, wherein the selected network devices are provided by the configurable network service for use in supporting at least some of the provided multiple virtual computer networks, wherein the configurable network service provides a plurality of co-located computing nodes for use with the multiple virtual computer networks, wherein each of the multiple virtual computer networks uses a subset of multiple of the plurality of computing nodes, and wherein at least two of the multiple virtual computer networks each uses the selected one or more network devices to provide the indicated type of functionality for communications for that virtual computer network.

5. The non-transitory computer-readable storage medium of claim 1 wherein the one or more network devices are configurable to perform multiple types of functionality, and wherein the selecting of the one or more network devices includes configuring the selected network devices to provide the indicated type of functionality.

6. The non-transitory computer-readable storage medium of claim 1 wherein the indicated type of functionality includes at least one of load balancing functionality, firewall functionality, and intrusion detection functionality.

7. The non-transitory computer-readable storage medium of claim 1 wherein the information received from the first client is configuration information for the first virtual computer network that specifies one or more networking devices that are part of the specified interconnections for the first virtual computer network, wherein the overlaying of the first virtual computer network on the substrate network is performed without physically providing the one or more networking devices, wherein the forwarding of the multiple communications between the multiple computing nodes in accordance with the specified interconnections is performed in a manner to emulate functionality that would be performed by the one or more networking devices if the one or more networking devices were physically provided, and wherein the method further comprises:

receiving one or more routing communications that are each directed to at least one of the one or more networking devices, the one or more routing communications being sent by at least one remote device associated with a remote computer network that interoperates with the first virtual computer network and including network routing information related to the remote computer network;

updating the specified interconnections of the first virtual computer network based on the network routing information included in the received one or more routing communications to enable one or more additional communications to be forwarded from the multiple computing nodes to the remote computer network in accordance with the updated specified interconnections.

8. The non-transitory computer-readable storage medium of claim 7 wherein the method further comprises:

before the receiving of the one or more routing communications, establishing a connection between the first virtual computer network and the remote computer network, the remote computer network including multiple computing systems and one or more physical networking devices located at one or more geographical locations distinct from a geographical location of the substrate network, wherein the at least one remote device that sends the one or more routing communications being at least one of the one or more physical networking devices, and wherein the one or more routing communications are received via the established connection; and

after the updating of the specified interconnections of the first virtual computer network, forwarding the one or more additional communications from the multiple computing nodes to the remote computer network over the established connection in accordance with the updated specified interconnections.

9. The non-transitory computer-readable storage medium of claim 1 wherein the computer-readable medium is a memory of the configured computing system that stores the contents, and wherein the contents are instructions that when executed program the configured computing system to perform the method.

10. The non-transitory computer-readable storage medium of claim 1 wherein the indicated type of functionality is load balancing functionality, and wherein the selected network devices are each configured to perform load balancing functionality for one or more virtual computer networks that include the configured first virtual computer network.

11. The non-transitory computer-readable storage medium of claim 1 wherein the indicated type of functionality is firewall functionality, and wherein the selected network devices are each configured to perform firewall functionality for one or more virtual computer networks that include the configured first virtual computer network.

12. The non-transitory computer-readable storage medium of claim 1 wherein the indicated type of functionality is intrusion detection functionality, and wherein the selected network devices are each configured to perform intrusion detection functionality for one or more virtual computer networks that include the configured first virtual computer network.

13. The non-transitory computer-readable storage medium of claim 1 wherein the configured computing system is part of a configurable network service that provides multiple virtual computer networks to multiple remote clients, wherein the configurable network services provides a plurality of network devices performing a plurality of types of functionality that are accessible via the substrate network, and wherein the selecting of the one or more network devices includes identifying the one or more network devices from the plurality of network devices based at least in part on those one or more network devices being available to provide the indicated type of functionality and further includes configuring those one or more network devices in a manner specific to the configured first virtual computer network.

14. The non-transitory computer-readable storage medium of claim 1 wherein the configured computing system is part of a configurable network service that provides multiple virtual computer networks to multiple remote clients and that supplies a plurality of computing nodes for use in the provided multiple virtual computer networks, wherein the configured first virtual computer network is one of the provided multiple virtual computer networks and the multiple computing nodes are a subset of the supplied plurality of computing nodes, wherein communications sent between the plurality of computing nodes for the multiple virtual computer networks are transmitted on the substrate network and are encoded to use information specific to the substrate network during transmission, and wherein the configurable network service provides multiple modules that manage communications between the plurality of computing nodes by modifying outgoing communications from the plurality of computing nodes to be encoded with the information specific to the substrate network before transmission over the substrate network and by modifying incoming communications to the plurality of computing nodes to remove the encoded information specific to the substrate network after the transmission over the substrate network.

15. The non-transitory computer-readable storage medium of claim 1 wherein the configured computing system is part of a configurable network service that provides multiple virtual computer networks to multiple remote clients and that supplies a plurality of computing nodes for use in the provided multiple virtual computer networks, wherein the configured first virtual computer network is one of the provided multiple virtual computer networks and the multiple computing nodes are a subset of the supplied plurality of computing nodes, wherein the multiple computing nodes are each a virtual machine hosted on one of multiple physical computing systems of the configurable network service, and wherein the providing of the configured first virtual computer network includes configuring one or more virtual machine communication manager modules that execute on one or more of the physical computing systems to manage communications for the hosted virtual machines.

