Network configuration analysis and management

Patent metadata

Field	Value
Publication number	US-12348571-B2
Application number	US-202418741445-A
Country	US
Kind code	B2
Filing date	Jun 12, 2024
Priority date	Dec 10, 2021
Publication date	Jul 1, 2025
Grant date	Jul 1, 2025

Abstract

Systems and methods are provided for obtaining policy data associated with a private network implemented at least partly within a cloud provider network; establishing, based on the policy data, a first segment within the private network, wherein in a first geographic region of the cloud provider network, traffic associated with the first segment is isolated from traffic associated with a second segment of the private network, and wherein in a second geographic region of the cloud provider network, traffic associated with the first segment is isolated from traffic associated with a third segment of the private network; obtaining metadata indicating an isolated network of the cloud provider network is associated with the first segment; and enabling the isolated network to communicate, over the first segment, across the first geographic region and the second geographic region.

First claim

What is claimed is:

1. A computer-implemented method comprising: under control of a computing system comprising memory and one or more computer processors configured to execute specific instructions: obtaining policy data associated with a private network implemented at least within a cloud provider network;
establishing, based on the policy data, a first segment within the private network, wherein in a first geographic region of the cloud provider network, traffic associated with the first segment is isolated from traffic associated with a second segment of the private network, and wherein in a second geographic region of the cloud provider network, traffic associated with the first segment is isolated from traffic associated with a third segment of the private network; obtaining metadata indicating an isolated network of the cloud provider network is associated with the first segment; and enabling the isolated network to communicate, over the first segment, across the first geographic region and the second geographic region.

2. The computer-implemented method of claim 1 , wherein establishing the first segment comprises:
configuring a gateway node in the first geographic region to isolate the traffic associated with the first segment; and
configuring a second gateway node in the second geographic region to isolate the traffic associated with the first segment.

3. The computer-implemented method of claim 1 , further comprising:
determining that the policy data indicates acceptance is required to enable the isolated network to communicate over the first segment; and
receiving acceptance data representing approval to enable the isolated network to communicate over the first segment, wherein the isolated network is enabled to communicate over the first segment in response to receiving the acceptance data.

4. The computer-implemented method of claim 1 , further comprising:
determining, based on the policy data, that isolated networks enabled to communicate over the first segment are prohibited from communicating with each other over the first segment; and
preventing the isolated network from communicating with a second isolated network associated with the first segment.

5. The computer-implemented method of claim 4 , further comprising:
enabling, based on the policy data, communications between the isolated network and a shared resource segment; and
enabling, based on the policy data, communications between the second isolated network and the shared resource segment.

6. The computer-implemented method of claim 1 , further comprising determining, based on the policy data, a subset of geographic regions of the cloud provider network in which the first segment is to be established, wherein the subset of geographic regions of the cloud provider network comprises fewer than all geographic regions of the cloud provider network.

7. The computer-implemented method of claim 6 , further comprising determining, based on the policy data, a second subset of geographic regions of the cloud provider network in which a second segment is to be established, wherein the second subset of geographic regions of the cloud provider network is different than the subset of geographic regions of the cloud provider network.

8. The computer-implemented method of claim 7 , further comprising determining, based on the policy data, to deny sharing of a route from the second segment with the first segment.

9. The computer-implemented method of claim 7 , further comprising determining, based on the policy data, to permit sharing of a route from the second segment with the first segment.

10. The computer-implemented method of claim 7 , further comprising generating a graphical user interface comprising:
a first display object representing the first segment;
a second display object representing the second segment;
a third display object representing an attachment of the isolated network to the first segment; and
a fourth display object representing a path shared between the first segment and the second segment.

11. A system comprising: computer-readable memory storing executable instructions; and one or more processors in communication with the computer-readable memory and programmed by the executable instructions to: obtain policy data associated with a private network implemented at least within a cloud provider network; establish based on the policy data, a first segment within the private network, wherein in a first geographic region of the cloud provider network, traffic associated with the first segment is isolated from traffic associated with a second segment of the private network, and wherein in a second geographic region of the cloud provider network, traffic associated with the first segment is isolated from traffic associated with a third segment of the private network; obtain metadata indicating an isolated network of the cloud provider network is associated with the first segment; and enable the isolated network to communicate, over the first segment, across the first geographic region and the second geographic region.

12. The system of claim 11 , wherein to establish the first segment, the one or more processors are further programmed by the executable instructions to:
configure a gateway node in the first geographic region to isolate the traffic associated with the first segment; and
configure a second gateway node in the second geographic region to isolate the traffic associated with the first segment.

13. The system of claim 11 , wherein the one or more processors are further programmed by the executable instructions to:
determine that the policy data indicates acceptance is required to enable the isolated network to communicate over the first segment; and
receive acceptance data representing approval to enable the isolated network to communicate over the first segment, wherein the isolated network is enabled to communicate over the first segment in response to receiving the acceptance data.

14. The system of claim 11 , wherein the one or more processors are further programmed by the executable instructions to:
determine, based on the policy data, that isolated networks enabled to communicate over the first segment are prohibited from communicating with each other over the first segment; and
prevent the isolated network from communicating with a second isolated network associated with the first segment.

15. The system of claim 14 , wherein the one or more processors are further programmed by the executable instructions to:
enable, based on the policy data, communications between the isolated network and a shared resource segment; and
enable, based on the policy data, communications between the second isolated network and the shared resource segment.

16. The system of claim 11 , wherein the one or more processors are further programmed by the executable instructions to determine, based on the policy data, a subset of geographic regions of the cloud provider network in which the first segment is to be established, wherein the subset of geographic regions of the cloud provider network comprises fewer than all geographic regions of the cloud provider network.

17. The system of claim 16 , wherein the one or more processors are further programmed by the executable instructions to determine, based on the policy data, a second subset of geographic regions of the cloud provider network in which a second segment is to be established, wherein the second subset of geographic regions of the cloud provider network is different than the subset of geographic regions of the cloud provider net

Assignees

• Amazon Tech Inc

Inventors

• Qian Baihu
• Deb Bashuman
• Hsieh Justin Lin
• Dacosta Daniel William
• Matthews Nick
• Heorhiadi Viktor
• Ramamoorthi Lalith Kumar
• Dawani Anoop
• Hashmi Omer
• Spendley Thomas Nguyen

Classifications

• H04L47/20

  Traffic policing · CPC title

• H04L12/4675 Primary

  Dynamic sharing of VLAN information amongst network nodes (configuration of the network or of network elements H04L41/08) · CPC title

• H04L45/24

  Multipath · CPC title

• H04L63/0272

  Virtual private networks · CPC title

• H04L41/0893

  Assignment of logical groups to network elements · CPC title