Using virtual networking devices and routing information to initiate external actions

• US 8,224,971 B1
• Filed: 12/28/2009
• Issued: 07/17/2012
• Est. Priority Date: 12/28/2009
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Miller, Kevin Christopher, Brandwine, Eric Jason, Doane, Andrew J.
• Primary Examiner(s): Dinh, Khanh Q
• Assistant Examiner(s): Daftuar, Saket K
• Application Number:
  US12/648,194
• Time in Patent Office: 932 Days
• Field of Search: 709/223, 709/227, 709/228, 709/229, 709/238, 709/239, 709/240, 709/241, 709/242, 709/243, 709/244, 709/245, 709/249, 709/250, 370/254, 370/351, 370/352, 370/353, 370/354, 370/355, 370/356, 370/357, 370/360, 370/370, 370/369, 370/389, 370/400, 370/409, 370/395.2, 370/395.5, 370/395.51, 370/395.52, 370/395.53, 370/395.54
• US Class Current: 709/227
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/5041 characterised by the time relationship between creation and deployment of a service
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 45/586 of virtual routers

Abstract

Techniques are described for providing managed virtual computer networks that have a configured logical network topology with virtual networking devices, such as by a network-accessible configurable network service, with corresponding networking functionality provided for communications between multiple computing nodes of the virtual computer network by emulating functionality that would be provided by the virtual networking devices if they were physically present. In some situations, the networking functionality provided for a managed computer network of a client includes receiving routing communications directed to the virtual networking devices, and using included routing information to identify and initiate external actions whose effects are not related to how network communications between computing nodes of the managed computer network are configured to be routed or otherwise forwarded through the managed computer network, such as external actions that affect devices that are not part of the managed computer network, or other types of external actions.

Claims

1. A computer-implemented method comprising:

under control of one or more computing systems of a configurable network service that provides virtual computer networks to clients,

receiving one or more requests to provide a first virtual computer network for a first client in accordance with specified configuration information, the configuration information indicating one or more specified networking devices of the first virtual computer network that interconnect multiple computing nodes of the first virtual computer network; and

automatically providing the first virtual computer network in accordance with the configuration information by overlaying the first virtual computer network on a distinct substrate network without physically providing the one or more specified networking devices, the providing of the first virtual computer network including;

forwarding multiple communications between the multiple computing nodes over the substrate network in a manner that emulates functionality that would be provided by the one or more specified networking devices if the one or more specified networking devices were physically provided;

after the forwarding of the multiple communications, receiving one or more routing communications that are each directed to at least one of the specified networking devices and include network routing information for the first virtual computer network that is specified in accordance with one or more predefined network routing protocols, the one or more routing communications being sent by one or more nodes controlled by the first client that facilitate handling communications for at least part of the first virtual computer network;

automatically analyzing the network routing information included in the one or more routing communications to identify one or more changes to make for the first virtual computer network while the first virtual computer network is operating that are not related to forwarding of communications between the multiple computing nodes of the first virtual computer network as part of the providing of the first virtual computer network; and

automatically initiating the identified one or more changes.

2. The method of claim 1 further comprising, after the initiating of the identified one or more changes and while the first virtual computer network continues to be operating, forwarding one or more additional communications between the multiple computing nodes over the substrate network in accordance with the configuration information for the first virtual computer network, the forwarding performed in a manner that is not affected by the initiated identified one or more changes.

3. The method of claim 1 wherein the identified one or more changes for the first virtual computer network include configuring one or more devices of the configurable network service that are not part of the first virtual computer network.

4. The method of claim 3 wherein each of the multiple computing nodes of the first virtual computer network is assigned at least one of multiple virtual network addresses used by the first virtual computer network, wherein the network routing information included in the one or more routing communications indicates a new use by at least one of the multiple computing nodes of a first public network address that is distinct from the multiple virtual network addresses, wherein the configured one or more devices include a first device that performs network address translation (“

NAT”

) functionality for incoming communications from computing systems external to the configurable network service, and wherein the configuring of the first device includes associating the first public network address with the first virtual computer network to enable future incoming communications from the external computing systems that specify the first public network address to be directed to the first virtual computer network.

5. The method of claim 3 wherein one or more computing systems external to the first virtual computer network are enabled to communicate with the multiple computing nodes of the first virtual computer network via one or more established connections, wherein the network routing information included in the one or more routing communications indicates a new routing path external to the first virtual computer network based on at least one of the established connections, wherein the configured one or more devices include a first device that performs functionality for filtering a subset of communications sent to the multiple computing nodes of the first virtual computer network via at least one of the established connections, the filtering performed by the first device in a specified manner, and wherein the configuring of the first device includes modifying the specified manner in which the first device performs filtering associated with future communications that are sent to the multiple computing nodes of the first virtual computer network using the new routing path for at least a temporary time.

6. The method of claim 1 wherein the identified one or more changes for the first virtual computer network include modifying operations performed by at least one of the multiple computing nodes of the first virtual computer network.

