Managing use of intermediate destination computing nodes for provided computer networks

• US 8,510,420 B1
• Filed: 06/27/2012
• Issued: 08/13/2013
• Est. Priority Date: 03/31/2010
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Brandwine, Eric Jason, Searle, Ian R., Thompson, Aaron C., Miller, Kevin Christopher
• Primary Examiner(s): Chan, Wing F
• Assistant Examiner(s): Yohannes, Tesfay
• Application Number:
  US13/535,119
• Time in Patent Office: 412 Days
• Field of Search: 709/220, 709/226, 709/227, 370/398
• US Class Current: 709/220
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/5051 Service on demand, e.g. definition and deployment of services in real time
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/131 Protocols for games, networked simulations or virtual reality
• CPC Class Codes: H04L 67/288 Distributed intermediate devices, i.e. intermediate devices for interaction with other intermediate devices on the same level
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

Techniques are described for providing managed computer networks. In some situations, the techniques include managing communications for computing nodes of a managed computer network by using one or more particular computing nodes of the managed computer network that are configured to operate as intermediate destinations to handle at least some communications that are sent by and/or directed to one or more other computing nodes of the managed computer network. For example, a manager module associated with a source computing node may select one or more particular intermediate destination computing nodes to use for one or more particular communications from the source computing node to an indicated final destination, such as based on a configured logical network topology for the managed computer network. The manager module then forwards those communications to a first of the selected intermediate destination computing nodes for further handling.

Claims

1. A non-transitory computer-readable storage medium comprising stored contents that configure a computing system to:

overlay a virtual computer network on a substrate network in accordance with information indicating that a first computing node of the virtual computer network is configured to act as an intermediate destination for at least some communications sent via the virtual computer network, wherein the information is configuration information specified by a user on whose behalf the virtual computer network is provided and includes a specified network topology for the virtual computer network, the specified network topology including the first computing node being located between a first group of one or more computing nodes in the virtual computer network and a second group of one or more other computing nodes; and

manage a communication for the virtual computer network that is sent by a source computing node in the virtual computer network to an indicated destination network address associated with an intended final destination of the communication, the managing of the communication including;

determining to use the first computing node as an intermediate destination for the communication; and

causing the communication to be sent over the substrate network to the first computing node before the communication is further sent to the destination network address.

2. The non-transitory computer-readable storage medium of claim 1 wherein the second group includes one or more computing nodes external to the virtual computer network.

3. The non-transitory computer-readable storage medium of claim 1 wherein the one or more computing nodes of the first group are co-located at a first geographical location, and wherein the second group includes one or more computing nodes at one or more locations remote from the first geographical location.

4. The non-transitory computer-readable storage medium of claim 1 wherein the one or more computing nodes of the first group are part of a first specified logical subnet of the virtual computer network, and wherein the one or more other computing nodes of the second group are other computing nodes in the virtual computer network that are part of a second specified logical subnet of the virtual computer network.

5. The non-transitory computer-readable storage medium of claim 1 wherein the first computing node is configured to receive the communication that is caused to be sent over the substrate network to the first computing node, and to determine whether to perform further sending of the received communication to the destination network address based at least in part on information specific to the received communication.

6. The non-transitory computer-readable storage medium of claim 1 wherein the determining to use the first computing node as the intermediate destination for the communication is based at least in part on one or more attributes of the communication distinct from the destination network address.

7. The non-transitory computer-readable storage medium of claim 6 wherein the one or more attributes of the communication include at least one of a networking protocol used for the communication, a port number indicated for the communication, a source network address indicated for the communication, or quality of service information indicated for the communication.

8. The non-transitory computer-readable storage medium of claim 1 further comprising stored contents that configure the computing system to meter a quantity of communications that are sent to the first computing node as an intermediate destination.

9. The non-transitory computer-readable storage medium of claim 1 wherein the configuration information includes information about a threshold of use of the first computing node as an intermediate destination, and wherein the determining to use the first computing node as the intermediate destination is based at least in part on the information about the threshold of use.

10. The non-transitory computer-readable storage medium of claim 1 wherein the first computing node has a threshold of use as an intermediate destination based at least in part on a capacity of the first computing node for operating as an intermediate destination, and wherein the determining to use the first computing node as the intermediate destination is based at least in part on the threshold of use.

11. The non-transitory computer-readable storage medium of claim 1 wherein the managing of the communication is performed by a communication manager module of a configurable network service, and wherein the non-transitory computer-readable medium further comprises stored contents that configure the computing system to:

determine that the first computing node is not currently available to act as an intermediate destination for the virtual computer network; and

notify at least one communication manager module of the configurable network service to inhibit future determinations to use the first computing node as an intermediate destination.

12. The non-transitory computer-readable storage medium of claim 1 further comprising stored contents that configure the computing system to cause a second communication to be sent over the substrate network from a source computing node to a location in the substrate network of a destination computing node of the virtual computer network without sending the second communication to the first computing node, the destination computing node being an intended final destination for the second communication.

