Techniques for accessing logical networks via a programmatic service call

• US 8,819,229 B1
• Filed: 10/04/2011
• Issued: 08/26/2014
• Est. Priority Date: 10/04/2011
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Hegg, Joel C., Furr, Michael B., Miller, Kevin C., Schultze, Eric W., Doane, Andrew J.
• Primary Examiner(s): Whipple, Brian P
• Assistant Examiner(s): EDWARDS, JAMES A
• Application Number:
  US13/252,604
• Time in Patent Office: 1,057 Days
• Field of Search: 709/225
• US Class Current: 709/225
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Disclosed are various embodiments for configuring logical networks. A client makes a request, through a service call, for creation of a logical network, including a logical network gateway and accounts for users to access the logical network gateway. In response to the service call, the logical network is created and configured, and a confirmation is provided to the client.

Claims

1. A non-transitory computer-readable medium embodying a program executable in a computing device, the program comprising:

code that creates, upon receiving a first service call in at least one computing device, a data structure describing a logical network gateway;

code that transmits, in response to the first service call, a handle for the logical network gateway;

code that creates, upon receiving a second service call in the at least one computing device, a data structure describing a plurality of clients of the logical network gateway, the second service call received after the first service call;

code that transmits, in response to the second service call, a handle for the clients;

code that creates, upon receiving a third service call in the at least one computing device, a data structure describing a plurality of permissions associated with the clients, the third service call received after the second service call;

code that transmits, in response to the third service call, a handle for the permissions associated with the clients;

code that creates, upon receiving a fourth service call in the at least one computing device, a data structure describing an accounting of usage of the logical network gateway by the clients, the fourth service call received after the third service call;

code that transmits, in response to the fourth service call, a handle for the accounting of usage of the logical network gateway by the clients;

code that programmatically configures, upon receiving a fifth service call in the at least one computing device, a logical network that includes the logical network gateway, the clients, the permissions associated with the clients and the accounting of usage of the logical network gateway by the clients, the fifth service call received after the fourth service call; and

code that transmits, in response to the fifth service call, configuration data associated with a client device establishing a connection with the logical network gateway.

2. The non-transitory computer-readable medium of claim 1, wherein the logical network gateway further comprises a plurality of logical network gateways organized in a distributed computing configuration.

3. A system, comprising:

at least one computing device; and

a logical network configuration manager executable in the at least one computing device, the logical network configuration manager comprising;

logic that creates, upon receiving a first service call, a logical network gateway;

logic that creates, upon receiving a second service call received after the first service call, a plurality of client accounts, individual ones of the plurality of client accounts associated with respective ones of a plurality of clients;

logic that sends confirmation data corresponding to the creation of the plurality of client accounts in response to the second service call;

logic that creates, upon receiving a third service call received after the second service call, a plurality of permissions, individual ones of the plurality of permissions associated with the respective ones of the plurality of client accounts;

logic that creates, upon receiving a fourth service call received after the third service call, a plurality of accountings of usage of the logical network gateway, individual ones of the plurality of accountings of usage associated with the respective ones of the plurality of client accounts;

logic that programmatically creates, upon receiving a fifth service call received after the fourth service call, a logical network comprising a logical network gateway and the plurality of client accounts associated with the logical network gateway; and

logic that sends confirmation data associated with creation of the logical network in response to the fifth service call.

4. The system of claim 3, wherein the logical network gateway further comprises a plurality of logical network gateways arranged in a distributed computing configuration.

5. The system of claim 3, wherein the plurality of client accounts associated with the logical network gateway are used to further establish a connection with the logical network gateway from a plurality of network addresses.

6. The system of claim 3, wherein the logical network gateway facilitates communication between a client device and at least one logical network.

7. The system of claim 3, wherein the plurality of client accounts associated with the logical network gateway are stored in at least one computing device within the logical network.

8. The system of claim 3, further comprising a logical network user manager executable in the at least one computing device, the logical network user manager comprising:

logic that associates the plurality of client accounts with the logical network gateway upon receiving the second service call; and

logic that sends, in response to the second service call, confirmation data corresponding to the association of the plurality of client accounts with the logical network gateway.

