Managing use of intermediate destination computing nodes for provided computer networks

• US 9,794,116 B2
• Filed: 05/18/2015
• Issued: 10/17/2017
• Est. Priority Date: 03/31/2010
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Brandwine, Eric Jason, Searle, Ian R., Thompson, Aaron C., Miller, Kevin Christopher
• Primary Examiner(s): Yohannes, Tesfay
• Application Number:
  US14/715,452
• Publication Number:
  US 20150249569A1
• Time in Patent Office: 883 Days
• Field of Search: 709220, 709223, 370397, 370307
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/5051 Service on demand, e.g. definition and deployment of services in real time
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/131 Protocols for games, networked simulations or virtual reality
• CPC Class Codes: H04L 67/288 Distributed intermediate devices, i.e. intermediate devices for interaction with other intermediate devices on the same level
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

Techniques are described for providing managed computer networks. In some situations, the techniques include managing communications for computing nodes of a managed computer network by using one or more particular computing nodes of the managed computer network that are configured to operate as intermediate destinations to handle at least some communications that are sent by and/or directed to one or more other computing nodes of the managed computer network. For example, a manager module associated with a source computing node may select one or more particular intermediate destination computing nodes to use for one or more particular communications from the source computing node to an indicated final destination, such as based on a configured logical network topology for the managed computer network. The manager module then forwards those communications to a first of the selected intermediate destination computing nodes for further handling.

Claims

1. A non-transitory computer-readable storage medium having stored contents that cause a computing system to at least:

instantiate, by the computing system, a virtual computer network having multiple computing nodes at a geographical location based on configuration information received from a client, wherein the instantiating includes overlaying the virtual computer network on a substrate network at the geographical location, and wherein one or more computer systems that host the multiple computing nodes are co-located at the geographical location and are configured to forward, based on the configuration information, communications over the substrate network between the multiple computing nodes at the geographical location; and

update, by the computing system and while the virtual computer network is in use, the configuration information based on instructions from the client to add functionality for an indicated computing node in the virtual computer network at the geographical location, wherein one or more computer systems that host the multiple computing nodes are configured to forward, based on the updated configuration information, an additional communication over the substrate network to the indicated computing node to obtain the added functionality for the additional communication.

2. The non-transitory computer-readable storage medium of claim 1 wherein the indicated computing node is configured to receive the additional communication forwarded over the substrate network, and to determine whether to perform further forwarding of the additional communication based at least in part on information specific to the additional communication, and wherein the stored contents further cause the computing system to add the functionality for the indicated computing node in the virtual computer network without modifying any other computing nodes in the virtual computer network.

3. The non-transitory computer-readable storage medium of claim 1 wherein the stored instructions further cause the computing system to determine to forward the additional communication to the indicated computing node based on the updated configuration information and to provide the added functionality of the indicated computing node for the additional communication, by providing at least one of firewall functionality, network address translation functionality, port address translation functionality, intrusion detection functionality, intrusion prevention functionality, functionality for an endpoint of a virtual private network connection, or load balancing functionality.

4. The non-transitory computer-readable storage medium of claim 1 wherein the stored instructions include software instructions that, when executed by the computing system, further cause the computing system to provide at least some functionality of a configurable network service that provides virtual computer networks to multiple clients of the configurable network service, wherein the client is one of the multiple clients, and wherein the instructions from the client further specify to use the indicated computing node as an intermediate destination to which at least some communications are forwarded for further handling before the at least some communications reach final destinations.

5. A computer-implemented method, comprising:

providing, by one or more computing systems of a configurable network service and for a client of the configurable network service, a virtual computer network having multiple computing nodes based on configuration information received from the client, the providing including overlaying the virtual computer network on a substrate network of the configurable network service;

forwarding, by the one or more computing systems and based on the configuration information, communications over the substrate network between the multiple computing nodes;

updating, by the one or more computing systems and while the virtual computer network is in use, the configuration information based on instructions from the client to add functionality for an intermediate computing node in the virtual computer network; and

providing, by the one or more computing systems, the added functionality of the intermediate computing node for an additional communication without modifying any other computing nodes in the virtual computer network, including forwarding, by the one or more computing systems and based on the updated configuration information, the additional communication over the substrate network to the intermediate computing node to obtain the added functionality for the additional communication.

