Providing location-specific network access to remote services

Patent metadata

Field	Value
Publication number	US-9524167-B1
Application number	US-33224108-A
Country	US
Kind code	B1
Filing date	Dec 10, 2008
Priority date	Dec 10, 2008
Publication date	Dec 20, 2016
Grant date	Dec 20, 2016

Abstract

Techniques are described for providing users with access to computer networks, such as to enable users to create and configure computer networks that are provided by a remote configurable network service for the users' use. Computer networks provided by the configurable network service may be configured to be private computer networks that are accessible only by the users who create them, and may each be created and configured by a client of the configurable network service to be an extension to an existing computer network of the client, such as a private computer network extension to an existing private computer network of the client. In addition, access to remote resource services may be configured and provided from such computer networks in various manners, such as to automatically include access control information to limit access to particular resources to computing nodes at the location of that provided computer network.

First claim

What is claimed is:

1. A computer-implemented method comprising:
configuring, by one or more computing systems of a service provider, a first private virtual computer network that is provided by the service provider and includes multiple computing nodes, the configuring including associating the multiple computing nodes with multiple network addresses from a plurality of network addresses specified for use with the first private virtual computer network, and further including assigning one of the plurality of network addresses separate from the multiple network addresses to represent, within the first private virtual computer network, a remote resource service external to the first private virtual computer network;
restricting, by the one or more computing systems, communications sent by the multiple computing nodes to only destinations indicated by the plurality of network addresses;
associating, by the one or more computing systems and with the assigned network address, an identifier that represents a location of the first private virtual computer network, wherein the identifier is an indicator supplied by the service provider for use by the remote resource service in validating that communications are sent from the location of the first private virtual computer network;
modifying, by the one or more computing systems, a communication that is sent to the assigned network address by one of the multiple computing nodes to cause the modified communication to include the identifier; and
forwarding, by the one or more computing systems,

the modified communication to the remote resource service via one or more networks external to the first private virtual computer network.

2. The method of claim 1 wherein the forwarded modified communication relates to accessing one or more computing-related resources from the remote resource service, and wherein the method further comprises storing, by the remote resource service, information to enable later access to the one or more computing-related resources from a later communication only if the later communication includes the identifier.

3. The method of claim 2 further comprising, under control of one or more additional computing systems of the remote resource service:
receiving the forwarded modified communication;
determining that the identifier in the received forwarded modified communication corresponds to the location of the first private virtual computer network; and
providing, in response to the determining, access to the one or more computing-related resources.

4. The method of claim 3 further comprising, under the control of the one or more additional computing systems:
receiving one or more later communications that request access to at least one of the one or more computing-related resources;
performing a determination of whether the one or more later communications include the identifier; and
providing the requested access to the at least one of the one or more computing-related resources only if the performed determination indicated that the one or more later communications include the identifier.

5. The method of claim 2 wherein the one or more computing-related resources are created by the remote resource service in response to the modified communication forwarded to the remote resource service.

6. The method of claim 2 wherein the first private virtual computer network is provided by the service provider for use by a first customer of the service provider, and wherein the method further comprises preventing, based at least in part on not making the identifier available to the first customer, the first customer from later accessing the one or more computing-related resources from the remote resource service using a computing device that is not part of the first private virtual computer network.

7. The method of claim 2 wherein the identifier is an indication of a geographical location of the multiple computing nodes of the first private virtual computer network.

8. The method of claim 1 wherein the identifier is specific to the first private virtual computer network, and wherein the location of the first private virtual computer network is an indication of the first private virtual computer network.

9. The method of claim 1 wherein the first private virtual computer network is provided by the service provider for use by a first customer of the service provider, and wherein the identifier is associated with the first customer by the service provider.

10. The method of claim 1 further comprising associating the identifier with a distinct second network address of the plurality of network addresses that is assigned to represent a second remote resource service, and, for an additional communication sent to the distinct second network address by one or more of the multiple computing nodes, modifying the additional communication to include an indication of the identifier before forwarding the modified additional communication to the second remote resource service.

11. The method of claim 1 wherein the one or more networks external to the first private virtual computer network are public networks external to the service provider.

12. The method of claim 1 wherein the configuring of the first private virtual computer network is performed in response to one or more requests that are programmatically made based on invocations of one or more programmatic interfaces provided by the service provider for use in configuring private computer networks being provided by the service provider, and
wherein the configuring of the first private virtual computer network includes restricting the multiple computing nodes of the first private virtual computer network from accessing computing systems that are not associated with any of the plurality of network addresses.

13. The method of claim 1 wherein the first private virtual computer network is overlaid on a physical substrate network of the service provider that interconnects a plurality of computing nodes provided by the service provider, wherein the remote resource service has a configured local access point that is part of the physical substrate network, and wherein the forwarding of the modified communication sent to the assigned network address includes providing the modified communication to the configured local access point.

14. The method of claim 1 wherein the remote resource service is a data storage service, a program execution service, or an asynchronous message passing service, and provides computing-related resources for clients of the remote resource service.

15. The method of claim 1 wherein the forwarding of the modified communication further includes determining, by the one or more computing systems, that the one of the multiple computing nodes is authorized to send communications to the remote resource service.

16. The method of claim 15 wherein the determining that the one of the multiple computing nodes is authorized includes using one or more configuration parameters specified for the first private virtual computer network.

17. The method of claim 15 wherein the determining that the one of the multiple computing nodes is authorized includes using one or more configuration parameters specified for the one of the multiple computing nodes.

18. The method of claim 1 wherein the remote resource service includes a web service operated by the service provider.

19. A non-transitory computer-readable medium having stored contents that cause a computing system of a service provider to:
configure, by the computing syste

Assignees

• Cohn Daniel T
• Brandwine Eric Jason
• Doane Andrew J
• Amazon Tech Inc

Inventors

• Cohn Daniel T
• Brandwine Eric Jason
• Doane Andrew J

Classifications

• G06F9/384

  Register renaming · CPC title

• G06F9/3885

  using a plurality of independent parallel functional units · CPC title

• H04L12/4641

  Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272) · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title

• H04L12/4675

  Dynamic sharing of VLAN information amongst network nodes (configuration of the network or of network elements H04L41/08) · CPC title