Interfaces to manage direct network peerings

• US 10,791,096 B2
• Filed: 08/06/2018
• Issued: 09/29/2020
• Est. Priority Date: 11/29/2011
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Miller, Kevin Christopher, Doane, Andrew J., Abuelela, Mahmoud A., Furr, Michael B.
• Primary Examiner(s): Yuen, Kan
• Application Number:
  US16/056,097
• Publication Number:
  US 20180375837A1
• Time in Patent Office: 785 Days
• CPC Class Codes: H04L 12/1435 volume-based
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0896 Bandwidth or capacity management, i.e. automatically increasing or decreasing capacities flow or congestion control using dynamic resource allocation, e.g. in-call renegotiation, H04L47/76
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 45/306 Route determination based on the nature of the carried application
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Methods and apparatus for interfaces to manage direct network peerings. A system may include a data center, endpoint routers and a connectivity coordinator. The coordinator implements a programmatic interface defining connectivity operations. The coordinator receives a request for dedicated connectivity to data center resources, formatted according to the interface. The coordinator selects a target endpoint router at which to establish a physical link to implement the dedicated connectivity, and transmits a response identifying the target endpoint router and including configuration instructions for setting up a physical link for the dedicated connectivity.

Claims

1. A system, comprising:

a data center comprising one or more computers that implement a resource collection designated to respond to service requests received from a client;

a plurality of endpoint routers linked to the data center by one or more private network paths; and

a connectivity coordinator, implemented on one or more computers, configured to;

select a target endpoint router of the plurality of endpoint routers, based at least in part upon a connectivity request from the client for dedicated connectivity to the resource collection and a determination that the target endpoint router is configurable to provide a route over a private network path of the one or more private network paths in accordance with the connectivity request to provide the client access to the resource collection; and

generate a notification comprising configuration instructions for establishing a physical network link between the client and the target endpoint router by configuring the selected target endpoint router to provide at least a portion of the dedicated connectivity for the client to access the resource collection via one or more cables connecting the client to the selected target endpoint router.

2. The system of claim 1, wherein:

the resource collection comprises a plurality of resources implemented by the one or more computers; and

the connectivity coordinator is configured to;

receive one or more selection criteria identifying a subset of the plurality of resources to which an isolated connection is to be provided over the physical network link; and

route network traffic in accordance with the selection criteria.

3. The system of claim 1, wherein the target endpoint router is housed within a facility requiring authorization for physical access, and wherein the notification includes an indication of an authorization of physical access to the target endpoint router at the facility.

4. The system of claim 3, wherein the configuration instructions for establishing a physical network link between the client and the target endpoint router comprise instructions for attaching the one or more cables to the target endpoint router.

5. The system of claim 1, wherein the connectivity coordinator is further configured to:

receive an isolation request from the client to establish a logically isolated network path to the resource collection via the physical network link; and

implement a network isolation mechanism to establish the logically isolated network path in accordance with the isolation request.

6. The system of claim 5, wherein the network isolation mechanism comprises at least one of:

a virtual local area network (VLAN) mechanism or a Multi-Protocol Label Switching (MPLS) technique.

7. The system of claim 1, wherein the connectivity coordinator is further configured to:

receive, from the client, identification information of a network device to be used to transmit network traffic of the client to the resource collection; and

provide, to the client, one or more configuration instructions for the network device based on the identification information.

8. A method, comprising:

selecting an endpoint router of a plurality of endpoint routers of a provider network, based at least in part upon a connectivity request for dedicated connectivity of a client to a resource collection of the provider network and a determination that the endpoint router is configurable to provide a route over a private network to the resource collection in accordance with the connectivity request; and

generating a notification comprising configuration information for establishing a physical network link between the client and the selected endpoint router by configuring the selected endpoint router to provide at least a portion of the dedicated connectivity via one or more cables connecting the client to the selected endpoint router.

9. The method of claim 8, further comprising:

receiving identification information of a network device to be used to transmit network traffic of the client to the resource collection; and

providing one or more configuration instructions for the network device based on the identification information.

10. The method of claim 8, wherein the resource collection comprises a plurality of resources, the method further comprising:

receiving one or more selection criteria identifying a subset of the plurality of resources to which an isolated connection is to be provided over the physical network link; and

routing network traffic in accordance with the selection criteria.

11. The method of claim 10, wherein a selection criteria of the one or more selection criteria comprises a virtual local area network (VLAN) tag.

12. The method of claim 8, wherein the selected endpoint router is housed within a facility requiring authorization for physical access, and wherein the notification includes an indication of an authorization of physical access to the selected endpoint router at the facility.

13. The method of claim 12, wherein the configuration instructions for establishing a physical network link between the client and the selected endpoint router comprise instructions for attaching the one or more cables to the selected endpoint router.

14. The method of claim 13, wherein transmitting the notification comprises sending the notification to an operator of a facility at which the selected endpoint router is housed.

15. The method of claim 8, comprising:

receiving, by a connectivity coordinator implemented on one or more computers, a connectivity request indicating a logically isolated network connection is desired to be established between a client network of the client and the resource collection of the provider network, wherein the resource collection is allocated to the client, wherein the request specifies a dedicated physical path from the client network to the provider network that is to be used to establish the logically isolated network connection, wherein the specified dedicated physical path comprises the physical network link between the client and the selected endpoint router; and

initiating, by the connectivity coordinator, one or more configuration operations to allow traffic to flow from the client network to the resource collection in accordance with the request.

16. The method of claim 15, further comprising:

receiving, by the connectivity coordinator, an indication indicating that an additional logically isolated network connection is desired to be established between another client network and the resource collection via the same dedicated physical path; and

initiating, by the connectivity coordinator, one or more additional configuration operations to allow traffic to flow between the other client network and the resource collection over the additional logically isolated network connection via the same dedicated physical path.

17. The method of claim 16, further comprising:

receiving network traffic, via the other client network, wherein the other client network is exposed to the public internet; and

forwarding the network traffic to the client network, wherein the client network is an internal network not exposed to the public internet, wherein the forwarded network traffic is forwarded from the other client network to the client network via the resource collection of the provider network allocated to the client.

18. The method of claim 15, further comprising:

establishing the dedicated physical path from the client network to the endpoint router of the provider network; and

subsequent to the dedicated physical path being established, initiating by the connectivity coordinator, one or more configuration operations to allow traffic to flow between the client network and the resource collection over the logically isolated network connection via the dedicated physical path.

19. The method of claim 15, wherein the one or more configuration operations to allow traffic to flow from the client network to the resource collection in accordance with the request comprise one or more virtual local area network (VLAN) operations or one or more Multi-Protocol Label Switching (MPLS) operations.

20. The method of claim 15, wherein the connectivity request comprises at least one of:

a virtual local area network (VLAN) tag or a border gateway protocol (BGP) autonomous system number (ASN).