Techniques for accessing logical networks via a virtualized gateway

Patent metadata

Field	Value
Publication number	US-11146443-B2
Application number	US-201916692327-A
Country	US
Kind code	B2
Filing date	Nov 22, 2019
Priority date	Nov 21, 2012
Publication date	Oct 12, 2021
Grant date	Oct 12, 2021

Abstract

Disclosed are various embodiments for receiving, via a network, a request from a client to establish a network tunnel over the network. A credential is received from the client in order to establish the network tunnel. The client is authenticated based upon the credential. The client negotiates, via the network, to establish the network tunnel.

First claim

The invention claimed is:

1. A system comprising:
a computing device comprising a processor and a memory; and
machine readable instructions stored in the memory that, when executed by the processor of the computing device, cause the computing device to at least:
receive a request from a client device to connect to a logical network gateway hosted on a virtual machine, the logical network gateway controlling access to a logical network comprising a plurality of virtual machines;
establish an encrypted connection between the logical network gateway and the client device, the encrypted connection providing the client device access to the logical network;
assign a logical network address to the client device; and
in response to an assignment of the logical network address to the client device, allocate an additional computing resource to the virtual machine hosting the logical gateway.

2. The system of claim 1 , wherein the additional computing resource is a first computing resource and the machine readable instructions further cause the computing device to at least:
monitor the virtual machine hosting the logical gateway to determine whether usage of the first computing resource assigned to the logical network gateway has exceeded a threshold; and
allocate a second computing resource to the logical network gateway in response to a determination that usage of the first computing resource assigned to the logical network gateway has exceeded the threshold.

3. The system of claim 2 , wherein the virtual machine hosting the logical gateway is a first virtual machine and at least one of the first computing resource or the second computing resource comprises a second virtual machine to supplement the first virtual machine.

4. The system of claim 1 , wherein the machine readable instructions further cause the computing device to at least create the logical network in response to receipt of the request from the client device to connect to the logical network gateway.

5. The system of claim 4 , wherein the machine readable instructions that cause the computing device to create the logical network further cause the computing device to at least include the plurality of virtual machines in the logical network.

6. The system of claim 4 , wherein the logical network is created in response to receipt of a request from a client device to create the logical network.

7. The system of claim 1 , wherein the machine readable instructions further cause the computing device to at least:
authenticate the client device; and
assign the logical network address to the client device in response to authentication of the client device.

8. The system of claim 7 , wherein the machine readable instructions that cause the computing device to authenticate the client device further cause the computing device to at least:
receive a credential from the client device;
send the credential to an authentication service; and
receive a response from the authentication service that indicates that the client device is authenticated.

9. The system of claim 1 , wherein the machine readable instructions further cause the computing device to at least identify a permission assigned to the client device.

10. The system of claim 9 , wherein the machine readable instructions further cause the computing device to at least limit access to a portion of the logical network based at least in part on the permission assigned to the client device.

11. A system, comprising:
a computing device comprising a processor and a memory; and
machine readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
monitor usage of a first computing resource assigned to a logical network gateway for a logical network, the first computing resource facilitating the operation of a plurality of logical network tunnels maintained by the logical network gateway between the logical network and a plurality of respective clients; and
in response to a determination that usage of the first computing resource exceeds a threshold, allocate a second computing resource to the logical network gateway to augment the first computing resource.

12. The system of claim 11 , wherein the machine readable instructions further cause the computing device to at least:
receive a request from a client to connect to the logical network gateway; and
wherein the determination that the usage of the first computing resource exceeds the threshold occurs in response to the request from the client to connect to the logical network gateway.

13. The system of claim 12 , wherein the machine readable instructions further cause the computing device to at least establish a logical network tunnel between the client and the logical network in response to allocation of the second computing resource.

14. The system of claim 13 , wherein the logical network tunnel is an encrypted connection.

15. The system of claim 13 , wherein the machine readable instructions that cause the computing device to establish the logical network tunnel between the client and the logical network gateway further cause the computing device to assign a logical network address to the client.

16. The system of claim 12 , wherein the machine readable instructions further cause the computing device to at least:
authenticate the client in response to the request to connect; and
wherein the determination that the usage of the first computing resource exceeds the threshold further occurs in response to authentication of the client.

17. The system of claim 11 , wherein at least one of the first computing resource or the second computing resource comprises a virtual machine.

18. A method, comprising:
creating, by a computing device, a logical network comprising a logical network gateway;
allocating a first computing resource to the logical network gateway;
in response to receiving a connection request to the logical network gateway from a client device, determining by the computing device that usage of the first computing resource exceeds a threshold; and
allocating, by the computing device, a second computing resource to the logical network gateway to augment the first computing resource.

19. The method of claim 18 , further comprising establishing, by the computing device, a connection between the logical network gateway and the client device in response to allocation of the second computing resource to the logical network gateway.

20. The method of claim 18 , wherein the connection request comprises authentication credentials for the client device and the method further comprises authenticating the client device by the computing device.

Assignees

• Amazon Tech Inc

Inventors

• Siddiqui Ahmed Fuad

Classifications

• H04L41/0896

  Bandwidth or capacity management, i.e. automatically increasing or decreasing capacities (flow or congestion control using dynamic resource allocation, e.g. in-call renegotiation, H04L47/76) · CPC title

• H04L41/04 Primary

  Network management architectures or arrangements · CPC title

• H04L9/40

  Network security protocols · CPC title

• H04L41/0897

  by horizontal or vertical scaling of resources, or by migrating entities, e.g. virtual resources or entities · CPC title

• H04L41/045 Primary

  comprising client-server management architectures · CPC title