Configuring communications between computing nodes

• US 7,865,586 B2
• Filed: 03/31/2008
• Issued: 01/04/2011
• Est. Priority Date: 03/31/2008
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Cohn, Daniel T.
• Primary Examiner(s): Jacobs; Lashonda T
• Application Number:
  US12/060,074
• Publication Number:
  US 20090248846A1
• Time in Patent Office: 1,009 Days
• Field of Search: 709/223, 709/224, 709/203, 709/217, 709/219
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/76 Routing in software-defined topologies, e.g. routing between virtual machines
• CPC Class Codes: H04L 63/0272 Virtual private networks

Abstract

Techniques are described for configuring communications between multiple computing nodes, such as computing nodes that are separated by one or more physical networks. In some situations, the techniques may be used to provide a virtual network between multiple computing nodes that are separated by one or more intermediate physical networks, such as from the edge of the one or more intermediate physical networks by modifying communications that enter and/or leave the intermediate physical networks so as to provide an overlay network without encapsulation of the communications. In some situations, the computing nodes may include virtual machine nodes hosted on one or more physical computing machines or systems, such as by or on behalf of one or more users (e.g., users of a program execution service).

Claims

1. A method for a computing system to configure communications between computing nodes, the method comprising:

under control of a communication manager module that manages communications for multiple associated computing nodes,

receiving an outgoing communication from an executing program on a sending node that is one of the associated computing nodes for the communication manager module, the outgoing communication intended for a remote destination node that is one of multiple other computing nodes associated with another remote communication manager module, the outgoing communication having an indicated destination address that is a first destination network address for the destination node specified by the sending node using a first network addressing protocol for a first virtual network, the communication manager module being communicatively connected to the another communication manager module via at least one other second physical network that uses a distinct second network addressing protocol;

automatically determining if the executing program is authorized to send the outgoing communication to the destination node; and

if the executing program is determined to be authorized, sending the outgoing communication to the destination node over the at least one second network by,

automatically determining a distinct second destination network address specified in accordance with the second network addressing protocol, the second destination network address including a partial destination network address for the destination node based on the second network addressing protocol that corresponds to the another communication manager module and including a representation of the first destination network address specified in accordance with the first network addressing protocol;

automatically modifying the outgoing communication so as to enable an overlay of the first network on the at least one second network for the outgoing communication without encapsulating the outgoing communication in one or more distinct communications to be sent over the at least one second network, the modifying of the outgoing communication including changing the indicated destination address to the determined second destination network address; and

initiating forwarding of the modified outgoing communication to the destination node via the at least one second network based on the second destination network address.

2. The method of claim 1 wherein the program on the sending node is a first program being executed on behalf of a first customer of a program execution service, wherein the sending node is one of multiple virtual machines that are hosted by one of multiple physical computing systems associated with the program execution service, wherein the communication manager module is provided by a virtual machine manager module of the one physical computing system on behalf of the program execution service, wherein the destination node is one of multiple virtual machines that are hosted by another of the multiple physical computing systems and executes a second program on behalf of a second customer of the program execution service, and wherein the automatic determining if the executing first program is authorized to send the outgoing communication to the destination node includes interacting with a system manager module of the program execution service to determine if the first customer is authorized to send communications to the second customer.

3. The method of claim 1 wherein the first virtual network is a private virtual local network to which the sending node and the destination node belong, wherein the at least one second network is a non-private network, and wherein the method further comprises, under the control of the communication manager module:

receiving an incoming communication for one of the multiple associated computing nodes from a second program executing on a remote sending computing node that is associated with the another remote communication manager module, the incoming communication having a representation of a first source network address for the remote sending node that is specified by the remote sending node using the first network addressing protocol, the incoming communication further having a representation of a third destination network address for the one associated computing node that is specified by the remote sending node using the first network addressing protocol;

automatically determining if the incoming communication is valid based at least in part on the first source network address corresponding to a computing node that is allowed to send communications to the one associated computing node; and

if the incoming communication is determined to be valid, using the third destination network address to provide the incoming communication to the one associated computing node.

4. A computer-implemented method for configuring communications between computing nodes, the method comprising:

receiving an outgoing communication from a sending computing node that is intended for a remote destination computing node, the outgoing communication having an indicated destination address that is a first destination network address for the destination node specified by the sending node using a first network addressing protocol for a first network, the sending node being communicatively connected to the destination node via at least one other second network that uses a distinct second network addressing protocol;

before sending the outgoing communication over the one or more intermediate networks, automatically modifying the outgoing communication so as to enable an overlay of the first network on the at least one second network for the outgoing communication, the modifying of the outgoing communication including changing the indicated destination address to a distinct second destination network address using the second network addressing protocol, the second destination network address including a partial destination network address for the destination node that corresponds to multiple computing nodes that include the destination node, the second destination network address further including a representation of the first destination network address; and

initiating forwarding of the modified outgoing communication to the destination node via the at least one second network based on the second destination network address.

