Managing use of intermediate destination hardware devices for provided computer networks

• US 10,084,851 B1
• Filed: 04/16/2014
• Issued: 09/25/2018
• Est. Priority Date: 03/31/2010
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Brandwine, Eric Jason, Miller, Kevin Christopher
• Primary Examiner(s): Doan, Duyen My
• Application Number:
  US14/254,780
• Time in Patent Office: 1,623 Days
• Field of Search: 709218, 709220, 709223, 709224
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/131 Protocols for games, networked simulations or virtual reality
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

Techniques are described for providing a managed computer network, such as for a managed virtual computer network overlaid on another substrate computer network, and including managing communications for computing nodes of the managed computer network by using one or more particular hardware devices connected to the substrate computer network to operate as a logical network node of the managed computer network that acts as an intermediate destination to provide one or more types of functionality for at least some communications that are sent by and/or directed to one or more computing nodes of the managed computer network. For example, a communication manager module associated with a source computing node for the managed computer network may determine to direct a communication from the source computing node over the substrate network to one or more substrate hardware devices that represent a particular intermediate destination network node of the managed computer network.

Claims

1. A computer-implemented method comprising:

configuring, by a computing system of an online service, and for a virtual computer network provided by the online service and having multiple computing nodes accessible via a substrate network on which the virtual computer network is overlaid, multiple devices in the substrate network that are provided by the online service, including storing virtual network addresses of the virtual computer network and causing each device to use the stored virtual network addresses to provide a specified type of functionality for communications sent between the multiple computing nodes of the virtual computer network;

selecting, by the computing system, and to provide load balancing for the configured multiple devices in a manner that is based at least in part on specified configuration information for the virtual computer network, one of the configured multiple devices to use as an intermediate destination for a communication that is sent from one of the multiple computing nodes of the virtual computer network and that indicates one of the virtual network addresses as a final destination;

modifying the communication to include encoded information specific to the substrate network, and forwarding the modified communication over the substrate network to the selected one configured device;

after the forwarding of the modified communication over the substrate network, further modifying the communication to remove the included encoded information specific to the substrate network, and providing the further modified communication to the selected one configured device for further handling; and

providing, by the selected one configured device acting as the intermediate destination and using the stored virtual network addresses of the virtual computer network, the specified type of functionality for the further modified communication before forwarding the further modified communication to the final destination.

2. The computer-implemented method of claim 1 wherein the selected one configured device is a virtual networking device and has an associated substrate network address corresponding to a location of the selected one configured device in the substrate network, and wherein the forwarding of the modified communication over the substrate network includes directing the modified communication to the associated substrate network address.

3. The computer-implemented method of claim 1 wherein the specified configuration information includes network topology information for the virtual computer network that is specified by a user and that specifies a node of the virtual computer network separating one or more of the multiple computing nodes from one or more other nodes, and wherein the selecting of the one configured device as the intermediate destination for the communication includes determining to use the selected one configured device as the specified node.

4. The computer-implemented method of claim 3 wherein the specified configuration information further indicates the specified type of functionality, and wherein the selecting of the one configured device is based at least in part on a current load of each of the multiple configured devices.

5. The computer-implemented method of claim 3 wherein the network topology information indicates that the specified node of the virtual computer network is located between a first group of computing nodes of the virtual computer network and a second group of one or more other computing nodes, and wherein the communication is sent between at least one computing node of the first group and at least one computing node of the second group.

6. The computer-implemented method of claim 4 wherein the online service further provides multiple other virtual computer networks to multiple other users.

7. The computer-implemented method of claim 1 wherein the providing of the specified type of functionality by the selected one configured device includes determining to not perform further forwarding of the further modified communication to the final destination.

8. The computer-implemented method of claim 1 further comprising, before a second communication of the virtual computer network is forwarded over the substrate network, determining to not use the selected one configured device as an intermediate destination for the second communication based at least in part on the specified configuration information for the virtual computer network.

9. The computer-implemented method of claim 1 further comprising:

before the forwarding of the modified communication over the substrate network, configuring a translation manager module to support the selected one configured device;

receiving, by the configured translation manager module, the forwarded modified communication;

decoding, by the configured translation manager module, the received communication and formatting the decoded communication in a manner specific to the virtual computer network; and

providing, by the configured translation manager module, the formatted decoded communication to the selected one configured device, to cause the selected one configured device to manage communications formatted in the manner specific to the virtual computer network.

10. The computer-implemented method of claim 1 further comprising providing, by the computing system of the online service, the virtual computer network in accordance with the specified configuration information by overlaying the virtual computer network on the substrate network, including configuring the selected one configured device to act as a network node for the virtual computer network by providing the specified type of functionality.

11. The computer-implemented method of claim 1 further comprising, after the providing of the further modified communication to the selected one configured device and if the selected one configured device determines to initiate further forwarding of the further modified communication to the final destination, performing the further forwarding of the further modified communication over the substrate network from the selected one configured device to the final destination.

