VIRTUAL PRIVATE NETWORKS DISTRIBUTED ACROSS MULTIPLE CLOUD-COMPUTING FACILITIES

• US 20150052525A1
• Filed: 03/12/2014
• Published: 02/19/2015
• Est. Priority Date: 08/13/2013
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Raghu, Jagannath N.
• Granted Patent: US 9,391,801 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

The current document discloses methods and systems for extending an internal network within a first cloud-computing facility to a second cloud-computing facility and using the extended internal network as a basis for creating virtual private clouds distributed across multiple cloud-computing facilities. In one implementation, a pool of IP addresses is allocated and distributed to end appliances of the first and second cloud-computing facilities. In this implementation, the internal network is extended via a secure tunnel between end appliances in the first and second cloud-computing facilities and the end appliances of the extended internal network are configured to route messages transmitted by a first member of the virtual private cloud executing on a first cloud-computing facility to a second member of the virtual private cloud executing on a second cloud-computing facility through the secure tunnel.

Claims

1. A cloud-connector subsystem that provides a virtual private cloud operation for creating virtual private clouds distributed across a first and a second cloud-computing facility, the cloud-connector subsystem comprising:

cloud-connector nodes associated with each of the first and second cloud-computing facilities; and

a cloud-connector server that includes one or more processors, one or more memories, one or more data-storage devices, and computer instructions that, when executed on the one or more processors, control the cloud-connector server to provide, in cooperation with the cloud-connector nodes, a virtual-private-cloud-creation operation that

securely interconnects a first virtual organization network within the first cloud-computing facility to a second virtual organization network within the second cloud-computing facility;

distributes internal IP virtual-private-network addresses to the first and second cloud-computing facilities for use by virtual-private-cloud members that execute within the organization virtual data centers to communicate over the virtual private network; and

configures organization-edge appliances and edge appliances associated with virtual appliances within the organization virtual data centers to route packets transmitted by virtual-private-cloud members through the virtual private network.

2. The cloud-connector subsystem of claim 1 wherein a virtual-private-cloud member is one of:

a virtual machine; and

a virtual application.

3. The cloud-connector subsystem of claim 1

wherein the virtual-private-cloud-creation operation securely interconnects a first virtual organization network within the first cloud-computing facility to a second virtual organization network within the second cloud-computing facility by interconnecting a first organization edge appliance in the first cloud-computing facility to a second organization edge appliance in the second cloud-computing facility with a secure tunnel.

4. The cloud-connector subsystem of claim 3 wherein the secure tunnel is one or more of:

an SSL VPN tunnel; and

an IPsec tunnel.

5. The cloud-connector subsystem of claim 1 wherein the virtual-private-cloud-creation operation configures organization-edge appliances and edge appliances associated with virtual appliances within the organization virtual data centers with rules and policies to control packet transmission within the virtual private network.

6. The cloud-connector subsystem of claim 1 wherein the virtual-private-cloud-creation operation creates a virtual private cloud distributed across three or more cloud-computing facilities by:

securely interconnecting the first virtual organization network within the first cloud-computing facility to each of the other two or more of the three or more cloud-computing facilities;

distributing internal IP virtual-private-network addresses to the three or more cloud-computing facilities for use by virtual-private-cloud members that execute within organization virtual data centers to communicate over the virtual private network; and

configuring organization-edge appliances and edge appliances associated with virtual appliances within the organization virtual data centers to route packets transmitted by virtual-private-cloud members through the virtual private network.

7. The cloud-connector subsystem of claim 6

wherein the virtual-private-cloud-creation operation securely interconnects the first virtual organization network within the first cloud-computing facility to the other two or more of the three or more cloud-computing facilities by interconnecting each pair of organization-edge appliances in different cloud-computing facilities with a secure tunnel.

8. The cloud-connector subsystem of claim 6

wherein the virtual-private-cloud-creation operation securely interconnects the first virtual organization network within the first cloud-computing facility to the other two or more of the three or more cloud-computing facilities by interconnecting each of a set of organization-edge appliances in different cloud-computing facilities into a tree or graph of organization-edge appliances with secure tunnels interconnecting pairs of organization-edge appliances.

9. The cloud-connector subsystem of claim 6

wherein the virtual-private-cloud-creation operation securely interconnects the first virtual organization network within the first cloud-computing facility to the other two or more of the three or more cloud-computing facilities by interconnecting the first virtual organization network with each of a set of organization-edge appliances in different cloud-computing facilities as a star topology with secure tunnels that each interconnects the first virtual organization network with another the set of organization-edge appliances.