7. The method of claim 1 wherein the identified one or more changes for the first virtual computer network include at least one of configuring operations to be performed external to the first virtual computer network for at least some communications between the first virtual computer network and at least one other virtual computer network that is provided by the configurable network service to at least one other client, of modifying which computing nodes are part of the first virtual computer network, and of modifying configuration information for one or more devices of the configurable network service external to the first virtual computer network to reflect a modification of network topology information for the first virtual computer network that is indicated in the network routing information included in the one or more routing communications.

8. The method of claim 1 wherein the identified one or more changes for the first virtual computer network include storing information at a first time related to at least some of the network routing information included in the one or more routing communications to enable future use of the stored information, and wherein the method further comprises, at a second time after the first time, providing to the first client access to the stored information related to the at least some network routing information.

9. The method of claim 1 wherein the identified one or more changes for the first virtual computer network include sending a notification message to a target external to the first virtual computer network that is indicated by the first client, the notification message including at least some of the network routing information included in the one or more routing communications.

10. The method of claim 1 wherein the identified one or more changes for the first virtual computer network include updating one or more Domain Name System (“

DNS”

) servers external to the first virtual computer network, the updating including changing an association of one or more DNS domain names to one or more of the multiple computing nodes of the first virtual computer network, the one or more DNS domain names being available to computer systems external to the first virtual computer network to access the associated one or more computing nodes of the first virtual computer network.

11. The method of claim 10 wherein the changing of the association of the one or more DNS domain names to the one or more computing nodes of the first virtual computer network includes adding a first computing node of the first virtual computer network to a group of multiple computing nodes associated with a first DNS domain name, the one or more DNS servers selecting a member of the group of multiple computing nodes for use for the first DNS domain name in response to each of multiple requests by the external computer systems.

12. The method of claim 1 wherein the automatic analyzing of the network routing information included in the one or more routing communications further includes identifying an absence for at least a predetermined amount of time of network routing information corresponding to one or more routing targets that were previously indicated in one or more other received routing communications, and identifying one or more additional changes to make for the first virtual computer network while the first virtual computer network is operating that are not related to forwarding of communications between the multiple computing nodes of the first virtual computer network and that are based at least in part on the identified absence of the network routing information corresponding to the one or more routing targets.

13. The method of claim 1 wherein the received configuration information from the first client for the first virtual computer network includes policy information specified by the first client related to actions that are initiated based on network routing information for the first virtual computer network, and wherein the automatic analyzing of the network routing information to identify the one or more changes is further based in part on the policy information specified by the first client.

14. The method of claim 13 wherein the network routing information included in the one or more routing communications indicates a modification in how at least one of the multiple computing nodes is to participate in the operating of the first virtual computer network, and wherein the automatic analyzing of the network routing information to identify the one or more changes further includes automatically determining to block the indicated modification based at least in part on the policy information specified by the first client.

15. The method of claim 1 wherein the receiving of the one or more routing communications includes intercepting the one or more routing communications before the one or more routing communications are forwarded over the substrate network, and inhibiting forwarding of the intercepted routing communications to the at least one specified networking device to which the intercepted routing communications are directed.

16. The method of claim 1 wherein the configurable network service provides a plurality of computing nodes for use in provided virtual computer networks, wherein the configurable network service further provides multiple other virtual computer networks distinct from the first virtual computer network to multiple other clients, wherein each of the multiple other virtual computer networks include a distinct subset of multiple of the plurality of computing nodes, wherein communications sent between the plurality of computing nodes for the multiple other virtual computer networks and for the first virtual computer network are transmitted on the substrate network and are encoded to use information specific to the substrate network during transmission, and wherein the configurable network service provides multiple modules that manage communications between the plurality of computing nodes by modifying outgoing communications from the plurality of computing nodes to be encoded with the information specific to the substrate network before transmission over the substrate network and by modifying incoming communications to the plurality of computing nodes to remove the encoded information specific to the substrate network after the transmission over the substrate network.

17. The method of claim 1 wherein the multiple computing nodes are each a virtual machine hosted on one of multiple physical computing systems of the configurable network service, wherein the providing of the first virtual computer network includes configuring one or more virtual machine communication manager modules that execute on one or more of the physical computing systems to manage communications for the hosted virtual machines, and wherein the automatic initiating of the identified one or more changes are performed by a network routing manager module of the configurable network service.

18. A non-transitory computer-readable storage medium whose contents configure a computing system to perform a method, the method comprising:

providing, by the configured computing system, a virtual computer network for a client in accordance with information received from the client, the received information indicating interconnections between multiple computing nodes of the virtual computer network that include one or more networking devices, the providing of the virtual computer network including overlaying the virtual computer network on a distinct substrate network and further including;

receiving one or more routing communications that are each directed to at least one of the one or more networking devices and include network routing information;

analyzing, by the configured computing system, the network routing information included in the one or more routing communications to identify one or more actions to take that are not related to network communication forwarding behavior for the virtual computer network; and

automatically initiating, by the configured computing system, the identified one or more actions based at least in part on the network routing information included in the received one or more routing communications.

