Managing external communications for provided computer networks

• US 9,356,860 B1
• Filed: 12/30/2013
• Issued: 05/31/2016
• Est. Priority Date: 03/03/2010
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Dickinson, Andrew B., Cohn, Daniel T.
• Primary Examiner(s): Taylor, Nicholas
• Assistant Examiner(s): Williams, Clayton R
• Application Number:
  US14/144,407
• Time in Patent Office: 883 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 45/64 using an overlay routing layer
• CPC Class Codes: H04L 45/7453 using hashing
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications
• CPC Class Codes: H04L 67/1023 based on a hash applied to IP addresses or costs
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/59 Providing operational support to end devices by off-loading in the network or by emulation, e.g. when they are unavailable
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC

Abstract

Techniques are described for providing managed computer networks. In some situations, the techniques include managing communications for computing nodes of a managed computer network by using a pool of multiple alternative intermediate destinations to forward at least some communications to other final destinations. For example, a manager module associated with a source computing node may select a particular one of multiple alternative intermediate destinations to use for one or more particular communications from the source computing node to an indicated final destination, such as based on network addresses associated with the source computing node and/or the final destination. The multiple alternative intermediate destinations may have various forms, including multiple alternative edge devices at a first location at which various computing nodes are co-located that operate to manage communications between those co-located computing nodes at the first location and other external computer systems at one or more other locations.

Claims

1. A computer-implemented method comprising:

providing, by one or more programmed computing systems, a virtual computer network;

receiving an indication of a communication directed to a destination network address from a first computing node of the virtual computer network;

selecting, by the one or more programmed computing systems and based at least in part on one or more attributes of the communication, and before sending the communication over a substrate network on which the virtual computer network is overlaid and that separates the first computing node from a final destination associated with the destination network address, an intermediate destination node for the communication from a group of multiple intermediate destination nodes connected to the substrate network, wherein the selecting of the intermediate destination node includes performing hashing, using the destination network address, on multiple substrate network addresses associated with the multiple intermediate destination nodes in order to obtain a substrate network address for the intermediate destination node to be selected; and

sending, by the one or more programmed computing systems and using the substrate network address associated with the selected intermediate destination node, the communication over the substrate network from the first computing node to the selected intermediate destination node, to enable forwarding of the communication by the selected intermediate destination node to the final destination.

2. The method of claim 1 wherein the first computing node is associated with a second network address, and wherein the performing of the hashing is further based in part on the second network address.

3. The method of claim 2 wherein the first computing node is one of multiple virtual machines hosted on a physical computing system, wherein the second network address is specific to the one virtual machine for the first computing node, and wherein the selecting of the intermediate destination node is performed by a module that executes on the physical computing system to manage communications by the multiple virtual machines.

4. The method of claim 2 wherein the first computing node is one of multiple virtual machines hosted on a physical computing system, and wherein the second network address is associated with the physical computing system.

5. The method of claim 1 wherein the performing of the hashing is further based in part on a source network address associated with the first computing node and on at least one attribute of the one or more attributes that is separate from the destination network address.

6. The method of claim 1 further comprising tracking a current load on at least one of the intermediate destination nodes of the group, and wherein the selecting of the intermediate destination node is further performed based at least in part on the tracked current load.

7. The method of claim 1 wherein the group of intermediate destination nodes includes multiple alternative intermediate destination nodes, and wherein the method further comprises, after the sending of the communication over the substrate network to the selected intermediate destination node:

receiving an indication of a second communication directed from the first computing node to the destination network address for the final destination; and

selecting a second intermediate destination node from the group that is distinct from the intermediate destination node selected for use with the communication, and sending the second communication over the substrate network to the selected second intermediate destination node, to enable spreading communications from the first computing node to the final destination across two or more of the multiple alternative intermediate destination nodes.

8. The method of claim 1 wherein the final destination is a second computing node of the virtual computer network, and wherein the destination network address is a virtual network address of the virtual computer network that is associated with the second computing node.

