Using virtual networking devices to manage routing communications between connected computer networks

• US 8,370,488 B1
• Filed: 02/28/2012
• Issued: 02/05/2013
• Est. Priority Date: 12/28/2009
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Miller, Kevin Christopher, Brandwine, Eric Jason, Doane, Andrew J.
• Primary Examiner(s): DINH, KHANH Q
• Application Number:
  US13/407,726
• Time in Patent Office: 343 Days
• Field of Search: 709/203, 709/220, 709/224, 709/228
• US Class Current: 709/224
• CPC Class Codes: H04L 12/6418 Hybrid transport
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/5054 Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Techniques are described for providing managed virtual computer networks whose configured logical network topology may have one or more virtual networking devices, such as by a network-accessible configurable network service, with corresponding networking functionality provided for communications between multiple computing nodes of a virtual computer network by emulating functionality that would be provided by the networking devices if they were physically present. The networking functionality provided for a managed computer network may include supporting a connection between that managed computer network and one or more other managed computer networks, such as via a provided virtual peering router to which each of the managed computer networks may connect, with the functionality of the virtual peering router being emulated by modules of the configurable network service without physically providing the virtual peering router, including to manage routing communications between the inter-connected managed computer networks in accordance with client-specified configuration information.

Claims

1. A computer-implemented method comprising:

configuring one or more computing systems of a configurable network service to emulate functionality of a virtual peering router device, the virtual peering router device being indicated to inter-connect multiple virtual computer networks provided by the configurable network service, the configuring of the one or more computing systems being based at least in part on configuration information specified for the virtual peering router device;

receiving, by the configured one or more computing systems, information about one or more communications that are directed to the virtual peering router device from a first virtual computer network of the multiple virtual computer networks;

determining, by the configured one or more computing systems, whether to forward the one or more communications to one or more second virtual computer networks of the multiple virtual computer networks that are distinct from the first virtual computer network, the determining being based at least in part on the specified configuration information; and

if it is determined to forward the one or more communications to the one or more second virtual computer networks, initiating forwarding of the one or more communications to the one or more second virtual computer networks, and otherwise not initiating forwarding of the one or more communications to the one or more second virtual computer networks.

2. The method of claim 1 wherein the multiple virtual computer networks include one or more third virtual computer networks that are distinct from the first virtual computer network and from the one or more second virtual computer networks, and wherein the method further comprises:

determining to not forward the one or more communications to the one or more third virtual computer networks based at least in part on the specified configuration information; and

inhibiting forwarding of the one or more communications to the one or more third virtual computer networks.

3. The method of claim 2 wherein the specified configuration information includes first peering configuration information specified for the one or more second virtual computer networks that allows the one or more communications to be forwarded to the one or more second virtual computer networks, and includes second peering configuration information specified for the one or more third virtual computer networks that blocks the one or more communications from being forwarded to the one or more third virtual computer networks, and wherein the determining whether to forward the one or more communications to the one or more second virtual computer networks includes determining to forward the one or more communications to the one or more second virtual computer networks based at least in part on the first peering configuration information.

4. The method of claim 1 further comprising:

receiving, by the configured one or more computing systems, information about one or more second communications that are directed to the virtual peering router device from one of the one or more second virtual computer networks;

determining to not forward the one or more second communications to the first virtual computer network based at least in part on the specified configuration information; and

inhibiting forwarding of the one or more second communications to the first virtual computer network.

5. The method of claim 4 wherein the specified configuration information includes first peering configuration information specified for the first virtual computer network that blocks communications of one or more specified types.

6. The method of claim 1 wherein the one or more communications are routing communications that include routing information for the first virtual computer network corresponding to one or more first computing nodes of the first virtual computer network, wherein the determining whether to forward the one or more communications to the one or more second virtual computer networks includes determining to forward the one or more communications to the one or more second virtual computer networks, and wherein the initiating forwarding of the one or more communications to the one or more second virtual computer networks includes using the routing information to enable subsequent communications from one or more second computing nodes of the one or more second virtual computer networks to be sent to the one or more first computing nodes of the first virtual computer network.

7. The method of claim 1 wherein the one or more communications are routing communications that include routing information for the first virtual computer network, wherein the determining whether to forward the one or more communications to the one or more second virtual computer networks includes determining to forward the one or more communications to the one or more second virtual computer networks, and wherein the initiating forwarding of the one or more communications to the one or more second virtual computer networks includes forwarding the one or more communications to one or more second computing nodes of the one or more second virtual computer networks that participate in a routing protocol.

8. The method of claim 7 wherein the one or more communications are specified in accordance with a first routing protocol, wherein the routing protocol that the one or more second computing nodes participate in is a distinct second routing protocol, and wherein the forwarding of the one or more communications to the one or more second computing nodes includes modifying the forwarded one or more communications to be specified in accordance with the second routing protocol.

9. The method of claim 1 wherein the one or more communications are data communications that are sent from one or more first computing nodes of the first virtual computer network to one or more second computing nodes of the one or more second virtual computer networks, wherein the determining whether to forward the one or more communications to the one or more second virtual computer networks includes determining to forward the one or more communications to the one or more second virtual computer networks, and wherein the initiating forwarding of the one or more communications to the one or more second virtual computer networks includes forwarding the one or more communications to the one or more second computing nodes.