19. The non-transitory computer-readable storage medium of claim 18 wherein the information received from the client is configuration information for the virtual computer network that specifies the one or more networking devices for the virtual computer network, wherein the one or more routing communications are received from one or more of the multiple computing nodes that are controlled by the client and that perform functions that facilitate handling communications for at least part of the provided virtual computer network and that send the one or more routing communications using a defined network routing protocol, wherein the one or more routing communications are received after the forwarding of the multiple communications and include network routing information for the virtual computer network, and wherein the identified one or more actions include one or more changes to make for the virtual computer network while the virtual computer network is operating.

20. The non-transitory computer-readable storage medium of claim 19 wherein the forwarding of the multiple communications in accordance with the specified interconnections is performed without physically providing the one or more networking devices, and wherein the receiving of the one or more routing communications includes intercepting the one or more routing communications before the one or more routing communications are forwarded over the substrate network to the at least one networking devices.

21. The non-transitory computer-readable storage medium of claim 19 wherein the configured computing system is part of a configurable network service that provides multiple virtual computer networks to multiple remote clients using a plurality of co-located computing nodes, wherein each of the provided virtual computer networks uses a subset of multiple of the plurality of computing nodes, and wherein the configurable network service provides a programmatic interface for use by the multiple remote clients in supplying configuration information for the multiple provided virtual computer networks to the configurable network service, the information received from the client for use in configuring the provided virtual computer network for the client being supplied via the provided programmatic interface.

22. The non-transitory computer-readable storage medium of claim 18 wherein the computer-readable medium is a memory of the configured computing system that stores the contents, and wherein the contents are instructions that when executed program the configured computing system to perform the method.

23. A computing system, comprising:

one or more processors; and

a manager module that is configured to, when executed by at least one of the processors, provide computer networks to one or more clients by, for each of the one or more clients;

automatically configuring a first computer network provided for the client in accordance with configuration information from the client, the configuration information indicating interconnections between multiple computing nodes of the first computer network that include one or more networking devices, the configuring of the provided first computer network including overlaying the provided first computer network on a distinct second computer network without physically providing the one or more networking devices;

forwarding multiple communications between the multiple computing nodes over the second computer network without physically providing the one or more networking devices;

receiving one or more routing communications that are each directed to at least one of the one or more networking devices and include routing information for the first computer network;

automatically identifying one or more actions to take based on the routing information included in the received one or more routing communications, the identified one or more actions to be performed on behalf of the client to whom the first computer network is provided and including at least one identified action that is unrelated to forwarding of communications between the multiple computing nodes of the first computer network;

automatically initiating the identified one or more actions; and

after the initiating the identified one or more actions, forwarding one or more additional communications to one or more of the multiple computing nodes, the forwarding performed in a manner that is not affected by the initiated at least one identified actions.

24. The computing system of claim 23 wherein, for one of the computer networks provided to one of the clients, the configuration information from the one client specifies the one or more networking devices for the one computer network, the one or more routing communications for the one computer network are received from one or more of the multiple computing nodes of the one computer network that are controlled by the one client and that send the one or more routing communications using a defined network routing protocol, the one or more routing communications for the one computer network are received after the forwarding of the multiple communications for the one computer network and include network routing information for the one computer network, and the automatic identifying one or more actions to take for the one computer network includes automatically analyzing the network routing information included in the one or more routing communications for the one computer network to identify one or more changes to make for the one computer network while the one computer network is operating that are not related to forwarding of communications between the multiple computing nodes of the one computer network, the identified one or more actions including the identified one or more changes.

25. The computing system of claim 23 wherein the one or more clients include multiple remote clients, wherein the manager module is part of a configurable network service and provides an interface for use by the multiple remote clients to configure the computer networks provided for use by the clients, wherein the multiple computing nodes of each of the provided computer networks are a subset of a plurality of computing nodes provided by the configurable network service for use with the provided computer networks, wherein the second computer network is a substrate network, and wherein the provided computer networks are each virtual computer networks overlaid on the substrate network.

26. The computing system of claim 23 wherein the manager module includes software instructions for execution by the at least one processor.

27. The computing system of claim 23 wherein the manager module consists of a means for providing computer networks to one or more clients by, for each of the one or more clients:

automatically configuring a first computer network provided for the client in accordance with configuration information from the client, the configuration information indicating interconnections between multiple computing nodes of the provided computer network that include one or more networking devices, the configuring of the provided first computer network including overlaying the provided first computer network on a distinct second computer network without physically providing the one or more networking devices;

forwarding multiple communications between the multiple computing nodes over the second computer network without physically providing the one or more networking devices;

receiving one or more routing communications that are each directed to at least one of the one or more networking devices and include routing information for the first computer network;

automatically identifying one or more actions to take based on the routing information included in the received one or more routing communications, the identified one or more actions to be performed on behalf of the client to whom the first computer network is provided and including at least one identified action that is unrelated to forwarding of communications between the multiple computing nodes of the first computer network;

automatically initiating the identified one or more actions; and

after the initiating the identified one or more actions, forwarding one or more additional communications to one or more of the multiple computing nodes, the forwarding performed in a manner that is not affected by the initiated at least one identified actions.