Providing private access to network-accessible services

• US 9,654,340 B2
• Filed: 06/02/2014
• Issued: 05/16/2017
• Est. Priority Date: 09/30/2010
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Gabrielson, Jacob, Hansen, Zachary J., Lye, Diane N.
• Primary Examiner(s): KIM, EDWARD J
• Application Number:
  US14/293,957
• Publication Number:
  US 20140280810A1
• Time in Patent Office: 1,079 Days
• Field of Search: 709220, 709225, 709227, 709228, 709238, 709245, 709250
• CPC Class Codes: G06F 16/1824 implemented using Network-attached Storage [NAS] architecture distributed or networked storage systems G06F3/067; protocols for distributed storage of data in a network H04L67/1097
• CPC Class Codes: G06F 16/282 Hierarchical databases, e.g. IMS, LDAP data stores or Lotus Notes
• CPC Class Codes: H04L 12/6418 Hybrid transport
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/5051 Service on demand, e.g. definition and deployment of services in real time
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Techniques are described for managing communications for a managed virtual computer network overlaid on a distinct substrate computer network. The techniques may be used in situations in which a configurable network service provides managed virtual computer networks for clients and also provides one or more network-accessible services that are available to the managed virtual computer networks, with particular managed virtual computer networks being configured to provide local private access to at least one of the provided network-accessible services, despite those provided network-accessible services being located externally to the particular managed virtual computer networks. In some situations, a Lightweight Directory Access Protocol (“LDAP”) network-accessible service is provided, and a logical endpoint for the LDAP service is created within a managed virtual computer network to enable the multiple computing nodes of the managed virtual computer network to communicate with one or more LDAP computer servers from the LDAP service.

Claims

1. A computer-implemented method comprising:

providing, by one or more computing systems of a configurable network service, a virtual computer network having multiple computing nodes for use by a customer of the configurable network service, the providing including assigning one of a plurality of virtual network addresses for the virtual computer network to represent a Lightweight Directory Access Protocol (“

LDAP”

) service that is made available by the configurable network service externally to the virtual computer network; and

initiating, by the one or more computing systems and for a communication that is sent by one of the multiple computing nodes to the assigned virtual network address for the LDAP service, providing functionality of the LDAP service to the virtual computer network by encoding the communication in a manner specific to a substrate network on which the virtual computer network is overlaid, and by forwarding the encoded communication over the substrate network to at least one LDAP computer server of the LDAP service that is external to the virtual computer network.

2. The computer-implemented method of claim 1 further comprising:

associating, by the one or more computing systems, some of the plurality of virtual network addresses with the multiple computing nodes, wherein each of the multiple computing nodes has an associated virtual network address distinct from the assigned virtual network address for the LDAP service; and

encoding, by the one or more computing systems, and for a second communication that is sent by one of the multiple computing nodes to a virtual network address associated with another of the multiple computing nodes, the second communication in a manner specific to the substrate network, and forwarding the encoded second communication over the substrate network to a location of the another computing node within the substrate network.

3. The computer-implemented method of claim 1 wherein the LDAP service includes a plurality of computer servers, wherein the method further comprises selecting for use with the virtual computer network a pool having one or more computer servers that are a subset of the plurality of computer servers, and wherein the at least one LDAP computer server to which the encoded communication is forwarded is from the selected pool.

4. The computer-implemented method of claim 3 wherein the configurable network service further provides multiple other virtual computer networks to multiple other clients, wherein one or more of the multiple other virtual computer networks each integrates the LDAP service within that virtual computer network, and wherein the method further comprises selecting a pool of one or more of the plurality of computer servers for use with each of the one or more other virtual computer networks, the selected pools for the one or more other virtual computer networks and for the virtual computer network having distinct computer servers of the LDAP service.

5. The computer-implemented method of claim 3 wherein the one or more computer servers of the pool are each connected to the substrate network and are distinct from the multiple computing nodes of the virtual computer network.

6. The computer-implemented method of claim 3 wherein the pool includes multiple of the plurality of computer servers of the LDAP service, and wherein the initiating providing of the functionality of the LDAP service for the communication includes selecting one of the multiple computer servers of the pool to which the encoded communication is forwarded.

7. The computer-implemented method of claim 6 wherein the multiple computer servers are alternatives, and wherein the selecting of one of the multiple computer servers of the pool to which the encoded communication is forwarded is based at least in part on a computing load of one or more of the multiple computer servers to enable load balancing capabilities to be provided for the multiple computer servers.

8. The computer-implemented method of claim 3 wherein the LDAP service is provided by the configurable network service, wherein the pool includes multiple of the plurality of computer servers of the LDAP service, and wherein the method further comprises selecting one of the multiple computer servers of the pool to operate as a master server that has one or more replica servers by using a consensus algorithm to enable the multiple computer servers of the pool to select the master server in a distributed manner.

9. The computer-implemented method of claim 8 wherein the selecting of the one computer server of the pool to operate as the master server is performed in response to an automated modification by the configurable network service of the computer servers that are included in the pool.

