Establishing secure remote access to private computer networks

• US 9,374,341 B2
• Filed: 09/05/2014
• Issued: 06/21/2016
• Est. Priority Date: 12/10/2008
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Doane, Andrew J., Brandwine, Eric Jason
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Cribbs, Malcolm
• Application Number:
  US14/479,124
• Publication Number:
  US 20140380461A1
• Time in Patent Office: 655 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 61/5069 for group communication, multicast communication or broadcast communication
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display

Abstract

Techniques are described for providing users with access to computer networks, such as to enable users to interact with a remote configurable network service to create and configure computer networks that are provided by the configurable network service for use by the users. Secure private access between a computer network provided for a user by the configurable network service and one or more other remote computing systems of the user (e.g., a remote private network) may be enabled in various ways. For example, a user may programmatically invoke an API provided by the configurable network service to obtain assistance in establishing remote access from a remote location to a provided computer network of the configurable network service, such as to establish a VPN connection from the remote location to the provided computer network using hardware and/or software supplied to the remote location in response to the API invocation.

Claims

1. A computer-implemented method comprising:

providing, by a network service associated with one or more configured computing systems, an application programming interface (API) for use by remote clients of the network service to configure computer networks provided by the network service for the remote clients and to configure remote access to the provided computer networks;

receiving, by the one or more configured computing systems and from a client device of a first client of the network service, instructions provided programmatically via the API to configure a first computer network for the first client, and configuring multiple computing devices of the network service based on the instructions to cause the configured multiple computing devices to create the first computer network at the network service for the first client;

receiving, by the one or more configured computing systems and from the client device of the first client, a request that is made programmatically via the API to configure a secure connection from a first remote location of the first client to the provided first computer network at the network service; and

responding, by the one or more configured computing systems, to the received request by providing configuration information that enables one or more devices of the first client at the first remote location to establish the secure connection to the first computer network at the network service.

2. The computer-implemented method of claim 1 wherein the receiving of the request includes receiving one or more electronic communications sent over one or more intervening networks to the network service from a program executing on the client device of the first client, and wherein the executing program initiates sending of the one or more electronic communications as part of invoking the API.

3. The computer-implemented method of claim 1 wherein the configuring of the multiple computing devices of the network service includes creating, by the network service, the first computer network for use by the first client, wherein the created first computer network is a virtual computer network that includes multiple computing nodes implemented using a subset of a plurality of hardware devices provided by the network service.

4. The computer-implemented method of claim 1 further comprising:

receiving, by the one or more configured computing systems and after providing the first computer network at the network service, another request that is made programmatically via the API by the client device of the first client to modify functionality provided by the first computer network in accordance with configuration information supplied by the first client; and

responding, by the one or more configured computing systems, to the received another request by configuring the multiple computing devices to modify the functionality provided by the first computer network for the first client in accordance with the supplied configuration information.

5. The computer-implemented method of claim 1 wherein the received request further supplies information to the network service about the one or more devices of the first client at the first remote location, and wherein the method further comprises generating, by the one or more configured computing systems, the configuration information in a manner specific to the one or more devices.

6. The computer-implemented method of claim 5 wherein the supplied information about the one or more devices of the first client at the first remote location includes an identification of a router networking device that is present at the first remote location, and wherein the generating of the configuration information is performed in a manner specific to the identified router networking device to configure the identified router networking device to establish the secure connection.

7. The computer-implemented method of claim 1 wherein the providing of the configuration information includes supplying configured software to the first remote location, such that execution of the supplied configured software on the one or more devices of the first client initiates the establishing of the secure connection.

8. The computer-implemented method of claim 1 wherein the responding to the received request further includes configuring at least one computing system of the network service to interact with the one or more devices of the first client to establish the secure connection.

9. The computer-implemented method of claim 1 further comprising:

establishing the secure connection between the first computer network and the first remote location, wherein the secure connection includes a VPN (“

virtual private network”

) connection;

receiving one or more electronic communications sent via the secure connection from the first remote location to the first computer network; and

forwarding the received one or more electronic communications to one or more computing nodes of the first computer network.

10. The computer-implemented method of claim 1 wherein the providing of the configuration information includes sending an electronic response to the received request over one or more intervening networks to the one or more devices of the first client at the first remote location, the electronic response including at least some of the configuration information.

11. The computer-implemented method of claim 1 wherein the providing of the configuration information includes initiating storage of at least some of the configuration information on a portable storage medium and initiating delivery of the portable storage medium to the first remote location of the first client.

12. The computer-implemented method of claim 1 wherein the providing of the configuration information includes supplying an entity external to the network service with at least some of the configuration information, to cause the at least some configuration information to be provided to the first remote location by the external entity.

