Virtual private gateway for encrypted communication over dedicated physical link

Patent metadata

Field	Value
Publication number	US-12381850-B2
Application number	US-202318487575-A
Country	US
Kind code	B2
Filing date	Oct 16, 2023
Priority date	Dec 5, 2016
Publication date	Aug 5, 2025
Grant date	Aug 5, 2025

Abstract

A request to establish an encrypted VPN connection between a network and the provider network via a dedicated direct physical link and a set of resources of the provider network is received. An isolated virtual network (IVN) is established to implement an encryption virtual private gateway to be used for the connection. Protocol processing engines (PPEs) are instantiated within the IVN, address information of the PPEs is exchanged with the external network and an encrypted VPN tunnel is configured between the PPEs and the external network. Routing information pertaining to the set of resources is provided to the external network via at least one of the encrypted VPN tunnels, enabling routing of customer data to the set of resources within the provider network from the external network via an encrypted VPN tunnel implemented over a dedicated direct physical link between the external network and the provider network.

First claim

What is claimed is:

1. A system comprising:
a plurality of instance hosts comprising computing devices configured to host one or more instances; and
one or more computing devices of a provider network configured to implement a connectivity manager configured to provide a high availability virtual private network (VPN), wherein to provide the high availability VPN, the connectivity manager is configured to cause a virtual private gateway to be established for a virtual network including the one or more hosted instances, wherein to establish the virtual private gateway, the connectivity manager is configured to:
assign the one or more instances to the virtual private gateway;
provide one or more virtual network interfaces to the one or more instances; and
implement one or more protocol processing engines for exchanging routing information with a network external to the provider network,

wherein the one or more protocol processing engines are configured to:
establish a border gateway protocol (BGP) session to exchange routing information for the one or more instances assigned to the virtual private gateway with the network external to the provider network, wherein the BGP session is established via the one or more virtual network interfaces and a network link established between the provider network and the network external to the provider network;
establish, using the exchanged routing information, a plurality of VPN tunnels between the network external to the provider network and the one or more instances assigned to the virtual private gateway via the network link;
establish additional respective BGP sessions within respective ones of the plurality of VPN tunnels to exchange routing information of one or more instances included in the virtual network with the network external to the provider network, wherein establishment of the additional respective BGP sessions within the respective ones of the plurality of VPN tunnels provides encrypted communication channels for the exchange of the routing information to the network external to the provider network; and
enable encrypted communications to flow between the one or more instances included in the virtual network and the network external to the provider network via the plurality of VPN tunnels implemented via the network link.

2. The system of claim 1 , wherein two or more instances are assigned to the virtual private gateway, and wherein each of the two or more instances are configured to perform said establishing a BGP session, said establishing a VPN tunnel, said establishing additional respective BGP sessions, and said enabling encrypted communications, such that two or more VPN tunnels are established that each enable encrypted communications to flow between the one or more instances included in the virtual network and the network external to the provider network.

3. The system of claim 1 , wherein the plurality of VPN tunnels are implemented in accordance with an IPSec protocol.

4. The system of claim 1 , wherein the plurality of instance hosts implement one or more virtual machines.

5. The system of claim 1 , wherein said establishing the plurality of virtual private network (VPN) tunnels between the external network and the one or more instances assigned to the virtual private gateway comprises establishing two VPN tunnels between the external network and the one or more instances assigned to the virtual private gateway.

6. The system of claim 1 , wherein one or more edge routers used to implement the network link are located at a co-location facility.

7. The system of claim 1 , wherein the one or more protocol processing engines are implemented on one or more virtual machines.

8. The system of claim 1 , wherein:
the network link established between the provider network and the network external to the provider network is implemented via a plurality of physical connections; and
the connectivity manager is further configured to:
detect a failure of a first one of the plurality of physical connections; and
automatically failover the encrypted communications to flow over a remaining one of the plurality of physical connections.

9. A method of providing a high-availability virtual private network (VPN), the method comprising:
establishing a virtual private gateway for a virtual network implemented within a provider network, wherein establishing the virtual private gateway comprises:
assigning one or more instances within the provider network to the virtual private gateway;
providing one or more virtual network interfaces to the one or more instances;
implementing one or more protocol processing engines on one or more instance hosts, hosting the one or more instances, for exchanging routing information with an external network, external to the provider network;
establishing, via the one or more protocol processing engines, a border gateway protocol (BGP) session to exchange routing information for the one or more instances assigned to the virtual private gateway with the external network, wherein the BGP session is established via the one or more virtual network interfaces and a network link established between the provider network and the external network;
establishing, using the exchanged routing information, a plurality of VPN tunnels between the external network and the one or more instances assigned to the virtual private gateway via the network link;
establishing, via the one or more protocol processing engines, additional respective BGP sessions within the plurality of VPN tunnels to exchange routing information of one or more instances included in the virtual network with the external network, wherein establishment of the additional respective BGP sessions within the plurality of VPN tunnels provides an encrypted communication channel for the exchange of the routing to the external network; and
enabling encrypted communications to flow between the one or more instances included in the virtual network and the external network via the plurality of VPN tunnels implemented via the network link.

10. The method of claim 9 , wherein said establishing the plurality of virtual private network (VPN) tunnels between the external network and the one or more instances assigned to the virtual private gateway comprises establishing two VPN tunnels between the external network and the one or more instances assigned to the virtual private gateway.

11. The method of claim 10 , wherein the two VPN tunnels encrypt network traffic in accordance with an IPSec protocol.

12. The method of claim 9 , wherein the one or more instances implement one or more virtual machines.

13. The method of claim 9 , wherein one or more edge routers used to implement the network link are located at a co-location facility.

14. The method of claim 9 , wherein the one or more protocol processing engines are implemented on one or more virtual machines.

15. The method of claim 9 , wherein to establish the plurality of virtual private network tunnels, the one or more virtual network interfaces for the protocol processing engines are configured to use VLAN tags.

16. The method of claim 9 , further comprising:
detecting a failure of a first one of the plurality of VPN tunnels; and
causing an automatic failover, wherein the encrypted communications flow over a remaining one of the plurality of VPN tunnels.

17. One or more non-transitory, computer-readable storage media, storing program instructions, that when executed implement a high-availability virtual private network (VPN), wherein to implement the high-availability VPN the program instructi

Assignees

• Amazon Tech Inc

Inventors

• Chen Po-Chun
• Hashmi Omer
• Bhal Sanjay

Classifications

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L12/4633

  Interconnection of networks using encapsulation techniques, e.g. tunneling · CPC title

• H04L12/66

  Arrangements for connecting between networks having differing types of switching systems, e.g. gateways · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title