Providing virtual networking device functionality for managed computer networks

• US 9,203,747 B1
• Filed: 12/07/2009
• Issued: 12/01/2015
• Est. Priority Date: 12/07/2009
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Brandwine, Eric Jason, Miller, Kevin Christopher, Doane, Andrew J.
• Primary Examiner(s): Pezzlo, John
• Application Number:
  US12/632,678
• Time in Patent Office: 2,185 Days
• Field of Search: 370/252, 370/254, 370/386, 370/389
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/0897 by horizontal or vertical scaling of resources, or by migrating entities, e.g. virtual resources or entities
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/586 of virtual routers
• CPC Class Codes: H04L 45/64 using an overlay routing layer
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

Techniques are described for providing virtual networking functionality for managed computer networks. In some situations, a user may configure or otherwise specify a logical network topology for a managed computer network with multiple computing nodes that includes one or more virtual networking devices each associated with a specified group of the multiple computing nodes. Corresponding networking functionality may be provided for communications between the multiple computing nodes by emulating functionality that would be provided by the networking devices if they were physically present and configured to support the specified network topology. In some situations, the managed computer network is a virtual computer network overlaid on a substrate network, and the networking device functionality emulating includes receiving routing communications directed to the networking devices and using included routing information to update the specified network topology for the managed computer network.

Claims

1. A computer-implemented method comprising:

receiving, by one or more configured computing systems of a configurable network service, configuration information for a virtual computer network for a client, the configuration information indicating a network topology of the virtual computer network that includes one or more specified virtual routers of the virtual computer network interconnecting multiple computing nodes of the virtual computer network; and

providing, by the one or more configured computing systems, the virtual computer network in accordance with the configuration information by overlaying the virtual computer network on a distinct substrate network and emulating functionality of the one or more specified virtual routers by;

intercepting one or more routing communications that are each directed to at least one of the specified virtual routers and include network routing information for the virtual computer network;

updating the configuration information for the virtual computer network based on the network routing information included in the intercepted one or more routing communications; and

after the updating of the configuration information, forwarding one or more communications between the multiple computing nodes over the substrate network in accordance with the updated configuration information.

2. The method of claim 1 wherein the network topology for the virtual computer network includes two distinct logical sub-networks each having a subset of the multiple computing nodes and being separated by a first virtual router of the one or more specified virtual routers, wherein one of the one or more communications forwarded between the multiple computing nodes over the substrate network is a communication sent from a first computing node that is part of a first of the two logical sub-networks to a second computing node that is part of a second of the two logical sub-networks, and wherein the forwarding of the one communication over the substrate network from the first computing node to the second computing node includes directing the one communication to a location in the substrate network of the second computing node and modifying the one communication to emulate changes to the one communication that would be made by the first virtual router if the first virtual router was physically provided and had physically forwarded the one communication.

3. The method of claim 2 wherein the network routing information included in the intercepted one or more routing communications identifies a third computing node as being located between the two logical sub-networks in the network topology of the virtual computer network, and wherein the method further comprises forwarding an additional communication over the substrate network from the first computing node to the second computing node by directing the additional communication to a location in the substrate network of the third computing node before providing the additional communication to the second computing node, to enable the third computing node to manage the additional communication in an indicated manner.

4. The method of claim 3 wherein the third computing node is configured to act as a firewall between the two logical sub-networks that manages communications between the two logical sub-networks in the indicated manner by preventing one or more indicated types of communications from traveling between the two logical sub-networks, and wherein managing of the additional communication in the indicated manner by the third computing node includes determining to prevent the additional communication from being forwarded to the second computing node.

5. The method of claim 3 wherein the third computing node is configured to provide intrusion detection system functionality between the two logical sub-networks to manage communications between the two logical sub-networks in the indicated manner by preventing communications having one or more indicated types of contents from traveling between the two logical sub-networks, and wherein managing of the additional communication in the indicated manner by the third computing node includes determining to prevent the additional communication from being forwarded to the second computing node.

6. The method of claim 1 wherein the network topology for the virtual computer network includes first and second computing nodes that are not separated by any of the one or more specified virtual routers, and wherein the method further comprises forwarding an indicated communication over the substrate network from the first computing node to the second computing node by directing the indicated communication to a location in the substrate network of the second computing node without modifying the indicated communication to emulate any changes to the indicated communication that would be made by the one or more specified virtual routers if the one or more specified virtual routers were physically provided.

