Using virtual networking devices to manage routing communications between connected computer networks

• US 9,137,102 B1
• Filed: 01/04/2013
• Issued: 09/15/2015
• Est. Priority Date: 12/28/2009
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Miller, Kevin Christopher, Brandwine, Eric Jason, Doane, Andrew J.
• Primary Examiner(s): DINH, KHANH Q
• Application Number:
  US13/734,789
• Time in Patent Office: 984 Days
• Field of Search: 709/207, 709/220, 709/224, 709/223, 709/227, 709/238, 370/401
• US Class Current: 1/1
• CPC Class Codes: H04L 12/6418 Hybrid transport
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/5054 Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Techniques are described for providing managed virtual computer networks whose configured logical network topology may have one or more virtual networking devices, such as by a network-accessible configurable network service, with corresponding networking functionality provided for communications between multiple computing nodes of a virtual computer network by emulating functionality that would be provided by the networking devices if they were physically present. The networking functionality provided for a managed computer network may include supporting a connection between that managed computer network and one or more other managed computer networks, such as via a provided virtual peering router to which each of the managed computer networks may connect, with the functionality of the virtual peering router being emulated by modules of the configurable network service without physically providing the virtual peering router, including to manage routing communications between the inter-connected managed computer networks in accordance with client-specified configuration information.

Claims

1. A computer-implemented method comprising:

configuring one or more computing systems of a configurable network service to emulate functionality of a virtual peering router device, the virtual peering router device being indicated to inter-connect at least first and second virtual computer networks provided by the configurable network service, wherein the configured one or more computing systems further implement at least a first computing node of the first virtual computer network, and wherein the configurable network service maintains mapping information for the first and second virtual computer networks that associates virtual network addresses of a plurality of computing nodes that are part of the first and second virtual computer networks with locations of the plurality of computing nodes in one or more substrate networks on which the first and second virtual computer networks are overlaid;

receiving, by the configured one or more computing systems, information about a communication that is directed to the virtual peering router device from the first computing node;

determining, by the configured one or more computing systems, to use routing information for the first virtual computer network that is included in the communication to update configuration information used for providing the second virtual computer network; and

updating, by the configured one or more computing systems, the configuration information used for providing the second virtual computer network based at least in part on the routing information included in the communication, wherein the updating of the configuration information includes using at least some of the mapping information.

2. The method of claim 1 wherein the routing information included in the communication identifies one or more computing nodes of the first virtual computer network, and wherein the updating of the configuration information enables communications to be forwarded from one or more second computing nodes of the second virtual computer network to the one or more computing nodes of the first virtual computer network via the virtual peering router device.

3. The method of claim 2 wherein the one or more computing nodes of the first virtual computer network include the first computing node, and wherein the method further comprises, after the updating of the configuration information:

receiving, by the configured one or more computing systems, a second communication sent to the first computing node by one of the one or more second computing nodes of the second virtual computer network; and

providing to the first computing node, by the configured one or more computing systems, the received second communication.

4. The method of claim 1 wherein the configured one or more computing systems include a first computing system, wherein the method further comprises configuring the first computing system to provide one or more virtual machines on the first computing system, and wherein the implementing of at least the first computing node includes using one of the provided virtual machines as the first computing node.

5. The method of claim 4 further comprising configuring the first computing system to implement a hypervisor monitor on the first computing system to manage the provided one or more virtual machines, and wherein the emulating of the functionality of the virtual peering router device is performed at least in part by the hypervisor monitor on the first computing system.

6. The method of claim 5 wherein the emulating of the functionality of the virtual peering router device includes, under control of the hypervisor monitor on the first computing system, performing the receiving of the information about the communication, the determining to use the routing information included in the communication, and the updating of the configuration information used for providing the second virtual computer network.

7. The method of claim 5 further comprising blocking, by the hypervisor monitor, the communication from being sent externally to the first computing system.

8. The method of claim 4 wherein the configured one or more computing systems further include one or more second computing systems that each provide at least one computing node for at least one of the first and second virtual computer networks, and wherein the emulating of the functionality of the virtual peering router device is performed in a distributed manner using the first computing system and the one or more second computing systems.

9. The method of claim 1 further comprising configuring the one or more computing systems to execute a communication manager module that manages communications for one or more computing nodes associated with the one or more computing systems, and wherein the receiving of the information about the communication, the determining to use the routing information included in the communication, and the updating of the configuration information are performed by the executing communication manager module.

10. The method of claim 1 further comprising configuring the one or more computing systems to execute a network routing manager module to manage network configuration information for the first and second virtual computer networks, and wherein the receiving of the information about the communication, the determining to use the routing information included in the communication, and the updating of the configuration information are performed by the executing network routing manager module.

11. The method of claim 1 wherein the locations of the plurality of computing nodes in the one or more substrate networks are represented in the mapping information based at least in part by using additional network addresses of the one or more substrate networks that are distinct from the virtual network addresses.

