PROVIDING LOCAL SECURE NETWORK ACCESS TO REMOTE SERVICES

• US 20160006610A1
• Filed: 09/14/2015
• Published: 01/07/2016
• Est. Priority Date: 12/10/2008
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Brandwine, Eric Jason, Cohn, Daniel T., Doane, Andrew J.
• Granted Patent: US 10,868,715 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/586 of virtual routers
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Techniques are described for providing users with access to computer networks, such as to enable users to create computer networks that are provided by a remote configurable network service for use by the users. Such provided computer networks may be configured to be private computer networks accessible only by the users who create them, and may each be created and configured by a client of the configurable network service to be an extension to an existing computer network of the client, such as a private computer network extension to an existing private computer network of the client. In addition, access to remote resource services may be configured and provided from such computer networks in various manners, such as to include a local access mechanism as part of a provided computer network that is configured to forward communications sent to the access mechanism to a particular remote resource service.

Claims

1-30. -30. (canceled)

31. A computer-implemented method comprising:

receiving, by one or more computing systems of a configurable network service operated by a service provider, configuration information from a client of the service provider for a virtual computer network instantiated using one or more internal networks of the service provider, the received configuration information identifying a web service having a publically accessible interface that is accessible via a public network, the public network being distinct and separate from the one or more internal networks;

based at least in part on the received configuration information, configuring, by the one or more computing systems, one or more communication manager modules to manage communications for computing nodes of the virtual computer network, the configuring of the one or more communication manager modules including providing routing information for the virtual computer network indicating that communications sent to or from the web service from within the virtual computer network are to be routed to or from the web service without the communications being sent via the public network;

wherein the configuring of the one or more communication manager modules causes a first communication manager module to;

receive one or more communications from a first computing node of the virtual computer network, the one or more communications specifying the identified web service as a destination of the one or more communications; and

forward, based at least in part on the routing information provided for the virtual computer network, the one or more received communications to the identified web service over the one or more internal computer networks of the service provider and without being sent via the public network.

32. The computer-implemented method of claim 31 wherein the configuring of the one or more communication manager modules further includes specifying one or more network access constraints for computing nodes of the virtual computer network, and wherein the configuring further causes the first communication manager module to determine, prior to forwarding the one or more received communications to the identified web service, that the one or more received communications are in accordance with the one or more network access constraints.

33. The computer-implemented method of claim 32 wherein the one or more network access constraints restrict communications between the computing nodes of the virtual computer network and computing nodes that are external to the virtual computer network.

34. The computer-implemented method of claim 32 wherein the one or more network access constraints restrict communications between the computing nodes of the virtual computer network and computing nodes that are external to the one or more internal networks.

35. The computer-implemented method of claim 32 wherein the configuring of the one or more communication manager modules further causes the first communication manager module to receive one or more additional communications from the first computing node, to determine that the one or more additional communications are not in accordance with the one or more network access constraints, and to accordingly prevent forwarding of the one or more additional communications.

36. The computer-implemented method of claim 31 wherein the one or more internal networks of the service provider include one or more physical substrate networks, and wherein the virtual computer network is overlaid on the physical substrate networks.

37. The computer-implemented method of claim 31 wherein each of the communication manager modules is executing on a physical host computing system provided by the configurable network service, and wherein each respective computing node of the virtual computer network is associated with a single respective one of the executing communication manager modules that manages communications for the respective computing node.

38. The computer-implemented method of claim 31 wherein receiving the configuration information from the client includes receiving at least some of the configuration information via one or more programmatic requests sent by the client to a programmatic interface of the configurable network service.

39. The computer-implemented method of claim 31 wherein the received configuration information includes multiple network addresses specified by the client for use with the virtual computer network, and wherein the method further comprises assigning one of the multiple specified network addresses to each of at least some of the computing nodes of the virtual computer network.

40. The computer-implemented method of claim 39, further comprising assigning one of the multiple specified network addresses to represent the identified web service, such that computing nodes of the virtual computer network may send communications to the identified web service as if the identified web service were part of the virtual computer network.