10. The computer-implemented method of claim 9 wherein the automated modification of the computer servers that are included in the pool includes replacing, by the configurable network service, at least one of the computer servers in the pool with another computer server in response to the at least one replaced computer server becoming unavailable.

11. The computer-implemented method of claim 8 further comprising, under control of one or more of the multiple computer servers of the pool, receiving the forwarded encoded communication, modifying information stored for the virtual computer network by the master server in response to the received forwarded encoded communication, and updating the one or more replica servers to include the modified stored information in order to maintain the one or more replica servers as copies of the master server.

12. The computer-implemented method of claim 3 further comprising scaling, by the configurable network service and while the virtual computer network is operating, a quantity of the computer servers that are included in the pool for use with the virtual computer network based at least in part on use of the LDAP service by the virtual computer network.

13. The computer-implemented method of claim 1 further comprising:

receiving, by the one or more computing systems, configuration information from the customer for the virtual computer network, the received configuration information including an indication to provide functionality of the LDAP service within the virtual computer network; and

creating, by the one or more computing systems and in response to the received configuration information, the virtual computer network for use by the customer, wherein the multiple computing nodes of the created virtual computer network are provided using computing systems of the configurable network service.

14. A non-transitory computer-readable medium having stored contents that cause a computing system of a configurable network service to:

provide, by the computing system, a virtual computer network having multiple computing nodes for use by a client, the providing including assigning one of a plurality of virtual network addresses for the virtual computer network to represent a network-accessible service provided by the configurable network service external to the virtual computer network, to enable use by the multiple computing nodes of the network-accessible service; and

initiate, by the computing system and for a communication directed to the assigned virtual network address for the network-accessible service, providing functionality of the network-accessible service to the virtual computer network by encoding the communication in a manner specific to a substrate network, and by forwarding the encoded communication over the substrate network to at least one computer server of the network-accessible service that is not part of the virtual computer network.

15. The non-transitory computer-readable medium of claim 14 wherein the network-accessible service provided by the configurable network service is a Lightweight Directory Access Protocol (“

LDAP”

) service, and wherein the at least one computer server includes one or more LDAP computer servers external to the virtual computer network.

16. The non-transitory computer-readable medium of claim 15 wherein the stored contents include software instructions that, when executed, further configure the computing system to obtain configuration information from the client for the virtual computer network that includes a specified network topology and includes information regarding use of the LDAP service by the virtual computer network, and wherein the providing of the virtual computer network includes creating, by the computing system, the virtual computer network for the client based on the configuration information, and emulating the specified network topology for the virtual computer network by overlaying the virtual computer network on the substrate network without physically implementing the specified network topology and by managing communications for the virtual computer network in a manner that reflects the specified network topology.

17. The non-transitory computer-readable medium of claim 16 wherein the stored contents further include software instructions that, when executed, further configure the computing system to encode in a manner specific to the substrate network a second communication sent by one of the multiple computing nodes to a virtual network address associated with another of the multiple computing nodes, and to forward the encoded second communication over the substrate network to a location of the another computing node within the substrate network, and wherein the computer-readable medium is a memory of the computing system.

18. A system, comprising:

one or more hardware processors of one or more computing systems; and

one or more memories with stored instructions that, when executed by at least one of the one or more hardware processors, cause the at least one hardware processor to provide for a client a virtual computer network that is overlaid on a distinct substrate network and that has a plurality of virtual network addresses for use with multiple computing nodes of the virtual computer network, the providing of the virtual computer network including;

assigning one of the plurality of virtual network addresses to represent one or more Lightweight Directory Access Protocol (“

LDAP”

) computer servers that are available externally to the virtual computer network, to enable functionality of the one or more LDAP computer servers to be accessible within the virtual computer network to the multiple computing nodes;

encoding, in a manner specific to the substrate network, a first network communication directed to a destination that is one of the multiple computing nodes and is specified using one of the plurality of virtual network addresses other than the assigned virtual network address, and sending the encoded first network communication to the substrate network for forwarding to the destination one computing node; and

encoding, in a manner specific to the substrate network, a second network communication directed to the assigned virtual network address by one of the multiple computing nodes, and sending the encoded second network communication to the substrate network for forwarding to the one or more LDAP computer servers.

19. The system of claim 18 wherein the stored instructions and the one or more computing systems are part of a configurable network service that provides multiple virtual computer networks to multiple customers, wherein the stored instructions further cause the at least one hardware processors to obtain configuration information from the client for the virtual computer network that indicates use of the LDAP computer servers by the virtual computer network, and wherein the providing of the virtual computer network includes creating the virtual computer network for the client based on the configuration information and by using computing devices that are provided by the configurable network service.

20. The system of claim 19 wherein the one or more LDAP computer servers are a subset of a plurality of LDAP computer servers of an LDAP service provided by the configurable network service, and wherein the sending of the second network communication to the LDAP computer server includes selecting the one or more LDAP computer servers from the plurality of LDAP computer servers based at least in part on information associated with the second network communication.