Managing use of intermediate destination hardware devices for provided computer networks

• US 8,738,745 B1
• Filed: 03/31/2010
• Issued: 05/27/2014
• Est. Priority Date: 03/31/2010
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Brandwine, Eric Jason, Miller, Kevin Christopher
• Primary Examiner(s): Hussain, Tauqir
• Assistant Examiner(s): Golabbakhsh, Ebrahim
• Application Number:
  US12/752,054
• Time in Patent Office: 1,518 Days
• Field of Search: 709/224, 709/223, 709/220, 709/218
• US Class Current: 709/220
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/131 Protocols for games, networked simulations or virtual reality
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

Techniques are described for providing a managed computer network, such as for a managed virtual computer network overlaid on another substrate computer network, and including managing communications for computing nodes of the managed computer network by using one or more particular hardware devices connected to the substrate computer network to operate as a logical network node of the managed computer network that acts as an intermediate destination to provide one or more types of functionality for at least some communications that are sent by and/or directed to one or more computing nodes of the managed computer network. For example, a communication manager module associated with a source computing node for the managed computer network may determine to direct a communication from the source computing node over the substrate network to one or more substrate hardware devices that represent a particular intermediate destination network node of the managed computer network.

Claims

1. A computer-implemented method comprising:

receiving configuration information for a first virtual computer network with multiple computing nodes, the configuration information indicating a specified network topology for the first virtual computer network that includes a first network node for use in providing a specified type of functionality; and

providing, by one or more programmed computing systems, the first virtual computer network in accordance with the received configuration information by overlaying the first virtual computer network on a distinct substrate network, the overlaying of the first virtual computer network including configuring one or more devices connected to the substrate network to act as the first network node for the first virtual computer network by providing the specified type of functionality, the providing of the first virtual computer network including;

forwarding a first communication over the substrate network between computing nodes of a first group without sending the first communication to the first network node;

determining, by the one or more programmed computing systems, to use the first network node as an intermediate destination for an additional communication based at least in part on the specified network topology, wherein the additional communication is from a source computing node in the first group to a destination computing node that is not in the first group; and

after the determining, encoding the additional communication for the substrate network and initiating forwarding the encoded additional communication over the substrate network from the source computing node to a translation manager module that manages decoding of encoded communications for the configured one or more devices, to enable the configured one or more devices to manage further forwarding of the additional communication to the destination computing node in accordance with the specified type of functionality.

2. The method of claim 1 further comprising, after the forwarding of the additional communication over the substrate network, and if the configured one or more devices determine to initiate further forwarding of the additional communication to the destination computing node, performing further forwarding of the additional communication over the substrate network from the configured one or more devices to the destination computing node.

3. The method of claim 2 wherein the determining to use the first network node as the intermediate destination for the additional communication and the initiating forwarding of the encoded additional communication over the substrate network from the source computing node are performed on behalf of the source computing node by a communication manager module that manages communications for the source computing node, and wherein the further forwarding of the additional communication over the substrate network from the configured one or more devices is performed on behalf of the configured one or more devices by the translation manager module.

4. The method of claim 2 wherein the configured one or more devices includes a configured first device with multiple logical network interfaces that each has a distinct virtual network address for the first virtual computer network, a first of the multiple logical network interfaces being associated with the computing nodes of the first group, and wherein the forwarding of the encoded additional communication over the substrate network from the source computing node of the first group includes directing the encoded additional communication to the first logical network interface.

5. The method of claim 4 further comprising providing the translation manager module for use with the first logical network interface and providing a second translation manager module for use with a second logical network interface of the multiple logical network interfaces, and wherein the further forwarding of the additional communication over the substrate network from the configured one or more devices uses the second logical network interface and is performed by the second translation manager module.

6. The method of claim 1 wherein the configured one or more devices are selected from multiple configurable hardware devices connected to the substrate network, and wherein the method further comprises configuring the selected one or more devices to provide functionality of the translation manager module.

7. The method of claim 1 further comprising decoding, by the translation manager module and after the forwarding of the encoded additional communication over the substrate network, the encoded additional communication before providing the decoded additional communication to the configured one or more devices.

8. The method of claim 1 wherein the computing nodes of the first group are at least some of the multiple computing nodes of the first virtual computer network, and wherein the specified network topology further indicates that the first network node is located between the first group and a second group of one or more other computing nodes, the destination computing node being one of the other computing nodes of the second group.

9. The method of claim 7 further comprising, under control of the configured one or more devices:

receiving the provided decoded additional communication from the translation manager module;

providing the specified type of functionality for the decoded additional communication by performing processing on the decoded additional communication, the performing of the processing including providing at least one of a group of capabilities that includes firewall capabilities, intrusion detection capabilities, content analysis capabilities, network acceleration capabilities, and virtual private network (“

VPN”

) connection capabilities; and

after the providing of the specified type of functionality for the decoded additional communication, initiating further forwarding of the decoded additional communication to the destination computing node.

10. The method of claim 7 further comprising, under control of the configured one or more devices:

receiving the provided decoded additional communication from the translation manager module; and

performing the managing of the further forwarding of the additional communication to the destination computing node by determining not to further forward the additional communication to the destination computing node.