7. The method of claim 6 wherein, after the forwarding of the indicated communication over the substrate network, a third of the multiple computing nodes is configured to manage communications between a first group of one or more computing nodes and a second group of one or more other computing nodes in an indicated manner, wherein the first computing node is part of the first group and the second computing node is part of the second group, and wherein the method further comprises forwarding an additional communication over the substrate network from the first computing node to the second computing node by directing the additional communication to a location in the substrate network of the third computing node before providing the additional communication to the second computing node to enable the third computing node to manage the additional communication in the indicated manner.

8. The method of claim 6 wherein the indicated communication is forwarded over the substrate network before the updating of the configuration information, wherein the network routing information included in the intercepted one or more routing communications identifies an additional virtual router for the virtual computer network that is indicated to separate the first and second computing nodes in the network topology of the virtual computer network, and wherein the method further comprises forwarding an additional communication over the substrate network from the first computing node to the second computing node by directing the additional communication to a location in the substrate network of the second computing node and by modifying the additional communication to emulate changes to the additional communication that would be made by the additional virtual router if the additional virtual router was physically provided and had physically forwarded the additional communication.

9. The method of claim 1 wherein the providing of the virtual computer network further includes assigning multiple virtual network addresses to the multiple computing nodes for use in directing communications between the multiple computing nodes, and assigning at least one additional virtual network address to each of the one or more specified virtual routers, and wherein the one or more routing communications use a predefined network routing protocol and are each directed to one of the specified virtual routers using one or more of the at least one assigned additional virtual network addresses for the one virtual router.

10. The method of claim 1 wherein the receiving of the one or more routing communications includes intercepting the one or more routing communications before the one or more routing communications are forwarded over the substrate network, and inhibiting the forwarding of the intercepted routing communications to the at least one specified virtual router to which the intercepted routing communications are directed.

11. The method of claim 1 wherein the configurable network service provides one or more programmatic interfaces for use by clients in providing configuration information for virtual computer networks, and wherein the configuration information for the virtual computer network is received based on one or more invocations of the one or more programmatic interfaces by an executing program of the client.

12. The method of claim 11 further comprising:

forwarding multiple communications between the multiple computing nodes over the substrate network in a manner that emulates functionality that would be provided by the one or more specified virtual routers if the one or more specified virtual routers were physically provided;

after the forwarding of the multiple communications, receiving one or more additional invocations of the one or more programmatic interfaces by the executing program of the client that indicate changes to the network topology for the virtual computer network; and

while the virtual computer network is in use,

modifying the configuration information for the virtual computer network to reflect the changes to the network topology from the one or more additional invocations; and

after the modifying of the configuration information, forwarding one or more further communications between the multiple computing nodes over the substrate network in accordance with the modified configuration information.

13. The method of claim 1 wherein the configurable network service provides a plurality of computing nodes for use in provided virtual computer networks, wherein the configurable network service further provides multiple other virtual computer networks distinct from the virtual computer network to multiple other clients, and wherein each of the multiple other virtual computer networks include a distinct subset of multiple of the plurality of computing nodes.

14. The method of claim 1 wherein the multiple computing nodes are each a virtual machine hosted on one of multiple physical computing systems of the configurable network service, and wherein the providing of the virtual computer network includes configuring one or more virtual machine communication manager modules that execute on one or more of the physical computing systems to manage communications for the hosted virtual machines.

15. A non-transitory computer-readable medium having stored contents that configure a computing system to:

receive, by the configured computing system, configuration information for a virtual computer network for a client, the configuration information indicating a network topology of the virtual computer network that includes one or more specified virtual routers of the virtual computer network interconnecting multiple computing nodes of the virtual computer network; and

provide, by the configured computing system, the virtual computer network in accordance with the configuration information by overlaying the virtual computer network on a substrate network and emulating functionality of the one or more specified virtual routers by;

intercepting one or more routing communications, before the one or more routing communications are transmitted over the substrate network, that are each directed to at least one of the specified virtual routers and include network routing information for the first virtual computer network;

updating the configuration information for the virtual computer network based on the network routing information included in the intercepted one or more routing communications; and

after the updating of the configuration information, forwarding one or more communications between the multiple computing nodes over the substrate network in accordance with the updated configuration information and in a manner based on the network topology of the virtual computer network.

16. The non-transitory computer-readable medium of claim 15 wherein the network topology for the virtual computer network includes two logical sub-networks each having a subset of the multiple computing nodes and being separated by a first virtual router of the one or more specified virtual routers, and wherein one of the forwarded one or more communications is sent between computing nodes in the two logical sub-networks.

17. The non-transitory computer-readable medium of claim 16 wherein forwarding the one communication to a destination computing node in the virtual computer network includes directing the one communication to a location in the substrate network of the destination computing node and modifying the one communication to emulate changes to the one communication that would be made by the first virtual router if the first virtual router was physically provided and had physically forwarded the one communication.