9. The method of claim 1 further comprising, after the sending of the communication over the substrate network to the selected intermediate destination node:

receiving an indication of a second communication from the first computing node that is directed to a second final destination, the second final destination being indicated by a second network address distinct from the destination network address;

selecting a second of the intermediate destination nodes of the group to use based at least in part on the second network address, the selected second intermediate destination node being distinct from the selected intermediate destination node for use with the communication; and

sending the second communication over the substrate network to the selected second intermediate destination node, for forwarding by the selected second intermediate destination node to the second final destination.

10. The method of claim 9 further comprising, after the sending of the communication over the substrate network to the selected intermediate destination node:

receiving an indication of a third communication from a second computing node that is directed to the destination network address, the second computing node being associated with a third network address;

selecting the second intermediate destination node to use for the third communication based at least in part on the destination network address and on the third network address; and

sending the third communication over the substrate network to the selected second intermediate destination node, for forwarding by the selected second intermediate destination node to the final destination.

11. The method of claim 1 further comprising, after the sending of the communication over the substrate network to the selected intermediate destination node:

receiving one or more indications of one or more second communications that are each from the first computing node and directed to the final destination using the destination network address;

selecting the intermediate destination node to use for each of the one or more second communications; and

sending each of the one or more second communications over the substrate network to the selected intermediate destination node, for forwarding by the selected intermediate destination node to the final destination.

12. The method of claim 1 wherein the virtual computer network includes multiple computing nodes that each has an associated substrate network address corresponding to a location of the computing node in the substrate network, and wherein the multiple computing nodes each further has an associated virtual network address for the virtual computer network that is independent from the associated substrate network address for that computing node.

13. The method of claim 1 wherein the one or more programmed computing systems are part of a configurable network service that provides the virtual computer network to a first client and that provides multiple other virtual computer networks to multiple other clients, and wherein the providing of the virtual computer network is performed in accordance with received configuration information for the virtual computer network by emulating functionality of one or more indicated networking devices of the virtual computer network without physically providing the indicated networking devices.

14. A computer-implemented method comprising:

providing, by one or more programmed computing systems, a virtual computer network;

receiving an indication of a communication directed to a destination network address from a first computing node of the virtual computer network;

selecting, by the one or more programmed computing systems and based at least in part on one or more attributes of the communication, and before sending the communication over a substrate network on which the virtual computer network is overlaid and that separates the first computing node from a final destination associated with the destination network address, an intermediate destination node for the communication from a group of intermediate destination nodes connected to the substrate network;

tracking an association of the selected intermediate destination node with a combination of the first computing node and the final destination;

sending, by the one or more programmed computing systems, the communication over the substrate network from the first computing node to the selected intermediate destination node, to enable forwarding of the communication by the selected intermediate destination node to the final destination;

receiving one or more indications of one or more second communications that are each from the first computing node and directed to the final destination using the destination network address;

selecting the intermediate destination node to use for each of the one or more second communications based on the tracked association; and

sending each of the one or more second communications over the substrate network to the selected intermediate destination node, for forwarding by the selected intermediate destination node to the final destination.

15. A computer-implemented method comprising:

providing, by one or more programmed computing systems, a virtual computer network;

receiving an indication of a communication directed to a destination network address from a first computing node of the virtual computer network;

selecting, by the one or more programmed computing systems and based at least in part on one or more attributes of the communication that include first information associated with the communication, and before sending the communication over a substrate network on which the virtual computer network is overlaid and that separates the first computing node from a final destination associated with the destination network address, an intermediate destination node for the communication from a group of intermediate destination nodes connected to the substrate network;

sending, by the one or more programmed computing systems, the communication over the substrate network from the first computing node to the selected intermediate destination node, to enable forwarding of the communication by the selected intermediate destination node to the final destination;

receiving one or more indications of one or more second communications that are each from the first computing node and directed to the final destination using the destination network address;

selecting, for each of the one or more second communications, the intermediate destination node to use for the second communication by dynamically selecting the selected intermediate destination node based on the first information also being associated with the second communication; and

sending each of the one or more second communications over the substrate network to the selected intermediate destination node, for forwarding by the selected intermediate destination node to the final destination.