5. The method of claim 4 wherein the automatic modifying of the outgoing communication is performed under control of a first communication manager module that manages communications for one or more computing nodes that include the sending node, wherein the partial destination network address corresponds to a remote second communication manager module that manages communications for the multiple computing nodes that include the destination node, and wherein the method further comprises, under control of the second communication manager module:

receiving the modified outgoing communication forwarded via the at least one second network as an incoming communication intended for the destination node;

retrieving the representation of the first destination network address included in the second destination network address of the received incoming communication; and

forwarding at least a portion of the received incoming communication to the destination node by using the first destination network address.

6. The method of claim 5 wherein the received outgoing communication further includes an indicated first source network address for the sending node that is specified by the sending node using the first network addressing protocol, wherein the modifying of the outgoing communication by the first communication manager module further includes adding a distinct second source network address for the sending node using the second network addressing protocol that includes a representation of the first source network address, and wherein the method further comprises, under the control of the second communication manager module and before the forwarding of the communication portion to the destination node, verifying that the received incoming communication is valid based at least in part on the first source network address corresponding to a computing node allowed to communicate with the destination node and based at least in part on the second source network address corresponding to the first communication manager module.

7. The method of claim 4 wherein the automatic modifying of the outgoing communication is performed under control of a first communication manager module that manages communications for one or more computing nodes that include the sending node, wherein the received outgoing communication further includes an indicated first source network address for the sending node that is specified by the sending node using the first network addressing protocol, and wherein the method further comprises, under the control of the first communication manager module and before the forwarding of the communication portion to the destination node, verifying that the received outgoing communication is valid based at least in part on the sending node being allowed to communicate with the destination node.

8. The method of claim 4 wherein the automatic modifying of the outgoing communication is performed under control of a first communication manager module that manages communications for one or more computing nodes that include the sending node, and wherein the method further comprises, under the control of the first communication manager module and before the modifying of the outgoing communication, automatically determining the partial destination network address for the destination node by retrieving stored information that indicates an association of the first destination network address for the destination node to a remote second communication manager module that manages communications for the multiple computing nodes that include the destination node.

9. The method of claim 4 wherein the automatic modifying of the outgoing communication is performed under control of a first communication manager module that manages communications for one or more computing nodes that include the sending node, and wherein the method further comprises, under the control of the first communication manager module and before the modifying of the outgoing communication, automatically determining the partial destination network address for the destination node by interacting with a remote server that maintains an association of the first destination network address for the destination node to a remote second communication manager module that manages communications for the multiple computing nodes that include the destination node.

10. The method of claim 9 wherein the sending and destination computing nodes are part of multiple computing nodes used by a program execution service to execute programs on behalf of customers, wherein the sending computing node executes a first program on behalf of a first customer, wherein the destination computing node executes a second program on behalf of a second customer, and wherein the remote server provides a system manager module for the program execution service.

11. The method of claim 4 wherein the sending node and the destination node are part of a virtual local network, wherein the first destination network address is a virtual network address used by the sending node for the destination node on the virtual local network, and wherein the second destination network address is not available to the sending node.

12. The method of claim 4 wherein the sending node and the destination node are each associated with an identifier corresponding to an entity on whose behalf the sending node and the destination node are operating, wherein the modifying of the outgoing communication further includes constructing the second destination network address so as to include the identifier, and wherein the modifying of the outgoing communication so as to enable the overlay of the first network on the at least one second network for the outgoing communication is performed without encapsulating the outgoing communication in one or more distinct communications to be sent over the at least one second network.

13. The method of claim 4 wherein the first network addressing protocol is Internet Protocol version 4 (IPv4), and wherein the second network addressing protocol is Internet Protocol version 6 (IPv6).

14. The method of claim 4 wherein the received outgoing communication further includes an indicated first source network address for the sending node that is specified by the sending node using the first network addressing protocol, wherein the destination computing node uses the first network addressing protocol for a network to which the destination computing node belongs, and wherein the modified outgoing communication further includes an indicated source address that includes a representation of the first source network address, so that the destination node receives a copy of the outgoing communication that is shown as being sent from the first source network address to the first destination network address.

15. The method of claim 4 wherein the second network addressing protocol uses more bits to represent a network address than the first network addressing protocol, such that the overlay of the first network on the at least one second network includes constructing the second destination network address so as to use a subset of the bits for the second network addressing protocol to represent the first network, the subset of the bits of the constructed second destination network address including the representation of the first destination network address specified in accordance with the first network addressing protocol.