6. The computer-implemented method of claim 5 wherein the providing of the added functionality further includes providing firewall functionality to block a further communication based on the further communication not meeting one or more specified criteria.

7. The computer-implemented method of claim 5 wherein the providing of the added functionality further includes providing at least one of network address translation functionality or port address translation functionality to modify information in the additional communication.

8. The computer-implemented method of claim 5 wherein the providing of the added functionality further includes providing at least one of intrusion detection functionality or intrusion prevention functionality for one or more threats posed by the additional communication.

9. The computer-implemented method of claim 5 wherein the providing of the added functionality further includes providing functionality for an endpoint of a virtual private network connection via which the additional communication is sent.

10. The computer-implemented method of claim 5 wherein the providing of the added functionality further includes providing load balancing functionality to handle the additional communication via one of multiple alternative devices.

11. The computer-implemented method of claim 5 wherein the intermediate computing node is configured to receive the additional communication forwarded over the substrate network, and to determine whether to perform further forwarding of the additional communication based at least in part on information specific to the additional communication.

12. The computer-implemented method of claim 5 wherein the multiple computing nodes are co-located at a geographical location, and wherein the method further comprises modifying, by the one or more computing systems and based on the instructions from the client, the virtual computer network while the virtual computer network is in use by adding, at the geographical location, the intermediate computing node to the multiple computing nodes.

13. The computer-implemented method of claim 5 wherein the configuration information received from the client includes a network topology for the virtual computer network, and wherein the method further comprises modifying, by the one or more computing systems and based on the instructions from the client, the network topology of the virtual computer network while the virtual computer network is in use by changing one of the multiple computing nodes to be located in the modified network topology between two or more groups of other computing nodes of the multiple computing nodes.

14. The computer-implemented method of claim 5 further comprising determining, by the one or more computing systems, to use the intermediate computing node for the additional communication based at least in part on one or more attributes of the additional communication.

15. The computer-implemented method of claim 14 wherein the one or more attributes of the additional communication include at least one of a networking protocol used for the additional communication, a port number indicated for the additional communication, a source network address indicated for the additional communication, or quality of service information indicated for the additional communication.

16. A system, comprising:

one or more hardware processors of one or more computer systems; and

one or more memories with stored instructions that, when executed by at least one of the one or more hardware processors, cause the system to;

instantiate, for a client of a configurable network service, a virtual computer network having multiple computing nodes based on configuration information received from the client, wherein the configuration information indicates a network topology for the virtual computer network, and wherein the instantiating includes overlaying the virtual computer network on a substrate network;

update, while the virtual computer network is in use, the configuration information based on instructions from the client;

add, based on the instructions from the client, functionality for an indicated computing node in the virtual computer network without modifying any other computing nodes in the virtual computer network, including to modify the network topology of the virtual computer network while the virtual computer network is in use to locate the indicated computing node in the modified network topology between two or more groups of the multiple computing nodes;

determine, based on the updated configuration information, to use the indicated computing node with an additional communication; and

forward the additional communication over the substrate network to the indicated computing node to obtain the added functionality for the additional communication.

17. The system of claim 16 wherein the multiple computing nodes and the substrate network and the indicated computing node are co-located at a geographical location, and wherein the indicated computing node is configured to receive the additional communication forwarded over the substrate network, and to determine whether to perform further forwarding of the additional communication based at least in part on information specific to the additional communication.

18. The system of claim 17 wherein the stored instructions further cause the system to provide the added functionality of the indicated computing node for the additional communication, by providing at least one of firewall functionality, network address translation functionality, port address translation functionality, intrusion detection functionality, intrusion prevention functionality, functionality for an endpoint of a virtual private network connection, or load balancing functionality.

19. The system of claim 16 wherein the instructions from the client further specify to use the indicated computing node as an intermediate destination to which at least some communications are forwarded for further handling before the at least some communications reach final destinations, and wherein the stored instructions further cause the system to, before the receiving of the instructions from the client, forward other initial communications over the substrate network to final destinations in the multiple computing nodes without forwarding the other initial communications to any intermediate destinations.