16. A non-transitory computer-readable storage medium having stored contents that cause a computing system to:

select, for use in forwarding a communication from a first computing node of a virtual computer network to a final destination that is indicated by a destination network address of the communication, and before sending the communication over a substrate network separating the first computing node from the final destination, an intermediate destination from multiple alternative intermediate destinations in the substrate network based at least in part on the destination network address for the communication, wherein the substrate network is operated by a service provider that manages the virtual computer network, and wherein the selecting of the intermediate destination includes performing hashing, using the destination network address, on multiple substrate network addresses associated with the multiple alternative intermediate destinations in order to determine a substrate network address that is associated with the intermediate destination to be selected; and

send the communication over the substrate network from the first computing node to the selected intermediate destination using the determined substrate network address.

17. The non-transitory computer-readable storage medium of claim 16 wherein the selected intermediate destination is a border device connecting the substrate network operated by the service provider and a second network over which the communication travels from the border device to the final destination.

18. The non-transitory computer-readable storage medium of claim 16 wherein the stored contents further cause the computing system to, for a second communication directed to a second destination virtual network address that is associated with a second computing node, send the second communication over the substrate network to a location of the second computing node in the substrate network by using a second substrate network address associated with the second computing node and without directing the second communication to any selected intermediate destinations.

19. The non-transitory computer-readable storage medium of claim 16 wherein the stored contents include executable software instructions, wherein the first computing node is associated with a second network address, and wherein the performing of the hashing is further based in part on the second network address.

20. A computing system, comprising:

one or more hardware processors; and

a manager module that is associated with a first computing node of a first computer network having multiple computing nodes overlaid on one or more second networks and that is configured to, when executed by at least one of the one or more hardware processors, manage a communication directed by the first computing node to a destination network address by;

selecting a first intermediate destination from multiple intermediate destinations in the one or more second networks to use in forwarding the communication to a final destination associated with the destination network address, the selecting of the first intermediate destination being based at least in part on the destination network address by performing hashing, using the destination network address, on multiple substrate network addresses associated with the multiple intermediate destinations in order to obtain a substrate network address for the first intermediate destination to be selected; and

sending the communication from the first computing node over the one or more second networks to the selected first intermediate destination by using the substrate network address for the selected first intermediate destination, to enable forwarding of the communication by the selected first intermediate destination to the final destination.

21. The computing system of claim 20 wherein the manager module includes software instructions for execution by the at least one processors, wherein the first computer network is a virtual computer network and the one or more second networks are a substrate network, and wherein the selecting of the first intermediate destination occurs before the sending of the communication from the first computing node.

22. The computing system of claim 20 wherein the multiple intermediate destinations are multiple alternative intermediate destinations in the one or more second networks for the forwarding of the communication to the final destination, and wherein the manager module is further configured to manage a second communication directed by the first computing node to a second destination network address by:

determining that the second destination network address is associated with a second final destination that is not one of the multiple computing nodes, the second destination network address being distinct from the destination network address and from the second network address;

selecting a second intermediate destination from the multiple alternative intermediate destinations to use in forwarding the second communication to the second final destination, wherein the selecting of the second intermediate destination is based at least in part on the second destination network address, and wherein the first and second intermediate destinations are distinct; and

sending the second communication from the first computing node over the one or more second networks to the selected second intermediate destination using a third network address for the one or more second networks that is associated with the selected second intermediate destination.

23. The computing system of claim 20 wherein the first computing node is associated with a second network address, and wherein the performing of the hashing is further based in part on the second network address.