Systems and methods for providing secure network exchanged for a multitenant virtual private cloud

• US 10,659,349 B2
• Filed: 02/06/2017
• Issued: 05/19/2020
• Est. Priority Date: 02/04/2016
• Status: Active Grant

• Current Assignee: Twilio, Inc.
• Original Assignee: Twilio, Inc.
• Inventors: Mysyk, Andriy
• Primary Examiner(s): Whipple, Brian
• Assistant Examiner(s): Tolchinsky, Gregory P
• Application Number:
  US15/425,934
• Publication Number:
  US 20180026877A1
• Time in Patent Office: 1,198 Days
• Field of Search: None
• CPC Class Codes: H04L 45/04 Interdomain routing, e.g. hierarchical routing
• CPC Class Codes: H04L 45/3065 for real time traffic
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2567 for reachability, e.g. inquiring the address of a correspondent behind a NAT server
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/0272 Virtual private networks

Abstract

Systems and methods for routing real-time voice communication via a private network exchange. A virtual private cloud (VPC) system receives first configuration for a first private network exchange for a first account of the VPC system. The VPC system assigns a first regional exchange system to the first private network exchange based on the first configuration. The first private network exchange is established between the first regional exchange system and a first outside entity system of the first account by mapping an identifier of the first account to the first private network exchange. Real-time voice communication data for the first account is routed from a first real-time voice communication service of the VPC system to the first outside entity system via the first private network exchange based on the mapping.

Claims

1. A method comprising:

receiving, by a multitenant platform, a first configuration for a first private network exchange for a first account, the multitenant platform being hosted by a virtual private cloud (VPC) system that is a cloud computing service, the first configuration comprising a location of a first regional exchange system for establishing a network connection of the first private network exchange, the first regional exchange system providing a plurality of private network exchange interfaces including a virtual private network (VPN) connection, a cross connect connection, and a multiprotocol label switching (MPLS) connection;

establishing a network connection for the first private network exchange, between the first regional exchange system and a first outside entity system of the first account, via one from the plurality of private network exchange interfaces, of the first regional exchange system, identified in the first configuration, the establishing comprising mapping an identifier of the first account to the first private network exchange, wherein establishing the network connection includes determining an internet protocol (IP) address for the network connection; and

routing traffic of the first private network exchange through the first regional exchange system, the routing traffic comprising;

routing real-time voice communication data for the first private network exchange through the first regional exchange system and a real-time voice communication service of the VPC system based on the mapping.

2. The method of claim 1, wherein the VPC system assigns the IP address within a subnet of the first regional exchange system to the first private network exchange.

3. The method of claim 1, wherein the first configuration specifies a type of private network exchange interface for the first private network exchange.

4. The method of claim 1, wherein the first account is an account of a service provider different from the VPC system, and wherein the first outside entity system is a system of the service provider.

5. The method of claim 1, wherein routing the real-time voice communication data for the first private network exchange comprises:

providing, by the VPC system, the real-time voice communication data to the first regional exchange system responsive to a determination that a destination endpoint identified by the real-time voice communication data is authorized to receive the real-time voice communication data via the first private network exchange; and

providing, by the VPC system, the real-time voice communication data to the first regional exchange system responsive to a determination that a source endpoint identified by the real-time voice communication data is authorized to provide the real-time voice communication data via the first private network exchange.

6. The method of claim 1, wherein the first regional exchange system and the multitenant platform are managed by a first entity and the cloud computing service is managed by a second entity.

7. The method of claim 1, wherein routing traffic of the first private network exchange through the first regional exchange system further comprises:

routing communication data for the first private network exchange through the first regional exchange system and a data-communication service of the VPC system based on the mapping.

8. The method of claim 1, wherein

routing messaging data for the first private network exchange through the first regional exchange system and a messaging service of the VPC system based on the mapping.

