Methods and apparatus for remapping public network addresses on a network to an external network via a private communications channel

Patent metadata

Field	Value
Publication number	US-9628294-B1
Application number	US-201113069719-A
Country	US
Kind code	B1
Filing date	Mar 23, 2011
Priority date	Mar 23, 2011
Publication date	Apr 18, 2017
Grant date	Apr 18, 2017

Abstract

Methods and apparatus for remapping IP addresses of a network to endpoints within a different network. A provider network may allocate IP addresses and resources to a customer. The provider network may allow the customer to remap an IP address to an endpoint on the customer's network. When a packet is received from a client addressed to the IP address, the provider network may determine that the IP address has been remapped to the endpoint. The provider network may translate the source and destination addresses of the packet and encode the packet for transmission over a private communications channel. The encoded packet may be sent to the endpoint via the private communications channel over an intermediate network. Response traffic may be routed to the client through the provider network, or may be directly routed to the client by the customer network.

First claim

What is claimed is:

1. A provider network, comprising:
one or more server devices configured to:
assign subsets of a plurality of public Internet Protocol (IP) addresses to particular customers of the provider network as customer IP addresses, wherein the customer IP addresses are published external to the provider network and external to a customer network of the particular customers as addresses associated with one or more network devices on the provider network; and
maintain mapping information that indicates mappings of the customer IP addresses to particular endpoints, wherein the mappings are specified by the particular customers of the provider network, and wherein at least one customer IP address is currently mapped to an endpoint on the provider network and at least one other customer IP address is currently mapped to an endpoint external to the provider network;

the one or more network devices on the provider network configured to:
receive packets from client devices external to the provider network and external to the customer network, the packets indicating respective ones of the customer IP addresses as respective destination addresses and IP addresses of respective ones of the client devices as respective source addresses;
for at least some of the packets, determine, from the mapping information, whether a given customer IP address indicated by a given destination address of a given packet is currently mapped to a given endpoint on the provider network or is currently mapped to a given endpoint on the customer network external to the provider network;
based on the determination:
for a packet for which the customer IP address is currently mapped to a particular endpoint on the provider network, send the packet to the particular endpoint via the provider network; and
for another packet for which the customer IP address is currently mapped to a particular endpoint on the customer network external to the provider network:
translate the destination address of the other packet to determine a network address of the particular endpoint on the customer network;
encapsulate the other packet according to a private communications channel protocol to generate an encapsulated packet, wherein the encapsulated packet indicates the network address of the particular endpoint on the customer network as a destination address; and
send the encapsulated packet to the customer network via a private communications channel over a public network.

2. The provider network as recited in claim 1 , wherein the public network is the Internet.

3. The provider network as recited in claim 1 , wherein the encapsulated packet further indicates a network address of one of the one or more network devices on the provider network as a source address.

4. The provider network as recited in claim 3 , wherein the one or more network devices are further configured to:
receive a response packet encapsulated according to the private communications channel protocol from the customer network via the private communications channel, wherein the encapsulated response packet indicates the network address of the particular endpoint on the customer network as a source address and the network address of one of the one or more network devices on the provider network as a destination address;
translate the source address and the destination address of the encapsulated response packet to determine the customer IP address and the IP address of the client device;
strip the private communications channel protocol encapsulation from the response packet; and
send the response packet to the client device, wherein the response packet sent to the client device indicates the customer IP address as a source IP address and the IP address of the client device as a destination address.

5. The provider network as recited in claim 1 , wherein the provider network includes a separate customer private network for each of one or more of the customers of the provider network, wherein each customer private network includes one or more components of the provider network assigned to the respective customer.

6. The provider network as recited in claim 5 , wherein the one or more network devices on the provider network comprises a plurality of network devices, and wherein, for the other packet for which the customer IP address is currently mapped to the particular endpoint on the customer network external to the provider network:
one of the plurality of network devices receives the packet from the client device, determines that the destination address of the packet is mapped to the particular endpoint on the customer network external to the provider network, and routes the packet over a customer private network via one or more other network devices of the plurality of network devices, wherein at least one of the one or more other network devices is a component of the customer private network on the provider network; and
one of the one or more other network devices receives the packet via the customer private network, translates the destination address of the packet, encapsulates the packet according to the private communications channel protocol to generate the encapsulated packet, and sends the encapsulated packet to the customer network via the private communications channel.

7. The provider network as recited in claim 6 , wherein, to route the packet over the customer private network via the one or more other network devices, the one of the plurality of network devices encodes the packet according to a network protocol of the provider network to form a customer private network packet for transmission on the customer private network.

8. The provider network as recited in claim 6 , wherein a path over the customer private network via which the packet is routed includes one or more customer private network appliances configured to apply one or more customer private network-specific networking functions to packets routed through the network appliances.

9. The provider network as recited in claim 8 , wherein the one or more customer private network appliances include one or more of firewalls, packet inspection appliances, security appliances, acceleration caches, and load balancers.

10. The provider network as recited in claim 1 , wherein the provider network is a virtualized service provider network configured to provide a plurality of virtualized resource instances on the provider network to the customers of the provider network, wherein the provider network is configured to assign subsets of the plurality of virtualized resource instances to the customers as customer resource instances.

11. The provider network as recited in claim 10 , wherein the provider network is further configured to form a customer private network on the provider network for a particular customer, wherein the customer private network includes at least a subset of the plurality of virtualized resource instances assigned to the particular customer.

12. The provider network as recited in claim 10 , wherein the plurality of virtualized resource instances includes virtualized computation resources and virtualized storage resources.

13. The provider network as recited in claim 10 , wherein the mapping information maps at least one customer IP address to a customer resource instance assigned to a respective customer.

14. The provider network as recited in claim 10 , wherein the provider network further comprises one or more devices configured to implement at least one virtualization service and at least one application programming interface (API) to the at least one virtualization service, wherein the at least one virtualizati

Assignees

• Brandwine Eric J
• Dickinson Andrew B
• Amazon Tech Inc

Inventors

• Brandwine Eric J
• Dickinson Andrew B

Classifications

• H04L63/0272 Primary

  Virtual private networks · CPC title

• H04L12/4641 Primary

  Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272) · CPC title

• H04L69/16

  Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] · CPC title

• H04L61/2592

  using tunnelling or encapsulation · CPC title

• H04W80/06

  Transport layer protocols, e.g. TCP [Transport Control Protocol] over wireless {(transmission control protocol/Internet protocol [TCP/IP] or user datagram protocol [UDP] H04L69/16)} · CPC title