16. A computed-implemented method comprising:

receiving information from a first client for use in configuring a first virtual computer network for the first client, the configuring including specifying interconnections between multiple computing nodes of the first virtual computer network and including providing an indicated type of functionality for handling at least some communications between the multiple computing nodes, the receiving of the information being performed by one or more configured computing systems of a configurable network service that provides multiple virtual computer networks to multiple clients; and

automatically providing the configured first virtual computer network for the first client in accordance with the configuring by overlaying the first virtual computer network on a distinct substrate network, the multiple computing nodes being connected to the substrate network, and the automatic providing of the first virtual computer network being performed by the one or more configured computing systems and including;

selecting one or more network devices that are accessible via the substrate network and that are configured to provide the indicated type of functionality; and

forwarding multiple communications between the multiple computing nodes in accordance with the configuring, the forwarding including routing at least one of the multiple communications to at least one of the selected devices to enable the at least one selected device to provide the indicated type of functionality for the at least one communication.

17. The computer-implemented method of claim 16 wherein the selected network devices are a subset of a plurality of network devices provided by the configurable network service for use in supporting at least some of the provided multiple virtual computer networks, and wherein the method further comprises, for a second of the multiple virtual computer networks provided to a second remote client, receiving information from the second client for use in configuring the second virtual computer network by providing the indicated type of functionality for handling at least some communications between computing nodes of the second virtual computer network, automatically determining to provide the indicated type of functionality for handling the at least some communications for the second virtual computer network using one or more configured software modules in lieu of the plurality of network devices, and automatically providing the second virtual computer network by overlaying the second virtual computer network on the substrate network and forwarding multiple communications between the computing nodes of the second virtual computer network using the one or more configured software modules to provide the indicated type of functionality.

18. The computer-implemented method of claim 17 wherein the configurable network service provides a plurality of co-located computing nodes for use with the provided multiple virtual computer networks, wherein each of the multiple virtual computer networks uses a subset of multiple of the plurality of computing nodes, and wherein at least two of the multiple virtual computer networks each uses the selected one or more network devices to provide the indicated type of functionality for communications for that virtual computer network.

19. The computer-implemented method of claim 16 wherein the indicated type of functionality includes at least one of load balancing functionality, firewall functionality, and intrusion detection functionality.

20. A computing system comprising:

one or more processors; and

a manager module of a configurable network service that is configured to, when executed by at least one of the processors, provide a virtual computer network for each of one or more clients, the providing of the virtual computer network for each of the one or more clients including;

receiving information from the client for use in configuring the virtual computer network for the client, the configuring including specifying interconnections between multiple computing nodes of the virtual computer network and including providing an indicated type of functionality for handling at least some communications between the multiple computing nodes; and

automatically providing the configured virtual computer network for the client in accordance with the configuring by overlaying the virtual computer network on a distinct substrate network, the multiple computing nodes being connected to the substrate network, and the automatic providing of the virtual computer network including;

selecting one or more network devices that are accessible via the substrate network and that are configured to provide the indicated type of functionality; and

forwarding multiple communications between the multiple computing nodes in accordance with the configuring, the forwarding including routing at least one of the multiple communications to at least one of the selected devices to enable the at least one selected device to provide the indicated type of functionality for the at least one communication.

21. The computing system of claim 20 wherein the selected network devices are a subset of a plurality of network devices provided by the configurable network service, and wherein the manager module is further configured to, for a second remote client distinct from the one or more clients, provide a second virtual computer network for the second client by receiving information from the second client for use in configuring the second virtual computer network to provide the indicated type of functionality for handling at least some communications between computing nodes of the second virtual computer network, by automatically determining to provide the indicated type of functionality for handling the at least some communications for the second virtual computer network using one or more configured software modules in lieu of the plurality of network devices, and by automatically providing the second virtual computer network by overlaying the second virtual computer network on the substrate network and forwarding multiple communications between the computing nodes of the second virtual computer network using the one or more configured software modules to provide the indicated type of functionality, and wherein the determining to provide the indicated type of functionality for handling the at least some communications for the second virtual computer network using the one or more configured software modules in lieu of the one or more accessible network devices is based at least in part on a quantity of the at least one communications for the second virtual computer network not exceeding a determined threshold.

22. The computing system of claim 21 wherein the configurable network service provides a plurality of co-located computing nodes for use with multiple provided virtual computer networks that includes the second virtual computer network and the virtual computer network provided for each of the one or more clients, wherein each of the multiple virtual computer networks uses a subset of multiple of the plurality of computing nodes, and wherein at least two of the multiple virtual computer networks each uses the selected one or more network devices to provide the indicated type of functionality for communications for that virtual computer network.

23. The computing system of claim 20 wherein the indicated type of functionality includes at least one of load balancing functionality, firewall functionality, and intrusion detection functionality.

24. The computing system of claim 20 wherein the one or more clients include multiple remote clients, and wherein the manager module includes software instructions that when executed performs the providing of the virtual computer network for each of the one or more clients and that further performs providing a programmatic interface for use by the multiple remote clients to configure the virtual computer networks provided for use by the clients.