18. The non-transitory computer-readable medium of claim 16 wherein the network routing information included in the intercepted one or more routing communications identifies one of the multiple computing nodes as being located between the two logical sub-networks in the network topology of the virtual computer network, and wherein forwarding the one communication to a destination computing node in the virtual computer network includes directing the one communication to a location in the substrate network of the identified one computing node before providing the one communication to the destination computing node.

19. The non-transitory computer-readable medium of claim 18 wherein the identified one computing node is configured to act as a firewall between the two logical sub-networks that prevents one or more indicated types of communications from traveling between the two logical sub-networks, and wherein the one communication is prevented by the identified one computing node from being forwarded to the destination computing node.

20. The non-transitory computer-readable medium of claim 18 wherein the identified one computing node is configured to provide intrusion detection system functionality between the two logical sub-networks to prevent communications having one or more indicated types of contents from traveling between the two logical sub-networks, and wherein the one communication is prevented by the identified one computing node from being forwarded to the destination computing node.

21. The non-transitory computer-readable medium of claim 15 wherein the providing of the virtual computer network further includes assigning one or more virtual network addresses of the virtual computer network to the one or more specified virtual routers, and wherein the one or more routing communications use a predefined network routing protocol and are each directed to at least one of the specified virtual routers using at least one of the assigned virtual network addresses.

22. The non-transitory computer-readable medium of claim 15 wherein the configured computing system is part of a configurable network service that provides one or more programmatic interfaces for use by clients in providing configuration information for virtual computer networks, and wherein the configuration information for the virtual computer network is received based on one or more invocations of the one or more programmatic interfaces by an executing program of the client.

23. The non-transitory computer-readable medium of claim 22 wherein the stored contents include executable software instructions that further configure the computing system to:

forward multiple communications between the multiple computing nodes over the substrate network in a manner that emulates functionality that would be provided by the one or more specified virtual routers if the one or more specified virtual routers were physically provided;

after the forwarding of the multiple communications, receive one or more additional invocations of the one or more programmatic interfaces that indicate changes to the network topology for the virtual computer network; and

while the virtual computer network is in use,

modify the configuration information for the virtual computer network to reflect the changes to the network topology from the one or more additional invocations; and

after the modifying of the configuration information, forward one or more further communications between the multiple computing nodes over the substrate network in accordance with the modified configuration information.

24. A system comprising:

one or more processors of one or more computing systems; and

one or more modules that are configured to, when executed by at least one of the one or more processors;

receive configuration information for a virtual computer network for a client, the configuration information indicating a network topology of the virtual computer network that includes one or more specified virtual routers of the virtual computer network interconnecting multiple computing nodes of the virtual computer network;

overlay the virtual computer network on a substrate network in accordance with the configuration information and emulate functionality of the one or more specified virtual routers;

intercept one or more routing communications, before the one or more routing communications are forwarded over the substrate network, that are each directed to at least one of the specified virtual routers and include network routing information for the virtual computer network;

update the configuration information for the virtual computer network based on the network routing information included in the intercepted one or more routing communications; and

after the updating of the configuration information, forward one or more communications between the multiple computing nodes over the substrate network in accordance with the updated configuration information.

25. The system of claim 24 wherein the network topology for the virtual computer network includes two logical sub-networks each having a subset of the multiple computing nodes and being separated by a first virtual router of the one or more specified virtual routers, and wherein one of the forwarded one or more communications is sent between computing nodes in the two logical sub-networks by directing the one communication directly to a location in the substrate network of a destination computing node for the one communication and by modifying the one communication to emulate changes to the one communication that would be made by the first virtual router if the first virtual router was physically provided and had physically forwarded the one communication.

26. The system of claim 24 wherein the network routing information included in the intercepted one or more routing communications identifies one of the multiple computing nodes as being located between the two logical sub-networks in a network topology of the virtual computer network, and wherein one of the forwarded one or more communications is sent between computing nodes in the two logical sub-networks by directing the one communication to a location in the substrate network of the identified one computing node before providing the one communication to a destination computing node for the one communication.

27. The system of claim 24 wherein the overlaying of the virtual computer network on the substrate network is performed as part of providing the virtual computer network for the client and further includes assigning one or more virtual network addresses of the virtual computer network to the one or more specified virtual routers, and wherein the one or more routing communications use a predefined network routing protocol and are each directed to at least one of the specified virtual routers using at least one of the assigned virtual network addresses.

28. The system of claim 24 wherein the one or more modules include executable software instructions and are part of a configurable network service that provides one or more programmatic interfaces for use by clients in providing configuration information for virtual computer networks, and wherein the configuration information for the virtual computer network is received based on one or more invocations of the one or more programmatic interfaces by an executing program of the client.