16. The method of claim 4 wherein the sending node is one of multiple virtual machines hosted by a physical computing system, and wherein the method is performed by a virtual machine manager module that executes on the physical computing system to manage communications by the multiple hosted virtual machines.

17. A computer-readable medium whose contents enable a computing system to configure communications between computing nodes, by performing a method comprising:

receiving an outgoing communication sent by a sending node to a destination node using a first destination network address specified in accordance with a first network addressing protocol; and

before sending the outgoing communication to the destination node over one or more networks that use a second network addressing protocol distinct from the first network addressing protocol,

automatically determining a distinct second destination network address specified in accordance with the second network addressing protocol, the second destination network address including a partial destination network address for the destination node based on the second network addressing protocol and including an indication of the first destination network address; and

modifying the outgoing communication so that it specifies the second destination network address for use in directing the modified outgoing communication to the destination node over the one or more networks, the modifying performed without encapsulating the outgoing communication in one or more distinct communications.

18. The computer-readable medium of claim 17 wherein the sending node is one of multiple virtual machines hosted by a physical computing system, wherein the method is performed by a virtual machine manager module that executes on the physical computing system to manage communications by the multiple hosted virtual machines and further comprises forwarding the modified outgoing communication to the one or more networks, wherein the first network addressing protocol is Internet Protocol version 4 (IPv4), wherein the sending node is part of a first virtual network that uses the first network addressing protocol, wherein the second network addressing protocol is Internet Protocol version 6 (IPv6), wherein the one or more networks are distinct from the first network and are part of at least one intermediate physical network between the sending node and destination node that uses the second networking addressing protocol, and wherein the modifying of the outgoing communication is performed so as to enable an overlay of the first network on the one or more networks.

19. The computer-readable medium of claim 17 wherein the computer-readable medium is at least one of a memory in a computing device and a data transmission medium transmitting a generated signal containing the contents.

20. The computer-readable medium of claim 17 wherein the contents are instructions that when executed cause the computing system to perform the method.

21. A system structured to configure communications between computing nodes, comprising:

one or more memories of one or more computing systems; and

at least one of multiple communication manager modules that are configured to manage communications between multiple computing nodes via one or more intermediate networks, such that each communication manager module manages outgoing communications for an associated group of one or more of the multiple computing nodes by;

after a sending computing node initiates a communication to a destination computing node that is part of the associated group for another of the communication manager modules, the sending computing node being one of the computing nodes of the associated group for the communication manager module, determining a destination network address for use with the communication that is specified in accordance with a network addressing protocol used by the one or more intermediate networks, the determined destination network address including a partial network address that corresponds to the another communication manager module whose associated group of computing nodes includes the destination node, the determined destination network address further including an indication of a network address of the destination node specified in accordance with a distinct other network addressing protocol used by the sending computing node; and

using the determined destination network address to forward the initiated communication to the destination node via the one or more intermediate networks.

22. The system of claim 21 wherein the determining by a communication manager module of the destination network address for use with a communication initiated by a sending node to a destination node includes interacting with a remote system manager module that maintains information about the associated group of computing nodes for each of the communication manager modules, the interacting including providing an indication to the system manager module of the destination node network address specified in accordance with the other network addressing protocol used by the sending node, the interacting further including receiving an indication from the system manager module of the partial network address that corresponds to the another communication manager module whose associated group of computing nodes includes the destination node, and wherein the system further comprises one or more system manager modules configured to interact with the multiple communication manager modules.

23. The system of claim 21 further comprising multiple computing systems that provide the multiple communication manager modules, one or more of the computing systems each hosting multiple virtual machines that each provide one of the multiple computing nodes and executing one of the communication manager modules as part of a virtual machine manager module for the computing system, such that the computing nodes provided by the hosted virtual machines of the computing system are the associated group of computing nodes for the executing communication manager module.

24. The system of claim 21 wherein the communication manager modules each includes software instructions for execution in memory of one or more computing systems.

25. The system of claim 21 wherein each communication manager module consists of a means for managing outgoing communications for an associated group of one or more of the multiple computing nodes by:

after a sending computing node initiates a communication to a destination computing node that is part of the associated group for another of the communication manager modules, the sending computing node being one of the computing nodes of the associated group for the communication manager module, determining a destination network address for use with the communication that is specified in accordance with a network addressing protocol used by the one or more intermediate networks, the determined destination network address including a partial network address that corresponds to the another communication manager module whose associated group of computing nodes includes the destination node, the determined destination network address further including an indication of a network address of the destination node specified in accordance with a distinct other network addressing protocol used by the sending computing node; and

using the determined destination network address to forward the initiated communication to the destination node via the one or more intermediate networks.