11. The method of claim 7 wherein the decoding of the encoded additional communication further includes adding information to the decoded additional communication to represent the first virtual computer network, the added information including one or more identifiers for a virtual local area network (“

VLAN”

) associated with the first virtual computer network.

12. The method of claim 11 wherein the configured one or more devices handle communications for multiple virtual computer networks that are overlaid on the substrate network for multiple clients and that each have a distinct VLAN identifier, and wherein the translation manager module manages a plurality of communications sent to and from the configured one or more devices over the substrate network for the multiple virtual computer networks and adds a VLAN identifier to each communication of the plurality that is specific to one of the multiple virtual computer networks from which the communication is sent.

13. The method of claim 8 wherein the specified network topology includes the first group having the multiple computing nodes of the first virtual computer network and the second group having one or more other computing nodes external to the first virtual computer network, the computing nodes of the first group being co-located at a first geographical location and the one or more other computing nodes of the second group being at one or more locations remote from the first geographical location, or the computing nodes of the first group being part of a first specified logical subnet of the first virtual computer network and the one or more other computing nodes of the second group being one or more of the multiple computing nodes that are part of a second specified logical subnet of the first virtual computer network.

14. The method of claim 1 wherein the one or more programmed computing systems are part of a configurable network service that provides the first virtual computer network to a first client and that provides multiple other virtual computer networks to multiple other clients, and wherein communications sent between the multiple computing nodes of the first virtual computer network are transmitted on the substrate network in an encoded form that uses information specific to the substrate network and that uses a specified destination substrate network address for forwarding over the substrate network.

15. A computing system, comprising:

one or more processors; and

a communication manager module that is associated with one or more computing nodes of a first virtual computer network overlaid on a second substrate network and that is configured to, when executed by at least one of the one or more processors, manage communications sent by the one or more computing nodes in accordance with specified network topology information for the first virtual computer network, by;

determining, before forwarding a first communication over the second substrate network, to use an indicated network node of the first virtual computer network as an intermediate destination for the first communication, the determining being based at least in part on the specified network topology information for the first virtual computer network;

identifying one or more devices accessible via the second substrate network for use as the indicated network node for the first virtual computer network, wherein the identified one or more devices are configured to provide a type of functionality specified for the indicated network node and have one or more associated translation manager modules to manage decoding of communications from the virtual computer network that are sent over the second substrate network to the identified one or more devices; and

initiating forwarding the first communication over the second substrate network to the one or more associated translation manager modules for the identified one or more devices, to enable the identified one or more devices to manage further handling of the first communication in accordance with the provided type of functionality before further forwarding of the first communication to an indicated final destination for the first communication.

16. The computing system of claim 15 wherein the identified one or more devices have an associated substrate network address corresponding to a location of the identified one or more devices in the second substrate network, and wherein the initiating forwarding of the first communication over the second substrate network includes directing the first communication to the associated substrate network address.

17. The computing system of claim 15 further comprising a system manager module configured to, when executed by at least one of the one or more processors:

obtain configuration information specified by a user on whose behalf the first virtual computer network is provided, the configuration information including the specified network topology for the first virtual computer network and specifying the type of functionality to be provided by the indicated network node, the specified network topology indicating that the indicated network node is located between a first group of computing nodes of the first virtual computer network and a second group of one or more other computing nodes, the first communication being sent between at least one computing node of the first group and at least one computing node of the second group; and

before the managing of the communications by the communication manager module, select the identified one or more devices from multiple devices connected to the substrate network.

18. The computing system of claim 15 further comprising the identified one or more devices, and wherein the identified one or more devices are further configured to perform the managing of the further handling of the first communication by determining not to perform further forwarding of the first communication to the indicated final destination for the first communication, the determining not to perform the further forwarding being based at least in part on the performing of the provided type of functionality for the first communication.

19. The computing system of claim 15 wherein the communication manager module includes software instructions for execution by the at least one processors of the computing system and is further configured to, before a second communication is forwarded to the second substrate network, determine to not use the indicated network node as an intermediate destination for the second communication based at least in part on the specified network topology information for the first virtual computer network.

20. The computing system of claim 15 wherein the communication manager module consists of a means for performing the managing of the communications sent by the one or more computing nodes in accordance with the specified network topology information for the first virtual computer network.

21. The computing system of claim 15 further comprising:

a first translation manager module that is associated with a first of the identified one or more devices and is configured to manage communications sent to and from the first identified device over the substrate network, wherein the first communication that is forwarded over the second substrate network is encoded in a manner specific to the substrate network and is forwarded to the first translation manager module, and wherein the first translation manager module is further configured to;

receive the forwarded encoded first communication;

decode the received encoded first communication to be formatted in a manner specific to the first virtual computer network; and

provide the decoded first communication to the first identified device to enable the first identified device to operate as the indicated network device by performing the type of functionality on the decoded first communication.

22. The computing system of claim 15 wherein the managing, by the communication manager module, of the communications sent by the one or more computing nodes further includes initiating forwarding a second communication over the second substrate network to an indicated final destination for the second communication without providing the second communication to the indicated network node as an intermediate destination.

