Configure interconnections between networks hosted in datacenters

Patent metadata

Field	Value
Publication number	US-9306949-B1
Application number	US-201313795402-A
Country	US
Kind code	B1
Filing date	Mar 12, 2013
Priority date	Mar 12, 2013
Publication date	Apr 5, 2016
Grant date	Apr 5, 2016

Abstract

Systems, methods and computer-readable media are described for connecting private networks that may otherwise be isolated. More particularly, the private networks may include private clouds that may be operated on a plurality of datacenters. A determination may be made as to whether network connections between the private clouds may be established and as to what compute resources of the private clouds may be exposed to the network connections. This determination may be used to generate virtual network paths that may be configured to route traffic between the private clouds.

First claim

What is claimed is:

1. A system for configuring communication between virtualized private networks, the system comprising:
one or more datacenters comprising one or more computing devices configured to communicate with each other over network connections within the one or more datacenters;
the one or more computing devices further configured to host a first virtualized private network comprising a first compute instance hosted on the one or more computing devices, the first virtualized private network being associated with a first entity;
the one or more computing devices further configured to host a second virtualized private network comprising a second compute instance hosted on the one or more computing devices, the second virtualized private network associated with a second entity, wherein the second virtualized private network is isolated from the first virtualized private network and wherein the first entity is different from the second entity; and
one or more memories having stored therein computer-readable instructions that, upon execution on the system, cause the system to at least:
determine that the first entity has authorized the second entity to access the first compute instance;
provide the second compute instance with a network address associated with the first virtualized private network via the network connections; and
route a communication that is addressed with the network address from the second compute instance to the first compute instance via the network connections.

2. The system of claim 1 , wherein the communication comprises a packet, and wherein the instructions that, upon execution on the system, cause the system to at least route the communication further cause the system to at least:
encapsulate the packet with an identifier associated with the first virtualized network and an address associated with a computing device from the one or more computing devices, the first compute instance being instantiated on the computing device.

3. The system of claim 1 , wherein the first and second virtualized networks are further configured to communicate with a public network.

4. A method for connecting two or more networks hosted on a private network, the method comprising:
verifying that a second network has permission to access a first network by receiving information indicative of an authorization to access the first network from a computing node associated with a second entity, wherein the authorization is provided to the second entity from a first entity, the first and second entities being different from each other, the first network being associated with the first entity, the second network being associated with the second entity, and the first network and the second network being isolated from each other, wherein the first network is inaccessible to the second network except by way of the address of the first computing node;
identifying a first computing node of the first network associated with the permission; and
generating a network path between the first network and the second network by way of the private network, the network path being based at least in part on an address of the first computing node.

5. The method of claim 4 , wherein the first network is a first virtualized private network, wherein the second network is a second virtualized private network.

6. The method of claim 4 , wherein the verifying that the second network has permission to access the first network comprises receiving information indicative of the permission from a computing node associated with the first entity.

7. The method of claim 4 , wherein the verifying that the second network has permission to access the first network comprises a first verification that the access is permitted and a second verification that the access is permitted, wherein the first verification is associated with verifying the first entity, and wherein the second verification is associated with verifying the second entity.

8. The method of claim 4 , wherein the identifying the first computing node of the first network comprises receiving the address of the first computing node.

9. The method of claim 8 , wherein the address is an internet protocol (IP) address.

10. The method of claim 9 , wherein the IP address is a public IP address of a router that is configured to route traffic to the first computing node, wherein the first network includes the router.

11. The method of claim 4 , wherein generating the network path comprises:
generating a routing table associated with the address of the first computing node; and
providing the routing table to a router of the private network, wherein the first network and the second network do not include the router.

12. The method of claim 4 , further comprising:
verifying that the first network has permission to access the second network;
identifying a second computing node of the second network associated with the permission; and
providing an address of the second computing node to the first network.

13. A non-transitory computer-readable medium comprising instructions that, upon execution on a system of a private network comprising a plurality of computing nodes, cause the system to perform operations comprising:
determining that a first entity associated with a first computing node of the plurality of computing nodes has allowed a second entity associated with a second computing node of the plurality of computing nodes to access the first computing node by way of the private network, wherein the first computing node is on a virtualized network that is isolated from the second computing node and wherein the first entity is different from the second entity, and wherein the virtualized network is inaccessible to the second computing node except by way of the address of the first computing node, the first computing node being previously inaccessible by the second computing node;
identifying a compute resource of the first computing node that the first entity has allowed the second entity to access by way of the second computing node; and
generating a network connection between the second computing node and the compute resource based at least in part on the identification of the compute resource, the network connection comprising a third computing node of the plurality of computing nodes.

14. The non-transitory computer-readable medium of claim 13 , wherein determining that the first entity has allowed the second entity to access the first computing node by way of the private network comprises:
transmitting first data to a computing device associated with the first entity; and
verifying that second data matches the first data, wherein the second data is received from a computing device associated with the second entity.

15. The non-transitory computer-readable medium of claim 13 , wherein identifying the compute resource comprises generating an interface configured for use by the first entity and a receipt by way of the interface an address or a description of the compute resource.

16. The non-transitory computer-readable medium of claim 13 , wherein the first computing node is a first virtual computing node, wherein the second computing node is a second virtual computing node, and wherein the compute resource is a compute instance.

17. The non-transitory computer-readable medium of claim 16 , wherein the network connection comprises a virtual network path between the first virtual computing node and the second virtual computing node.

18. The non-transitory computer-readable medium of claim 17 , wherein the virtual networ

Assignees

• Amazon Tech Inc

Inventors

• Richard Jacques Joshua
• Hill Peter John

Classifications

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L63/0272

  Virtual private networks · CPC title

• H04L12/2859

  Point-to-point connection between the data network and the subscribers (encapsulation H04L12/4633; virtual LANs H04L12/4641; routing of packets H04L45/00) · CPC title