12. The method of claim 1 wherein the configuring of the one or more computing systems is based at least in part on additional configuration information specified for the virtual peering router device, and wherein the determining to use the routing information included in the communication is based at least in part on the specified additional configuration information.

13. The method of claim 1 further comprising, before the receiving of the information about the communication, receiving at least some of the configuration information from a client of the configurable network service that is associated with the second virtual computer network, and storing the received at least some configuration information for later use.

14. The method of claim 13 wherein the received at least some configuration information includes one or more specified virtual network addresses for one or more specified computing nodes.

15. The method of claim 14 wherein the one or more specified computing nodes are part of the second virtual computer network.

16. The method of claim 13 wherein the at least some of the configuration information is received via an invocation, by an executing program on behalf of the client, of an application programming interface provided by the configurable network service.

17. The method of claim 13 wherein the at least some of the configuration information is received via one or more interactions, by a human representing the client, with a graphical user interface provided by the configurable network service.

18. The method of claim 13 wherein the configuring of the one or more computing systems is performed in response to a received request from the client to create the virtual peering router device and to establish a logical connection from the second virtual computer network to the virtual peering router device, and wherein the method further comprises providing the second virtual computer network for the client, and establishing the logical connection.

19. The method of claim 1 further comprising blocking, by the configured one or more computing systems, the communication from being forwarded to any computing nodes of the first and second virtual computer networks based at least in part on the communication including the routing information.

20. The method of claim 1 further comprising forwarding the communication to one or more second computing nodes of the second virtual computer network that participate in a routing protocol.

21. The method of claim 1 further comprising:

receiving, by the configured one or more computing systems, information about a second communication that is directed to the virtual peering router device from the first computing node, the second communication being a data communication that has a final intended destination of a second computing node of the second virtual computer network; and

forwarding the second communication directly to the second computing node.

22. A non-transitory computer-readable medium having stored contents that configure one or more computing systems of a configurable network service to:

provide, by the configured one or more computing systems of the configurable network service, first functionality to implement a first computing node of a first virtual computer network provided for a customer of the configurable network service, and second emulated functionality for a virtual peering router that inter-connects the first virtual computer network with at least a second virtual computer network, wherein the configurable network service maintains mapping information for the first and second virtual computer networks that associates virtual network addresses of a plurality of computing nodes that are part of the first and second virtual computer networks with locations of the plurality of computing nodes in one or more substrate networks on which the first and second virtual computer networks are overlaid;

receive, by the configured one or more computing systems and as part of the provided second emulated functionality, information about a communication that is directed to the virtual peering router and that is sent by the first computing node as part of the providing of the first functionality;

determine, by the configured one or more computing systems, to use routing information included in the communication to update configuration information used by the configurable network service as part of providing at least one of the first and second virtual computer networks; and

update, by the configured computing system, the configuration information based at least in part on the routing information included in the communication, wherein the updating of the configuration information includes using at least some of the mapping information.

23. The non-transitory computer-readable medium of claim 22 wherein the configured one or more computing systems include a first computing system that hosts one or more virtual machines, wherein the providing of the first functionality to implement the first computing node is performed using one of the hosted virtual machines, wherein the configuring of the one or more computing systems includes configuring a hypervisor monitor on the first computing system to manage the provided one or more virtual machines and to provide the second functionality by emulating at least some functionality of the virtual peering router, and wherein the stored contents include executable software instructions.

24. A configured computing system, comprising:

one or more processors;

memory;

multiple hosted virtual machines that are each allocated a portion of the memory and a portion of computing cycles of the one or more processors; and

a hypervisor monitor that is configured to manage the multiple hosted virtual machines and to participate in emulating functionality of a virtual peering router provided by a configurable network service to inter-connect at least first and second virtual computer networks provided by the configurable network service to one or more customers of the configurable network service, wherein the configurable network service maintains mapping information for the first and second virtual computer networks that associates virtual network addresses of a plurality of computing nodes that are part of the first and second virtual computer networks with locations of the plurality of computing nodes in one or more substrate networks on which the first and second virtual computer networks are overlaid, the emulating of the functionality including;

receiving information about a communication directed to the virtual peering router from a first computing node that is part of the first virtual computer network and is implemented on one of the multiple hosted virtual machines of the configured computing system;

determining to use routing information included in the communication to update configuration information used by the configurable network service for providing at least one of the first and virtual second computer networks; and

updating the configuration information based at least in part on the routing information included in the communication, wherein the updating of the configuration information includes using at least some of the mapping information.

25. The computing system of claim 24 wherein the first and second virtual computer networks each has a configured network topology that includes a logical connection to the virtual peering router, wherein the configured computing system is one of multiple computing systems that are part of a configurable network service and that perform the emulating of the functionality of the virtual peering router in a distributed manner while also providing computing nodes of the first and second virtual computer networks, and wherein the one or more modules include executable software instructions.