MANAGING USE OF INTERMEDIATE DESTINATION COMPUTING NODES FOR PROVIDED COMPUTER NETWORKS

• US 20150249569A1
• Filed: 05/18/2015
• Published: 09/03/2015
• Est. Priority Date: 03/31/2010
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Brandwine, Eric Jason, Searle, Ian R., Thompson, Aaron C., Miller, Kevin Christopher
• Granted Patent: US 9,794,116 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/5051 Service on demand, e.g. definition and deployment of services in real time
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/131 Protocols for games, networked simulations or virtual reality
• CPC Class Codes: H04L 67/288 Distributed intermediate devices, i.e. intermediate devices for interaction with other intermediate devices on the same level
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

Techniques are described for providing managed computer networks. In some situations, the techniques include managing communications for computing nodes of a managed computer network by using one or more particular computing nodes of the managed computer network that are configured to operate as intermediate destinations to handle at least some communications that are sent by and/or directed to one or more other computing nodes of the managed computer network. For example, a manager module associated with a source computing node may select one or more particular intermediate destination computing nodes to use for one or more particular communications from the source computing node to an indicated final destination, such as based on a configured logical network topology for the managed computer network. The manager module then forwards those communications to a first of the selected intermediate destination computing nodes for further handling.

Claims

1-34. -34. (canceled)

35. A non-transitory computer-readable storage medium having stored contents that configure a computing system to:

overlay a virtual computer network on a substrate network in accordance with information indicating that a first computing node of the virtual computer network is configured to act as an intermediate destination for at least some communications sent via the virtual computer network; and

manage a communication for the virtual computer network that is sent by a source computing node in the virtual computer network to an indicated destination network address associated with an intended final destination of the communication, the managing of the communication including;

determining to use the first computing node as an intermediate destination for the communication; and

causing the communication to be sent over the substrate network to the first computing node before the communication is further sent to the destination network address.

36. The non-transitory computer-readable storage medium of claim 35 wherein the first computing node is configured to receive the communication that is caused to be sent over the substrate network to the first computing node, and to determine whether to perform further sending of the received communication to the destination network address based at least in part on information specific to the received communication.

37. The non-transitory computer-readable storage medium of claim 36 wherein the first computing node is configured to operate as at least one of a firewall device, a network address translation device, a port address translation device, an intrusion detection device, an intrusion prevention device, or a virtual private network connection endpoint.

38. The non-transitory computer-readable storage medium of claim 35 wherein the determining to use the first computing node as the intermediate destination for the communication is based at least in part on one or more attributes of the communication distinct from the destination network address.

39. The non-transitory computer-readable storage medium of claim 38 wherein the one or more attributes of the communication include at least one of a networking protocol used for the communication, a port number indicated for the communication, a source network address indicated for the communication, or quality of service information indicated for the communication.

40. The non-transitory computer-readable storage medium of claim 35 wherein the stored contents include software instructions that, when executed, further configure the computing system to meter a quantity of communications that are sent to the first computing node as an intermediate destination.

41. The non-transitory computer-readable storage medium of claim 35 wherein the information includes configuration information received from a client for whom the virtual computer network is provided, wherein the configuration information includes information about a threshold of use of the first computing node as an intermediate destination, and wherein the determining to use the first computing node as the intermediate destination is based at least in part on the information about the threshold of use.

42. The non-transitory computer-readable storage medium of claim 35 wherein the first computing node has a threshold of use as an intermediate destination based at least in part on a capacity of the first computing node for operating as an intermediate destination, and wherein the determining to use the first computing node as the intermediate destination is based at least in part on the threshold of use.

43. The non-transitory computer-readable storage medium of claim 35 wherein the managing of the communication is performed by a communication manager module of a configurable network service, and wherein the stored contents include software instructions that, when executed, further configure the computing system to:

determine that the first computing node is not currently available to act as an intermediate destination for the virtual computer network; and

notify at least one communication manager module of the configurable network service to inhibit future determinations to use the first computing node as an intermediate destination.

44. The non-transitory computer-readable storage medium of claim 35 wherein the stored contents include software instructions that, when executed, further configure the computing system to cause a second communication to be sent over the substrate network from a source computing node to a location in the substrate network of a destination computing node of the virtual computer network without sending the second communication to the first computing node, the destination computing node being an intended final destination for the second communication.

45. The non-transitory computer-readable storage medium of claim 35 wherein the configured computing system is part of a configurable network service that provides virtual computer networking capabilities to multiple remote clients over one or more networks, and wherein the information includes configuration information received from one of the multiple remote clients for whom the virtual computer network is provided.

46. A computing system, comprising:

one or more processors; and

one or more memories including instructions that, upon execution by the one or more processors, cause the computing system to;

configure a virtual computer network according to network topology information received from a customer of a service provider, wherein the virtual computer network includes multiple computing nodes and is overlaid on a substrate network operated by the service provider;

determine to route a communication addressed to a final destination through an intermediate node that is part of the virtual computer network, the determining being based at least in part on the network topology information;

determine a substrate network address corresponding to the intermediate node; and

cause the communication to be sent over the substrate network to the substrate network address corresponding to the intermediate node.

47. The computing system of claim 46 wherein the intermediate node is configured to operate as a firewall device, a network address translation device, a port address translation device, an intrusion detection device, an intrusion prevention device, or a virtual private network connection endpoint.

48. The computing system of claim 46 wherein the instructions further cause the computing system to:

determine, for a second communication addressed to one of the multiple computing nodes, to send the second communication to the one computing node without routing the second communication through the intermediate node, the determining being based at least in part on the network topology information; and

cause the second communication to be sent over the substrate network to a substrate network address corresponding to the one computing node.

49. The computing system of claim 46 wherein the network topology information is part of configuration information received from the customer for the virtual computer network, and specifies that the intermediate node is configured to act as an intermediate destination for at least some communications sent via the virtual computer network.

50. The computing system of claim 46 wherein the communication is sent from a first computing node that is part of the virtual computer network, and wherein the final destination of the communication is a distinct second computing node that is part of the virtual computer network and that is indicated for the communication by an associated destination virtual network address.

51. A computer-implemented method comprising:

overlaying a virtual computer network on a substrate network in accordance with configuration information for the virtual computer network, the configuration information indicating a network topology of the virtual computer network in which a first computing node of the virtual computer network acts as an intermediate destination for at least some communications sent via the virtual computer network;

receiving, by one or more configured computing systems, information about a communication for the virtual computer network that is sent by a source computing node in the virtual computer network to a destination network address associated with an intended final destination of the communication;

determining, by the one or more configured computing systems, to use the first computing node as an intermediate destination for the communication based at least in part on the indicated network topology; and

causing, by the one or more configured computing systems, the communication to be sent over the substrate network to the first computing node before the communication is further sent to the destination network address.

52. The method of claim 51 further comprising managing an additional communication for the virtual computer network by:

determining, by the one or more configured computing systems, to not use the first computing node as an intermediate destination for the additional communication based at least in part on the indicated network topology; and

causing, by the one or more configured computing systems, the additional communication to be sent over the substrate network from a source computing node to a final destination computing node without sending the additional communication to the first computing node.

53. The method of claim 51 wherein the overlaying of the virtual computer network on the substrate network is performed without physically implementing the indicated network topology.

54. (canceled)