10. The method of claim 1 wherein the configuration information is specified for the virtual peering router device by a client of the configurable network service, wherein at least one of the multiple virtual computer networks are provided for the client by the configurable network service, and wherein the configuring of the one or more computing systems is performed in response to a received request from the client to create the virtual peering router device for use with the at least one virtual computer networks.

11. The method of claim 10 further comprising:

providing the at least one virtual computer networks to the client; and

establishing a logical connection between each of the provided at least one virtual computer networks and the virtual peering router device.

12. The method of claim 1 wherein the configuration information specified for the virtual peering router device indicates one or more filters to use in limiting communications that are allowed to be sent between the multiple virtual computer networks via the virtual peering router device, and wherein the determining whether to forward the one or more communications to the one or more second virtual computer networks includes determining that the one or more filters authorize the forwarding of the one or more communications to the one or more second virtual computer networks.

13. The method of claim 1 wherein the multiple virtual computer networks are overlaid on one or more substrate networks, and wherein the receiving of the information about the one or more communications includes intercepting the one or more communications before the one or more communications are forwarded over the one or more substrate networks.

14. A configured computing system, comprising:

one or more processors; and

one or more modules configured to, when executed by at least one of the one or more processors, emulate functionality of a virtual peering router that is indicated to inter-connect multiple computer networks, the emulating of the functionality including;

receiving information about one or more communications that are directed to the virtual peering router from a first computer network of the multiple computer networks;

determining whether to forward the received one or more communications to one or more second computer networks of the multiple computer networks, the determining being based at least in part on specified configuration information for the virtual peering router; and

if it is determined to forward the received one or more communications to the one or more second computer networks, initiating forwarding of the received one or more communications to the one or more second computer networks, and otherwise inhibiting forwarding of the received one or more communications to the one or more second computer networks.

15. The computing system of claim 14 wherein one or more of the multiple computer networks are each a virtual computer network that has a configured network topology that includes a logical connection to the virtual peering router.

16. A non-transitory computer-readable medium having stored contents that configure one or more computing systems to perform a method, the method comprising:

receiving, by the configured one or more computing systems, information about a communication that is directed to a virtual peering router device from a first virtual computer network, the virtual peering router device being indicated to inter-connect multiple virtual computer networks provided by a configurable network service associated with the configured computing system, the first virtual computer network being one of the multiple virtual computer networks;

determining, by the configured one or more computing systems, one or more destinations of the communication in one or more second virtual computer networks of the multiple virtual computer networks that are distinct from the first virtual computer network,

modifying, by the configured one or more computing systems, the communication to emulate functionality of the virtual peering router device without physically providing the virtual peering router device, the modified communication including information that would be added by the virtual peering router device if the virtual peering router device was physically provided and was forwarding the communication to the one or more destinations; and

initiating forwarding of the modified communication directly to the one or more destinations in the one or more second virtual computer networks.

17. The non-transitory computer-readable medium of claim 16 wherein the modifying of the communication includes modifying address information in a header of the communication so that the virtual peering router device is indicated to be a sender of the forwarded modified communication.

18. The non-transitory computer-readable medium of claim 16 wherein the modifying of the communication includes modifying network hop information in a header of the communication.

19. The non-transitory computer-readable medium of claim 16 wherein an overlap exists between first virtual network addresses used by the first virtual computer network and second virtual network addresses used by the one or more second virtual computer networks, and wherein the modifying of the communication includes translating at least one of a virtual network address of a sender of the communication and a virtual network address of at least one of the determined one or more destinations to eliminate the overlap for the modified communication.

20. The non-transitory computer-readable medium of claim 16 wherein the modifying of the communication is based at least in part on peering configuration information for use by the virtual peering router device that is specified for at least one of the first virtual computer network and the one or more second virtual computer networks.

21. The non-transitory computer-readable medium of claim 16 wherein the communication is a routing communication that includes routing information for the first virtual computer network corresponding to one or more first computing nodes of the first virtual computer network, and wherein the determined one or more destinations include one or more second computing nodes of the one or more second virtual computer networks that participate in a routing protocol.

22. The non-transitory computer-readable medium of claim 16 wherein the multiple virtual computer networks are overlaid on one or more substrate networks, and wherein the receiving of the information about the communication includes intercepting the communication before the communication is forwarded over the one or more substrate networks.

23. A configured computing system, comprising:

one or more processors; and

one or more modules configured to, when executed by at least one of the one or more processors, emulate functionality of a virtual peering router that is indicated to inter-connect multiple computer networks, the emulating of the functionality including;

receiving information about a communication that is directed to the virtual peering router from a first computer network of the multiple computer networks and is intended for one or more destinations in one or more second computer networks of the multiple computer networks that are distinct from the first computer network;

modifying the communication to include information that would be added by the virtual peering router if the virtual peering router was physically forwarding the communication to the one or more destinations; and

initiating forwarding of the modified communication to the one or more destinations in the one or more second computer networks.

24. The computing system of claim 23 wherein one or more of the multiple computer networks are provided by a configurable network service to one or more clients, and wherein the one or more modules are part of the configurable network service and include software instructions for execution by the one or more processors.

25. The computing system of claim 23 wherein one or more of the multiple computer networks are each a virtual computer network that has a configured network topology that includes a logical connection to the virtual peering router.