9. The system of claim 3, wherein the logical network further comprises the plurality of permissions.

10. The system of claim 3, wherein the individual ones of the plurality of permissions further comprise permissions granting, to the respective ones of the plurality of client accounts, network access to a plurality of network address destinations.

11. The system of claim 3, wherein the individual ones of the plurality of permissions further comprise limiting network access of the respective ones of the plurality of client accounts from a plurality of network address destinations.

12. The system of claim 3, wherein an individual one of the plurality of accountings of usage comprises at least one of a connection time, a bandwidth used, and a number of logical network tunnels established.

13. The system of claim 12, wherein the plurality of accountings of usage is stored on at least one computing device within the logical network.

14. The system of claim 12, wherein the plurality of accountings of usage is stored on the at least one computing device.

15. A method, comprising the:

creating, upon receiving a first service call in at least one computing device, a logical network gateway;

creating, upon receiving a second service call in the at least one computing device, a plurality of client accounts, individual ones of the plurality of client accounts associated with respective ones of a plurality of clients, the second service call received after the first service call;

transmitting, in response to the second service call and to the at least one computing device, confirmation data corresponding to the creation of the plurality of client accounts;

creating, upon receiving a third service call in the at least one computing device, a plurality of permissions, individual ones of the plurality of permissions associated with the respective ones of the plurality of client accounts, the third service call received after the second service call;

creating, upon receiving a fourth service call in the at least one computing device, a plurality of accountings of usage, individual ones of the plurality of accountings of usage associated with the respective ones of the plurality of client accounts, the fourth service call received after the third service call;

creating, upon receiving a fifth service call in the at least one computing device, a programmatic configuration of a logical network comprising the logical network gateway, the plurality of client accounts, and the plurality of accountings of usage, the fifth service called received after the fourth service call; and

transmitting, in response to the fifth service call to the at least one computing device, configuration data associated with a client device establishing a connection with the logical network gateway.

16. The method of claim 15, wherein the logical network gateway further comprises a plurality of logical network gateways arranged in a distributed computing configuration.

17. The method of claim 15, wherein the logical network further comprises at least one computing device within the logical network.

18. The method of claim 15, wherein an individual one of the plurality of client accounts further comprises data defining membership in at least one client group associated with the logical network gateway.

19. The method of claim 18, wherein the individual one of the plurality of client accounts and the at least one client group are stored on at least one computing device within the logical network.

20. The method of claim 18, wherein the plurality of client accounts and the at least one client group are stored in the at least one computing device.

21. The method of claim 15, wherein the individual ones of the plurality of permissions further comprise permissions granting to the respective ones of the plurality of client accounts network access to a plurality of network address destinations.

22. The method of claim 15, wherein the individual ones of the plurality of permissions further comprise limiting network access of the respective ones of the plurality of client accounts from a plurality of network address destinations.

23. A system, comprising:

at least one computing device; and

a logical network gateway service executable in the at least one computing device, the logical network gateway service comprising;

logic that creates a data structure describing a logical network gateway upon receiving a first service call;

logic that creates a data structure describing a plurality of clients of the logical network gateway upon receiving a second service call after the first service call;

logic that creates a data structure describing a plurality of permissions upon receiving a third service call after the second service call, individual ones of the plurality of permissions associated with respective ones of the plurality of clients;

logic that creates a data structure describing a plurality of accountings of usage of the logical network gateway upon receiving a fourth service call after the third service call, individual ones of the plurality of accountings of usage associated with respective ones of the plurality of clients; and

logic that automatically creates a logical network upon receiving a fifth service call after the fourth service call, wherein the logical network comprises the logical network gateway, the plurality of clients, the plurality of permissions and the plurality of accountings of usage.

24. The system of claim 23, wherein the logical network gateway further comprises a plurality of logical network gateways arranged in a distributed computing configuration.

25. The system of claim 23, wherein the logical network gateway service further comprises logic that provides an interface to facilitate a creation and a configuration of the logical network.

26. The system of claim 23, wherein the individual ones of the plurality of permissions further comprise permissions granting to the respective ones of the plurality of clients network access to a plurality of network address destinations.