23. A non-transitory computer-readable medium having stored contents that configure a computing system to manage communications sent by one or more computing nodes of a first virtual computer network in accordance with specified network topology information for the first virtual computer network, by:

determining, by the configured computing system and before forwarding a first communication over a second substrate network on which the first virtual computer network is overlaid, to use an indicated network node of the first virtual computer network as an intermediate destination for the first communication, the determining being based at least in part on the specified network topology information for the first virtual computer network;

identifying, by the configured computing system, one or more devices accessible via the second substrate network for use as the indicated network node for the first virtual computer network, wherein the identified one or more devices are configured to provide a type of functionality specified for the indicated network node and have one or more associated translation manager modules to manage communications for the virtual computer network that are sent over the second substrate network to the identified one or more devices; and

initiating, by the configured computing system, forwarding the first communication over the second substrate network to the one or more associated translation manager modules for the identified one or more devices, to enable the identified one or more devices to manage further handling of the first communication in accordance with the provided type of functionality before further forwarding of the first communication to an indicated final destination for the first communication.

24. The non-transitory computer-readable medium of claim 23 wherein the identified one or more devices have an associated substrate network address corresponding to a location of the identified one or more devices in the second substrate network, and wherein the initiating forwarding of the first communication over the second substrate network includes directing the first communication to the associated substrate network address.

25. The non-transitory computer-readable medium of claim 23 wherein the stored contents include software instructions that, when executed, further configure the computing system to:

obtain configuration information specified by a user on whose behalf the first virtual computer network is provided, the configuration information including the specified network topology for the first virtual computer network and specifying the type of functionality to be provided by the indicated network node; and

before the managing of the communications sent by the one or more computing nodes, select the identified one or more devices from multiple devices connected to the substrate network.

26. The non-transitory computer-readable medium of claim 25 wherein the specified network topology indicates that the indicated network node is located between a first group of computing nodes of the first virtual computer network and a second group of one or more other computing nodes, and wherein the first communication is sent between at least one computing node of the first group and at least one computing node of the second group.

27. The non-transitory computer-readable medium of claim 25 wherein the configured computing system is part of a configurable network service that provides the first virtual computer network to the user in exchange for one or more monetary fees and that provides multiple other virtual computer networks to multiple other users.

28. The non-transitory computer-readable medium of claim 25 wherein the stored contents include software instructions that, when executed, further configure the computing system to, before the initiating forwarding of the first communication, configure the identified one or more devices to provide the type of functionality specified for the indicated network node.

29. The non-transitory computer-readable medium of claim 28 wherein the configuring of the identified one or more devices enables the identified one or more devices to perform the managing of the further handling of the first communication, and wherein the managing of the further handling of the first communication includes determining not to perform further forwarding of the first communication to the indicated final destination based on the provided type of functionality.

30. The non-transitory computer-readable medium of claim 23 wherein the stored contents include software instructions that, when executed, further configure the computing system to, before a second communication from a computing node of the first virtual computer network is forwarded to the second substrate network, determine to not use the indicated network node as an intermediate destination for the second communication based at least in part on the specified network topology information for the first virtual computer network.

31. The non-transitory computer-readable medium of claim 23 wherein the managing of the communications for the virtual computer network by the one or more associated translation manager modules includes:

receiving the forwarded first communication, wherein the forwarded first communication is encoded in a manner specific to the second substrate network before it is forwarded to the one or more associated translation manager modules over the second substrate network;

decoding the received first communication and formatting the decoded first communication in a manner specific to the first virtual computer network; and

providing the formatted decoded first communication to at least one of the identified one or more devices, to enable the at least one identified device to operate as the indicated network device by performing the type of functionality on the formatted decoded first communication.

32. The non-transitory computer-readable medium of claim 23 wherein the stored contents include software instructions that, when executed, further configure the computing system to initiate forwarding a second communication for the virtual computer network over the second substrate network to an indicated final destination for the second communication without providing the second communication to the indicated network node as an intermediate destination.

33. The non-transitory computer-readable medium of claim 23 wherein the stored contents include software instructions that, when executed, further configure the computing system to provide the first virtual computer network in accordance with received configuration information by overlaying the first virtual computer network on the second substrate network, the overlaying of the first virtual computer network including configuring the identified one or more devices to act as the indicated network node for the first virtual computer network by providing the specified type of functionality.

34. The non-transitory computer-readable medium of claim 23 wherein the stored contents include software instructions that, when executed, further configure the computing system to, after the initiating forwarding of the first communication over the second substrate network, and if the identified one or more devices determine to initiate the further forwarding of the first communication to the indicated final destination, performing the further forwarding of the first communication over the second substrate network from the identified one or more devices to the indicated final destination.

35. The non-transitory computer-readable medium of claim 23 wherein the type of functionality specified for the indicated network node is at least one of a group of capabilities that includes firewall capabilities, intrusion detection capabilities, content analysis capabilities, network acceleration capabilities, and virtual private network (“

VPN”

) connection capabilities.