Domain name system operations implemented using scalable virtual traffic hub

Patent metadata

Field	Value
Publication number	US-11831600-B2
Application number	US-202017091995-A
Country	US
Kind code	B2
Filing date	Nov 6, 2020
Priority date	Sep 19, 2018
Publication date	Nov 28, 2023
Grant date	Nov 28, 2023

Abstract

Connectivity is enabled between a first and second isolated network using a virtual traffic hub that includes a decision master node responsible for determining a routing action for a packet received at the hub. At the hub, a determination is made that a particular domain name system (DNS) message being directed to a first resource in the first isolated network is to include an indication of a second resource in the second isolated network. The second resource is assigned a network address within a private address range of the second isolated network, which overlaps with a private address range being used in the first isolated network. The hub causes a transformed version of the network address to be included in the DNS message delivered to the first resource.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving one or more programmatic requests to create a virtual gateway for connectivity between a plurality of networks, including at least a first network comprising one or more resources of a cloud computing environment;
configuring the virtual gateway to perform one or more types of routing actions on network packets flowing between the first network and a second network of the plurality of networks; and
in response to a programmatic request to upgrade the virtual gateway to accommodate a change in traffic level, modifying a configuration of the virtual gateway.

2. The computer-implemented method as recited in claim 1 , wherein the first network comprises an isolated virtual network of a virtualized computing service of the cloud computing environment, and wherein the one or more resources include a virtual machine.

3. The computer-implemented method as recited in claim 1 , wherein the second network comprises one or more resources at a premise of a client of the cloud computing environment.

4. The computer-implemented method as recited in claim 1 , wherein the one or more types of routing actions comprise an address substitution operation.

5. The computer-implemented method as recited in claim 1 , further comprising:
receiving, via one or more programmatic interfaces from a client on whose behalf the virtual gateway is created, metadata for making packet processing decisions pertaining to the network packets flowing between the first network and a second network; and
performing the one or more types of routing actions using at least the metadata.

6. The computer-implemented method as recited in claim 1 , wherein the virtual gateway is implemented at least in part using one or more virtual machines of a virtualized computing service of the cloud computing environment.

7. The computer-implemented method as recited in claim 1 , wherein a first network address range from which network addresses are assigned to the one or more resources of the first network overlaps at least in part with a second network address range from which network addresses are assigned to one or more resources of the second network.

8. A system, comprising:
one or more computing devices;
wherein the one or more computing devices include instructions that upon execution on or across the one or more computing devices cause the one or more computing devices to:
receive one or more programmatic requests to create a virtual gateway for connectivity between a plurality of networks, including at least a first network comprising one or more resources of a cloud computing environment;
configure the virtual gateway to perform one or more types of routing actions on network packets flowing between the first network and a second network of the plurality of networks; and
in response to a programmatic request to upgrade the virtual gateway to accommodate a change in traffic level, modify a configuration of the virtual gateway.

9. The system as recited in claim 8 , wherein the first network comprises an isolated virtual network of a virtualized computing service of the cloud computing environment, and wherein the one or more resources include a virtual machine.

10. The system as recited in claim 8 , wherein the second network comprises one or more resources at a premise external to the cloud computing environment.

11. The system as recited in claim 8 , wherein the one or more types of routing actions comprise an address substitution operation.

12. The system as recited in claim 8 , wherein to configure the virtual gateway, the one or more computing devices include further instructions that upon execution on or across the one or more computing devices further cause the one or more computing devices to:
obtain, via one or more programmatic interfaces, a packet processing rule from a client on whose behalf the virtual gateway is created; and
perform the one or more types of routing actions using at least the packet processing rule.

13. The system as recited in claim 8 , wherein the virtual gateway is implemented at least in part using one or more virtual machines of a virtualized computing service of the cloud computing environment.

14. The system as recited in claim 8 , wherein a first network address range from which network addresses are assigned to the one or more resources of the first network overlaps at least in part with a second network address range from which network addresses are assigned to one or more resources of the second network.

15. One or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors cause the one or more processors to:
obtain an indication of one or more programmatic requests to create a virtual gateway for connectivity between a plurality of networks, including at least a first network comprising one or more resources of a cloud computing environment;
configure the virtual gateway to perform one or more types of routing actions on network packets flowing between the first network and a second network of the plurality of networks; and
modify a configuration of the virtual gateway in response to a programmatic request to upgrade the virtual gateway.

16. The one or more non-transitory computer-accessible storage media as recited in claim 15 , wherein the first network comprises an isolated virtual network of a virtualized computing service of the cloud computing environment, and wherein the one or more resources include a virtual machine.

17. The one or more non-transitory computer-accessible storage media as recited in claim 15 , wherein the second network comprises one or more resources at a premise of a client of the cloud computing environment.

18. The one or more non-transitory computer-accessible storage media as recited in claim 15 , wherein the one or more types of routing actions comprise a multicast operation.

19. The one or more non-transitory computer-accessible storage media as recited in claim 15 , wherein the one or more programmatic requests to create the virtual gateway indicate that a virtual private network (VPN) connection is to be used for traffic between the first network and the second network.

20. The one or more non-transitory computer-accessible storage media as recited in claim 15 , wherein to modify the configuration of the virtual gateway, the dedicated resource comprises at least a portion of an isolated read channel, the one or more non-transitory computer-accessible storage media storing further program instructions that when executed on or across one or more processors further cause the one or more processors to:
include one or more additional nodes of a packet processing service in a set of nodes of the packet processing service, wherein the set of nodes is assigned to implement at least a portion of the virtual gateway.

Assignees

• Amazon Tech Inc

Inventors

• Tillotson Paul John
• Deb Bashuman
• Spendley Thomas
• Hashmi Omer
• Qian Baihu
• Penney Alexander Justin

Classifications

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L61/4511 Primary

  using domain name system [DNS] · CPC title

• H04L12/4633 Primary

  Interconnection of networks using encapsulation techniques, e.g. tunneling · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• H04L12/4645

  Details on frame tagging (routing of packets H04L45/00; support for virtual LAN H04L49/354) · CPC title