9. A multitenant platform comprising:

a memory comprising instructions; and

one or more computer processors, wherein the instructions, when executed by the one or more computer processors, cause the multitenant platform to perform operations comprising;

receiving a first configuration for a first private network exchange for a first account, the multitenant platform being hosted by a virtual private cloud (VPC) system that is a cloud computing service, the first configuration comprising a location of a first regional exchange system for establishing a network connection of the first private network exchange, the first regional exchange system providing a plurality of private network exchange interfaces including a virtual private network (VPN) connection, a cross connect connection, and a multiprotocol label switching (MPLS) connection;

establishing a network connection for the first private network exchange, between the first regional exchange system and a first outside entity system of the first account, via one from the plurality of private network exchange interfaces, of the first regional exchange system, identified in the first configuration, the establishing comprising mapping an identifier of the first account to the first private network exchange, wherein establishing the network connection includes determining an internet protocol (IP) address for the network connection; and

routing traffic of the first private network exchange through the first regional exchange system, the routing traffic comprising;

routing real-time voice communication data for the first private network exchange through the first regional exchange system and a real-time voice communication service of the VPC system based on the mapping.

10. The multitenant platform of claim 9, wherein the VPC system assigns the IP address within a subnet of the first regional exchange system to the first private network exchange.

11. The multitenant platform of claim 9, wherein the first configuration specifies a type of private network exchange interface for the first private network exchange.

12. The multitenant platform of claim 9, wherein the first account is an account of a service provider different from the VPC system, and wherein the first outside entity system is a system of the service provider.

13. The multitenant platform of claim 9, wherein routing the real-time voice communication data for the first private network exchange comprises:

providing, by the VPC system, the real-time voice communication data to the first regional exchange system responsive to a determination that a destination endpoint identified by the real-time voice communication data is authorized to receive the real-time voice communication data via the first private network exchange; and

providing, by the VPC system, the real-time voice communication data to the first regional exchange system responsive to a determination that a source endpoint identified by the real-time voice communication data is authorized to provide the real-time voice communication data via the first private network exchange.

14. The multitenant platform of claim 9, wherein the first regional exchange system and the multitenant platform are managed by a first entity and the cloud computing service is managed by a second entity.

15. A non-transitory machine-readable storage medium including instructions that, when executed by one or more computer processors of a multitenant platform, cause the multitenant platform to perform operations comprising:

receiving a first configuration for a first private network exchange for a first account, the multitenant platform being hosted by a virtual private cloud (VPC) system that is a cloud computing service, the first configuration comprising a location of a first regional exchange system for establishing a network connection of the first private network exchange, the first regional exchange system providing a plurality of private network exchange interfaces including a virtual private network (VPN) connection, a cross connect connection, and a multiprotocol label switching (MPLS) connection;

establishing a network connection for the first private network exchange, between the first regional exchange system and a first outside entity system of the first account, via one from the plurality of private network exchange interfaces, of the first regional exchange system, identified in the first configuration, the establishing comprising mapping an identifier of the first account to the first private network exchange, wherein establishing the network connection includes determining an internet protocol (IP) address for the network connection; and

routing traffic of the first private network exchange through the first regional exchange system, the routing traffic comprising;

routing real-time voice communication data for the first private network exchange through the first regional exchange system and a real-time voice communication service of the VPC system based on the mapping.

16. The non-transitory machine-readable storage medium of claim 15, wherein the VPC system assigns the IP address within a subnet of the first regional exchange system to the first private network exchange.

17. The non-transitory machine-readable storage medium of claim 15, wherein the first configuration specifies a type of private network exchange interface for the first private network exchange.

18. The non-transitory machine-readable storage medium of claim 15, wherein the first account is an account of a service provider different from the VPC system, and wherein the first outside entity system is a system of the service provider.

19. The non-transitory machine-readable storage medium of claim 15, wherein routing the real-time voice communication data for the first private network exchange comprises:

providing, by the VPC system, the real-time voice communication data to the first regional exchange system responsive to a determination that a destination endpoint identified by the real-time voice communication data is authorized to receive the real-time voice communication data via the first private network exchange; and

providing, by the VPC system, the real-time voice communication data to the first regional exchange system responsive to a determination that a source endpoint identified by the real-time voice communication data is authorized to provide the real-time voice communication data via the first private network exchange.

20. The non-transitory machine-readable storage medium of claim 15, wherein the first regional exchange system and the multitenant platform are managed by a first entity and the cloud computing service is managed by a second entity.