10. A method that creates a virtual private cloud distributed across a first and a second cloud-computing facility that include cloud-connector nodes associated with each of the first and second cloud-computing facilities and a cloud-connector server that includes one or more processors, one or more memories, one or more data-storage devices, and computer instructions that are executed on the one or more processors control the cloud-connector server to provide, in cooperation with the cloud-connector nodes, a virtual-private-cloud-creation operation, the method comprising:

securely interconnecting a first virtual organization network within the first cloud-computing facility to a second virtual organization network within the second cloud-computing facility;

distributing internal IP virtual-private-network addresses to the first and second cloud-computing facilities for use by virtual-private-cloud members that execute within the organization virtual data centers to communicate over the virtual private network; and

configuring organization-edge appliances and edge appliances associated with virtual appliances within the organization virtual data centers to route packets transmitted by virtual-private-cloud members through the virtual private network.

11. The method of claim 10 wherein a virtual-private-cloud member is one of:

a virtual machine; and

a virtual application.

12. The method of claim 10

wherein the virtual-private-cloud-creation operation securely interconnects a first virtual organization network within the first cloud-computing facility to a second virtual organization network within the second cloud-computing facility by interconnecting a first organization edge appliance in the first cloud-computing facility to a second organization edge appliance in the second cloud-computing facility with a secure tunnel.

13. The method of claim 12 wherein the secure tunnel is one or more of

an SSL VPN tunnel;

and

an IP sec tunnel.

14. The method of claim 10 wherein the virtual-private-cloud-creation operation configures organization-edge appliances and edge appliances associated with virtual appliances within the organization virtual data centers with rules and policies to control packet transmission within the virtual private network.

15. The method of claim 10 wherein the virtual-private-cloud-creation operation creates a virtual private cloud distributed across three or more cloud-computing facilities by:

securely interconnecting the first virtual organization network within the first cloud-computing facility to each of the other two or more of the three or more cloud-computing facilities;

distributing internal IP virtual-private-network addresses to the three or more cloud-computing facilities for use by virtual-private-cloud members that execute within organization virtual data centers to communicate over the virtual private network; and

configuring organization-edge appliances and edge appliances associated with virtual appliances within the organization virtual data centers to route packets transmitted by virtual-private-cloud members through the virtual private network.

16. The method of claim 15

wherein the virtual-private-cloud-creation operation securely interconnects the first virtual organization network within the first cloud-computing facility to the other two or more of the three or more cloud-computing facilities by interconnecting each pair of organization-edge appliances in different cloud-computing facilities with a secure tunnel.

17. The method of claim 15

wherein the virtual-private-cloud-creation operation securely interconnects the first virtual organization network within the first cloud-computing facility to the other two or more of the three or more cloud-computing facilities by interconnecting each of a set of organization-edge appliances in different cloud-computing facilities into a tree or graph of organization-edge appliances with secure tunnels interconnecting pairs of organization-edge appliances.

18. The method of claim 15

wherein the virtual-private-cloud-creation operation securely interconnects the first virtual organization network within the first cloud-computing facility to the other two or more of the three or more cloud-computing facilities by interconnecting the first virtual organization network with each of a set of organization-edge appliances in different cloud-computing facilities as a star topology with secure tunnels that each interconnects the first virtual organization network with another the set of organization-edge appliances.

19. Computer instructions stored on a physical data-storage device that, when executed one or more processors of a cloud-connector server that includes the one or more processors, one or more memories, and one or more data-storage devices that include the physical data-storage device, control the cloud-connector server to create a virtual private cloud distributed across a first and a second cloud-computing facility, carried out in a cloud-connector subsystem that includes cloud-connector nodes associated with each of the first and second cloud-computing facilities and the cloud-connector server, by:

securely interconnecting a first virtual organization network within the first cloud-computing facility to a second virtual organization network within the second cloud-computing facility;

distributing internal IP virtual-private-network addresses to the first and second cloud-computing facilities for use by virtual-private-cloud members that execute within the organization virtual data centers to communicate over the virtual private network; and

configuring organization-edge appliances and edge appliances associated with virtual appliances within the organization virtual data centers to route packets transmitted by virtual-private-cloud members through the virtual private network.

20. The computer instructions of claim 19

wherein a virtual-private-cloud member is one of a virtual machine and a virtual application;

wherein the virtual-private-cloud-creation operation securely interconnects a first virtual organization network within the first cloud-computing facility to a second virtual organization network within the second cloud-computing facility by interconnecting a first organization edge appliance in the first cloud-computing facility to a second organization edge appliance in the second cloud-computing facility with a secure tunnel; and

wherein the secure tunnel is one or more of an SSL VPN tunnel and an IPsec tunnel.