12. The computer-implemented method of claim 1 wherein the specified type of functionality is at least one of firewall capabilities, intrusion detection capabilities, content analysis capabilities, network acceleration capabilities, or virtual private network (“

VPN”

) connection capabilities.

13. A non-transitory computer-readable medium having stored contents that cause a computing system of an online service to at least:

configure, by the computing system and for a virtual computer network provided by the online service to have multiple computing nodes accessible via a distinct substrate network on which the virtual computer network is overlaid, multiple devices in the substrate network that are provided by the online service, including storing information specific to the virtual computer network and causing each device to use the stored information to provide a specified type of functionality for communications of the virtual computer network;

select, by the computing system as part of providing load balancing for the configured multiple devices and based at least in part on specified network topology information for the virtual computer network, to use one of the configured multiple devices as an intermediate destination for a communication sent from one of the multiple computing nodes of the virtual computer network to a final destination indicated with a virtual network address for another of the multiple computing nodes;

modify the communication to include one or more substrate network addresses that are specific to the substrate network and separate from the virtual network addresses for the virtual computer network, and use the one or more substrate network addresses to forward the modified communication over the substrate network to the selected one configured device;

after the forwarding of the modified communication over the substrate network to the selected one configured device, further modify the communication to remove the included substrate network addresses, and provide the further modified communication to the selected one configured device for further handling; and

provide, by the selected one configured device as the intermediate destination and using the stored information specific to the virtual computer network, the specified type of functionality for the further modified communication before the further modified communication is forwarded to the final destination.

14. The non-transitory computer-readable medium of claim 13 wherein the specified network topology information is part of configuration information for the virtual computer network that is specified by a user.

15. The non-transitory computer-readable medium of claim 14 wherein the specified configuration information further indicates the specified type of functionality, and wherein the selected one configured device is a virtual networking device.

16. The non-transitory computer-readable medium of claim 13 wherein the specified network topology information indicates a network node of the virtual computer network that is located between a first group of computing nodes of the virtual computer network and a second group of one or more other computing nodes, wherein the communication is sent between at least one computing node of the first group and at least one computing node of the second group, and wherein the selecting to use the one configured device includes selecting the one configured device to act as the indicated network node for the virtual computer network.

17. The non-transitory computer-readable medium of claim 13 wherein the specified type of functionality is at least one of firewall capabilities, intrusion detection capabilities, content analysis capabilities, network acceleration capabilities, or virtual private network (“

VPN”

) connection capabilities, and wherein the stored contents include instructions that, when executed, program the computing system.

18. A computing system comprising:

one or more hardware processors; and

one or more memories with stored instructions that, when executed by at least one of the one or more hardware processors, cause the computing system to manage a communication for a virtual computer network overlaid on a distinct substrate network by;

configuring a device accessible via the substrate network to store information specific to the virtual computer network that includes virtual network addresses for the virtual computer network and to provide a specified type of functionality for communications of the virtual computer network that use the virtual network addresses;

determining, based at least in part on specified configuration information for the virtual computer network and as part of providing load balancing functionality, to use the configured device as an intermediate destination for a communication of the virtual computer network that is sent to a final destination indicated using one of the virtual network addresses for the virtual computer network;

modifying the communication to include information specific to the substrate network using one or more substrate network addresses for the substrate network that are separate from the virtual network addresses for the virtual computer network, and forwarding the modified communication over the substrate network to the configured device by using the one or more substrate network addresses;

after the forwarding of the modified communication over the substrate network to the configured device, further modifying the communication to remove the included information specific to the substrate network, and providing the further modified communication to the configured device for further handling; and

providing, by the configured device as the intermediate destination and using the stored information specific to the virtual computer network, the specified type of functionality for the further modified communication before further forwarding of the further modified communication to the final destination.

19. The computing system of claim 18 wherein the computing system is part of a configurable network service that provides the virtual computer network for a user using computing nodes of the configurable network service and that provides the device accessible via the substrate network, and wherein the configured device is a virtual networking device provided by the configurable network service.

20. The computing system of claim 18 wherein the specified configuration information includes network topology information for the virtual computer network that is specified by a user.

21. The computing system of claim 20 wherein the specified configuration information further indicates the specified type of functionality, and wherein the determining to use the configured device includes selecting, from multiple devices connected to the substrate network that are provided by the configurable network service and based at least in part on load on the multiple devices, the configured device.

22. The computing system of claim 20 wherein the network topology information indicates a network node of the virtual computer network that is located between a first group of computing nodes of the virtual computer network and a second group of one or more other computing nodes, wherein the communication is sent between at least one computing node of the first group and at least one computing node of the second group, and wherein the determining to use the configured device includes selecting the configured device to act as the indicated network node for the virtual computer network.

23. The computing system of claim 18 wherein the specified type of functionality is at least one of firewall capabilities, intrusion detection capabilities, content analysis capabilities, network acceleration capabilities, or virtual private network (“

VPN”

) connection capabilities, and wherein the stored instructions, when executed, further program the computing system to provide functionality of a configurable network service.