13. A computing system, comprising:

one or more processors; and

one or more memories including instructions that, upon execution by the one or more processors, cause the computing system to;

configure a virtual computer network according to network topology information received from a customer of a service provider, wherein the virtual computer network includes multiple computing nodes and is overlaid on a substrate network operated by the service provider, wherein the network topology information is part of configuration information indicating an intermediate node of the virtual computer network between a first group of one or more computing nodes in the virtual computer network and a second group of one or more other computing nodes;

determine to route a communication addressed to a final destination through the intermediate node, the determining being based at least in part on the network topology information;

determine a physical substrate network address corresponding to the intermediate node; and

cause the communication to be sent over the substrate network to the physical substrate network address corresponding to the intermediate node.

14. The computing system of claim 13 wherein the intermediate node is configured to operate as a firewall device, a network address translation device, a port address translation device, an intrusion detection device, an intrusion prevention device, or a virtual private network connection endpoint.

15. The computing system of claim 14 wherein the network topology information indicates that the first group of nodes includes the multiple computing nodes of the virtual computer network, and wherein the second group of one or more other computing nodes are external to the virtual computer network.

16. The computing system of claim 13 wherein the second group includes an additional computing node of the virtual computer network that is part of a second logical subnet of the virtual computer network distinct from a first logical subnet of the virtual computer network to which the multiple computing nodes belong.

17. The computing system of claim 13 wherein the instructions further cause the computing system to:

determine, for a second communication addressed to one of the multiple computing nodes, to send the second communication to the one computing node without routing the second communication through the intermediate node, the determining being based at least in part on the network topology information; and

cause the second communication to be sent to a physical substrate network address corresponding to the one computing node.

18. The computing system of claim 13 wherein the configuration information specifies that the intermediate node is configured to act as an intermediate destination for at least some communications sent via the virtual computer network.

19. The computing system of claim 13 wherein the communication is sent from a first computing node that is part of the virtual computer network, and wherein the final destination of the communication is a distinct second computing node that is part of the virtual computer network and that is indicated for the communication by an associated destination virtual network address.

26. The computing system of claim 13 wherein the one or more computing nodes of the first group are co-located at a first geographical location, and wherein the one or more other computing nodes of the second group are at one or more locations remote from the first geographical location.

20. A computer-implemented method comprising:

overlaying a virtual computer network on a substrate network in accordance with configuration information for the virtual computer network, the configuration information indicating a network topology of the virtual computer network in which a first computing node of the virtual computer network acts as an intermediate destination for at least some communications sent via the virtual computer network, the first computing node being located between a first group of one or more computing nodes in the virtual computer network and a second group of one or more other computing nodes;

receiving, by one or more configured computing systems, information about a communication for the virtual computer network that is sent by a source computing node in the virtual computer network to a destination network address associated with an intended final destination of the communication;

determining, by the one or more configured computing systems, to use the first computing node as an intermediate destination for the communication based at least in part on the indicated network topology; and

causing, by the one or more configured computing systems, the communication to be sent over the substrate network to the first computing node before the communication is further sent to the destination network address.

21. The method of claim 20 wherein the second group includes one or more computing nodes external to the virtual computer network, and wherein the first computing node is configured to provide functionality of at least one of a group including a firewall device, a network address translation device, a port address translation device, an intrusion detection device, an intrusion prevention device, and a virtual private network connection endpoint.

22. The method of claim 20 wherein the indicated network topology for the virtual computer network further includes a second computing node of the virtual computer network that is also located between the first and second groups, the first computing node and the second computing node being configured in the indicated network topology to form at least part of a chain of multiple intermediate destination computing nodes between the first and second groups, and wherein the method further comprises, after causing the communication to be sent over the substrate network to the first computing node, and if the first computing node determines to initiate forwarding of the communication, further causing the communication to be sent over the substrate network from the first computing node to the second computing node.

23. The method of claim 20 wherein the first computing node includes multiple logical network interfaces that each has a distinct virtual network address for the virtual computer network, a first of the multiple logical network interfaces being associated with the first group and a second of the multiple logical network interfaces being associated with the second group, wherein the source computing node is part of the first group, and wherein the causing the communication to be sent over the substrate network from the source computing node to the first computing node includes directing the communication to the first logical network interface of the first computing node.

24. The method of claim 20 wherein the overlaying of the virtual computer network on the substrate network is performed without physically implementing the indicated network topology.

25. The method of claim 20 further comprising managing an additional communication for the virtual computer network by:

determining, by the one or more configured computing systems, to not use the first computing node as an intermediate destination for the additional communication based at least in part on the indicated network topology; and

causing, by the one or more configured computing systems, the additional communication to be sent over the substrate network directly from a source computing node to a final destination computing node without sending the additional communication to the first computing node.