Virtual traffic hub management

Patent metadata

Field	Value
Publication number	US-12316477-B2
Application number	US-202318481966-A
Country	US
Kind code	B2
Filing date	Oct 5, 2023
Priority date	Sep 19, 2018
Publication date	May 27, 2025
Grant date	May 27, 2025

Abstract

Connectivity is enabled between a first and second isolated network using a virtual traffic hub that includes resources of a cloud computing environment. The connectivity may include respective first and second Virtual Private Network (VPN) connections between the hub and the first and second isolated network at respective premises external to the cloud computing environment. At least a portion of a first packet received at the hub from the first isolated network via the first VPN connection is transmitted from the hub to the second isolated network via the second VPN connection.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
establishing a hub for packets transmitted between a plurality of networks, wherein the hub comprises resources of a cloud computing environment;
establishing, in a hub-and-spoke configuration associated with the hub, (a) a first Virtual Private Network (VPN) connection between the hub and a first network located at a first premise external to the cloud computing environment and (b) a second VPN connection between the hub and a second network located at a second premise external to the cloud computing environment;
receiving, at the hub, a first packet from the first network via the first VPN connection; and
transmitting at least a portion of contents of the first packet to the second network from the hub via the second VPN connection.

2. The computer-implemented method as recited in claim 1 , further comprising:
in response to one or more programmatic requests, associating a virtual network of the cloud computing environment with the hub, wherein the virtual network comprises a virtual machine; and
transmitting a second packet from the virtual machine to the first network via the hub.

3. The computer-implemented method as recited in claim 1 , further comprising:
in response to one or more programmatic requests, associating (a) a first virtual network of the cloud computing environment with the hub and (b) a second virtual network of the cloud computing environment with the hub, wherein the first virtual network comprises a first virtual machine, and wherein the second virtual network comprises a second virtual machine; and
transmitting a second packet from the first virtual machine to the second virtual machine via the hub.

4. The computer-implemented method as recited in claim 1 , further comprising:
receiving, from a client of the cloud computing environment, a programmatic request to create the hub, wherein said establishing the hub is responsive to the programmatic request to create the hub.

5. The computer-implemented method as recited in claim 1 , wherein the hub is implemented at least in part using one or more virtual machines of a virtualized computing service of the cloud computing environment.

6. The computer-implemented method as recited in claim 1 , further comprising:
receiving, from a client of the cloud computing environment, via one or more programmatic interfaces, an indication of a packet processing task to be performed at the hub on one or more packets transmitted, via the hub, between a pair of networks of the plurality of networks; and
performing, at the hub, the packet processing task on the one or more packets transmitted via the hub between the pair of networks.

7. The computer-implemented method as recited in claim 6 , wherein the packet processing task comprises an address substitution operation.

8. A system, comprising:
one or more computing devices;
wherein the one or more computing devices include instructions that upon execution on or across the one or more computing devices cause the one or more computing devices to:
establish a hub for packets transmitted between a plurality of networks, wherein the hub comprises resources of a cloud computing environment;
establish, in a hub-and-spoke configuration associated with the hub, (a) a first Virtual Private Network (VPN) connection between the hub and a first network located at a first premise external to the cloud computing environment and (b) a second VPN connection between the hub and a second network located at a second premise external to the cloud computing environment;
receive, at the hub, a first packet from the first network via the first VPN connection; and
transmit at least a portion of contents of the first packet to the second network from the hub via the second VPN connection.

9. The system as recited in claim 8 , wherein the one or more computing devices include further instructions that upon execution on or across the one or more computing devices further cause the one or more computing devices to:
in response to one or more programmatic requests, associate a virtual network of the cloud computing environment with the hub, wherein the virtual network comprises a virtual machine; and
transmit a second packet from the virtual machine to the first network via the hub.

10. The system as recited in claim 8 , wherein the one or more computing devices include further instructions that upon execution on or across the one or more computing devices further cause the one or more computing devices to:
in response to one or more programmatic requests, associate (a) a first virtual network of the cloud computing environment with the hub and (b) a second virtual network of the cloud computing environment with the hub, wherein the first virtual network comprises a first virtual machine, and wherein the second virtual network comprises a second virtual machine; and
transmit a second packet from the first virtual machine to the second virtual machine via the hub.

11. The system as recited in claim 8 , wherein the one or more computing devices include further instructions that upon execution on or across the one or more computing devices further cause the one or more computing devices to:
receive, from a client of the cloud computing environment, a programmatic request to create the hub, wherein the hub is established in response to the programmatic request to create the hub.

12. The system as recited in claim 8 , wherein the hub is implemented at least in part using one or more virtual machines of a virtualized computing service of the cloud computing environment.

13. The system as recited in claim 8 , wherein the one or more computing devices include further instructions that upon execution on or across the one or more computing devices further cause the one or more computing devices to:
receive, from a client of the cloud computing environment, via one or more programmatic interfaces, an indication of a packet processing task to be performed at the hub on one or more packets transmitted, via the hub, between a pair of networks of the plurality of networks; and
perform, at the hub, the packet processing task on the one or more packets transmitted via the hub between the pair of networks.

14. The system as recited in claim 13 , wherein the packet processing task comprises an address substitution operation.

15. One or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors cause the one or more processors to:
establish a hub for packets transmitted between a plurality of networks, wherein the hub comprises resources of a cloud computing environment;
establish, in a hub-and-spoke configuration associated with the hub, (a) a first Virtual Private Network (VPN) connection between the hub and a first network located at a first premise external to the cloud computing environment and (b) a second VPN connection between the hub and a second network located at a second premise external to the cloud computing environment;
receive, at the hub, a first packet from the first network via the first VPN connection; and
transmit at least a portion of contents of the first packet to the second network from the hub via the second VPN connection.

16. The one or more non-transitory computer-accessible storage media as recited in claim 15 , storing further program instructions that when executed on or across one or more processors further cause the one or more processors to:
in response to one or more programmatic requests, associate a virtual network of the clo

Assignees

• Amazon Tech Inc

Inventors

• Tillotson Paul John
• Deb Bashuman
• Spendley Thomas
• Hashmi Omer
• Qian Baihu
• Penney Alexander Justin

Classifications

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L61/4511

  using domain name system [DNS] · CPC title

• H04L47/2483

  involving identification of individual flows · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title