13. A non-transitory computer-readable medium having stored contents that cause one or more computing systems of a network service to:

provide, by the one or more computing systems of the network service, an application programming interface (API) for use by remote clients of the network service to initiate remote access to computer networks provided by the network service for the remote clients;

receive, by the one or more computing systems of the network service and from a client device of a first client of the network service, instructions to provide a first computer network for the first client, and configuring multiple computing devices of the network service based on the instructions to provide the first computer network at the network service;

receive, by the one or more computing systems and from the client device of the first client, a request that is made via the API to configure remote access from a first remote location to the provided first computer network at the network service; and

respond, by the one or more computing systems, to the received request by initiating providing configuration information that enables one or more devices at the first remote location to initiate establishing the remote access to the first computer network at the network service.

14. The non-transitory computer-readable medium of claim 13 wherein the API further enables the remote clients to initiate creation of the computer networks provided by the network service for the remote clients, wherein the instructions to provide the first computer network for the first client are received via invocation of the API by the client device of the first client, and wherein the stored contents further cause the one or more computing systems to respond, by the one or more computing systems, to the received instructions by creating the first computer network for use by the first client, wherein the created first computer network is a virtual computer network that includes multiple computing nodes implemented using a subset of a plurality of hardware devices provided by the network service.

15. The non-transitory computer-readable medium of claim 14 wherein the API further enables the remote clients to configure the computer networks provided by the network service for the remote clients, and wherein the stored contents further configure the one or more computing systems to:

receive, by the one or more configured computing systems, another request from the first client that is made via the API to configure functionality provided by the first computer network in accordance with configuration information supplied by the first client; and

respond, by the one or more configured computing systems, to the received another request by configuring the functionality provided by the first computer network in accordance with the supplied configuration information.

16. The non-transitory computer-readable medium of claim 13 wherein the received request further supplies information to the network service about the one or more devices at the first remote location, and wherein the stored contents include instructions that, when executed, further configure the one or more computing systems to generate the configuration information in a manner specific to the one or more devices.

17. The non-transitory computer-readable medium of claim 13 wherein the initiating providing of the configuration information includes supplying configuration information to configure one or more existing networking devices at the first remote location to interact with the network service as part of the initiating establishing of the remote access.

18. The non-transitory computer-readable medium of claim 13 wherein the initiating providing of the configuration information includes supplying configured software to the first remote location, such that execution of the supplied configured software on the one or more devices initiates interactions between the one or more devices and the network service as part of the initiating establishing of the remote access.

19. The non-transitory computer-readable medium of claim 13 wherein the remote access to be configured for the received request includes a secure connection to be established between the network service and the first remote location, and wherein the initiating providing of the configuration information includes sending an electronic response to the received request over one or more intervening networks to the one or more devices at the first remote location, the electronic response including at least some of the configuration information.

20. A system comprising:

one or more processors of one or more computing systems; and

one or more memories including instructions that, when executed by at least one of the one or more processors, cause the one or more computing system to implement a network service that provides computer networks to remote clients, the implementing of the network service including;

providing, by the one or more computing systems, an application programming interface (API) for use by the remote clients of the network service with computer networks provided by the network service for the remote clients to initiate remote access to the provided computer networks;

receiving, by the one or more computing systems and from a computing device of a first client of the network service, instructions via the API to provide a first computer network for the first client, and configuring multiple computing devices of the network service based on the instructions to provide the first computer network at the network service;

receiving, by the one or more computing systems and from the computing device of the first client, a request that is made via the API to configure a secure connection from a first remote location to the first computer network provided by the network service for the first client; and

responding, by the one or more computing systems, to the received request by initiating providing configuration information that enables one or more devices at the first remote location to initiate establishing the secure connection to the first computer network at the network service.

21. The system of claim 20 wherein the receiving of the request includes receiving one or more electronic communications sent over one or more intervening networks to the network service from a program executing on the computing device of the first client, and wherein the executing program initiates sending of the one or more electronic communications as part of invoking the API.

22. The system of claim 20 wherein the receiving of the instructions includes receiving configuration information supplied by the first client, wherein the configuring of the multiple computing devices is performed in accordance with the supplied configuration information.

23. The system of claim 22 wherein the API further enables the remote clients to initiate creation of the computer networks provided by the network service for the remote clients, and wherein the first computer network is a virtual computer network that is created by the network service in response to the received instructions.

24. The system of claim 20 wherein the initiating providing of the configuration information includes supplying configuration information to configure one or more existing networking devices at the first remote location to interact with the network service as part of the initiating establishing of the secure connection.

25. The system of claim 20 wherein the initiating providing of the configuration information includes supplying configured software to the first remote location, such that execution of the supplied configured software on the one or more devices initiates interactions between the one or more devices and the network service as part of the initiating establishing of the secure connection.

26. The system of claim 20 wherein the secure connection includes a VPN (virtual private network) connection to be established between the network service and the first remote location, and wherein the initiating providing of the configuration information includes sending an electronic response to the received request over one or more intervening networks to the one or more devices at the first remote location, the electronic response including at least some of the configuration information.