Adaptive resolution of domain name requests in virtual private cloud network environments

• US 10,033,691 B1
• Filed: 08/24/2016
• Issued: 07/24/2018
• Est. Priority Date: 08/24/2016
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Mizik, Andrey, Zen, Lee-Ming, McCullagh, Gavin Derek, Santoso, Yohanes, Meleshuk, Vadim, Gu, Yu, Lai, Minli, Mistrianu, Ivan, Weiss, Rebecca Claire, Chen, Yi Cheng, Hoskinson, Ronald Andrew
• Primary Examiner(s): Wang, Liangche A
• Application Number:
  US15/245,847
• Time in Patent Office: 699 Days
• Field of Search: 709217, 709218, 709219, 709245, 709247
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/445 Program loading or initiating bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 49/354 for supporting virtual local area networks [VLAN]
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Systems and methods are described to enable adaptive handling of domain resolution requests originating from a virtual private cloud (VPC) networking environment. An administrator of the VPC can provide a set of rules specific to the VPC that designates how requests for a domain name should be handled. The rules may specify, for example, that a request for a given domain name should be routed to a particular domain name server, which may include a private domain name server, should be dropped, or should be routed according to a default behavior (e.g., a public domain name system). Resolution requests originating in the VPC can be associated with a VPC identifier. When an adaptive resolution system receives the request, it can retrieve rules associated with the VPC identifier, and apply the rules to determine further routing for the request.

Claims

1. A system for adaptive resolution of domain name system (DNS) requests obtained from devices of a virtual private cloud network environment (VPC), wherein the VPC includes one or more virtual computing devices arranged within a virtualized local area network, the virtualized local area network generated by a substrate network hosting the VPC, the system comprising:

a non-transitory data store including data identifying one or more rules designated by an administrator of the VPC for handling requests, the requests obtained from devices of the VPC, to resolve domain names into corresponding network addresses, wherein the one or more rules are separate from other rules associated with other VPCs;

at least one computing device configured with computer-executable instructions that, when executed, cause the at least one computing device to;

obtain a request from a virtual computing device of the VPC to resolve a domain name into a corresponding network address;

determine, from a VPC identifier of the request, that the request originates within the VPC;

apply the one or more rules to the request to determine a resolution server, designated within the one or more rules, to which the request should be forwarded, wherein the resolution server designated within the one or more rules is a private DNS server implemented within the VPC;

forward the request to the resolution server designated within the one or more rules;

obtain the corresponding network address in response to the request; and

return the corresponding network address to the virtual computing device in fulfillment of the request.

2. The system of claim 1, wherein the private DNS server is identified within the one or more rules by at least one of a network address or an identifier associated with the VPC.

3. The system of claim 1, wherein the computer-executable instructions further cause the at least one computing device to:

obtain a second request from the virtual computing device of the VPC to resolve a second domain name into a corresponding second network address;

determine, from a VPC identifier of the second request, that the second request originates within the VPC;

determine, from the one or more rules, that the second request should not be further routed; and

halt further routing of the second request.

4. A computer-implemented method for adaptive handling of domain names resolution requests obtained from devices of a virtual private cloud network environment (VPC), wherein the VPC includes one or more computing devices arranged within a virtualized local area network, the virtualized local area network generated by a substrate network hosting the VPC, the computer-implemented method comprising:

obtaining, from an administrator of the VPC, one or more rules for handling requests to resolve domain names into corresponding network addresses, wherein the one or more rules are separate from other rules associated with other VPCs, and wherein the requests are obtained from devices of the VPC;

obtaining a request from a computing device of the VPC to resolve a domain name into a corresponding network address;

determining, from a VPC identifier of the request, that the request originates within the VPC;

applying the one or more rules to the request to determine a resolution server, designated within the one or more rules, to which the request should be forwarded, wherein the resolution server designated within the one or more rules is a private DNS server implemented within the VPC;

forwarding the request to the resolution server designated within the one or more rules;

obtain the corresponding network address in response to the request; and

return the corresponding network address to the computing device in fulfillment of the request.

5. The computer-implemented method of claim 4 further comprising, prior to forwarding the request to the resolution server designated within the one or more rules, modifying the request to cause a response to the request to be returned to the computing device.

6. The computer-implemented method of claim 4, wherein the request is formatted according to the domain name system (DNS) protocol.

7. The computer-implemented method of claim 4, wherein the resolution server is a default resolution server associated with the VPC, and wherein the one or more rules designate the resolution server by reference to the default resolution server.

8. The computer-implemented method of claim 4, wherein obtaining the request from the computing device of the VPC to resolve the domain name into the corresponding network address comprises obtaining the request in an encapsulated form, and decapsulating the request.

9. The computer-implemented method of claim 8 further comprising extracting the VPC identifier from metadata associated with the encapsulated form.

10. The computer-implemented method of claim 4 further comprising:

obtaining a second request from the computing device of the VPC to resolve a second domain name into a corresponding second network address;

determining, from a VPC identifier of the second request, that the second request originates within the VPC;

determining, from the one or more rules, that the second request should not be further routed; and

halting further routing of the second request.

11. Non-transitory computer readable media including computer-executable instructions for adaptive handling of domain names resolution requests obtained from devices of a virtual private cloud network environment (VPC), wherein the VPC includes one or more computing devices arranged within a virtualized local area network, the virtualized local area network generated by a substrate network hosting the VPC, wherein the computer-executable instructions, when executed by a computing system, cause the computing system to:

obtain one or more rules for handling requests to resolve domain names into corresponding network addresses, wherein the one or more rules are separate from other rules associated with other VPCs, and wherein the requests are obtained from devices of the VPC;

obtain a request from a first computing device of the VPC to resolve a domain name into a corresponding network address;

determine, from a VPC identifier of the request, that the request originates within the VPC;

apply the one or more rules to the request to determine a resolution server, designated within the one or more rules, to which the request should be forwarded, wherein the resolution server designated within the one or more rules is a private DNS server implemented within the VPC; and

route the request to the resolution server determined from application of the one or more rules;

obtain the corresponding network address in response to the request; and

return the corresponding network address to the computing device in fulfillment of the request.

12. The non-transitory computer readable media of claim 11, wherein the computer-executable instructions further cause the computing system to determine the VPC identifier from a flag field of the request.

13. The non-transitory computer readable media of claim 11, wherein the computer-executable instructions further cause the computing system to:

obtain a modification to the one or more rules, the modification provided by the administrator of the VPC; and

update the one or more rules according to the modification.

14. The non-transitory computer readable media of claim 11, wherein at least one rule of the one or more rules references another rules associated with another VPC.

15. The non-transitory computer readable media of claim 11, wherein determining the resolution server, designated within the one or more rules, to which the request should be forwarded further includes determining a domain name system (DNS) forwarding type to utilize in further routing of the request.

16. The non-transitory computer readable media of claim 11, the request is obtained in an encapsulated form, and wherein the computer-executable instructions further cause the computing system to decapsulate the request.