41. The computer-implemented method of claim 31 wherein at least some of the computing nodes of the virtual computer network are virtual machines hosted by one or more physical computing systems provided by the configurable network service.

42. A non-transitory computer-readable medium having stored contents that, when executed, configure a computing system of a configurable network service operated by a service provider to:

receive configuration information for a virtual computer network from a client of the service provider, the received configuration information identifying a web service having a public interface that is accessible via a one or more public networks;

based at least in part on the received configuration information, configure a communication manager module of the configurable network service to manage communications for one or more computing nodes of the virtual computer network, wherein the configuring includes specifying routing information for the virtual computer network such that communications between the web service and computing nodes of the virtual computer network are to be routed via one or more internal computer networks of the service provider and not via the one or more public networks;

wherein the configuring causes the communication manager module to;

receive a communication from a first computing node of the virtual computer network that specifies the identified web service as a destination of the communication; and

forward, based at least in part on the specified routing information, the received communication to the identified web service via the one or more internal computer networks of the service provider and not via the one or more public networks.

43. The non-transitory computer-readable medium of claim 42 wherein the configuring of the communication manager module further includes specifying one or more network access constraints for computing nodes of the virtual computer network, and wherein the configuring further causes the communication manager module to verify, prior to forwarding the received communication to the identified web service, that the received communication is in accordance with the one or more network access constraints.

44. The non-transitory computer-readable medium of claim 43 wherein the configuring of the communication manager module further causes the communication manager module to receive an additional communication from another computing node of the virtual computer network, to determine that the additional communication is not in accordance with the one or more specified network access constraints, and to prevent forwarding of the additional communication based on the one or more specified network access constraints.

45. The non-transitory computer-readable medium of claim 42 wherein each of the communication manager modules is executing on a physical host computing system provided by the configurable network service, and wherein each respective computing node of the virtual computer network is associated with a single respective one of the executing communication manager modules that manages communications for the respective computing node.

46. The non-transitory computer-readable medium of claim 42 wherein the stored contents further configure the computing system to assign one of multiple network addresses specified by the client for use with the virtual computer network to each of at least some of the computing nodes of the virtual computer network.

47. The non-transitory computer-readable medium of claim 46, wherein the stored contents further configure the computing system to assign one of the multiple specified network addresses to represent the identified web service within the virtual computer network.

48. A system, comprising:

one or more processors; and

at least one memory, the memory including instructions that, upon execution by at least one of the one or more processors, cause the system to;

receive configuration information for a virtual computer network from a client of a service provider, wherein the virtual computer network includes a plurality of virtual machine nodes and is overlaid on one or more internal networks of the service provider, and wherein the received configuration information identifies a web service having a public interface accessible via a public network;

based at least in part on the received configuration information, configure a communication manager module to manage communications for one or more of the virtual machine nodes of the virtual computer network, wherein the configuration includes providing routing information for the virtual computer network such that communications between the web service and the one or more virtual machine nodes are to be routed to or from the web service without being sent over the public network;

wherein the configuration causes a first communication manager module to;

receive a communication from a first of the one or more virtual machine nodes, the communication specifying the identified web service as a destination of the one or more communications; and

forward, based at least in part on the routing information provided for the virtual computer network, the received communication to the identified web service over the one or more internal computer networks of the service provider and not via the public network.

49. The system of claim 48 wherein the configuration of the communication manager module further includes specifying one or more network access constraints for the one or more virtual machine nodes, and further causes the communication manager module to determine, prior to forwarding the received communication to the identified web service, that the received communication is in accordance with the one or more network access constraints.

50. The system of claim 49 wherein the configuration of the one or more communication manager module further causes the first communication manager module to receive one or more additional communications from the first virtual machine node, to determine that the one or more additional communications are not in accordance with the one or more network access constraints, and to prevent forwarding of the one or more additional communications based at least in part on the one or more network access constraints.

51. The system of claim 48 wherein the configured communication manager module is one of a plurality of communication manager modules respectively executing on one of multiple physical host computing systems provided by the service provider, and wherein each virtual machine node of the virtual computer network is associated with a single respective one of the executing communication manager modules that manages communications for the respective virtual machine node.