Back to results
US 10,476,738 B1Granted
Virtual network segmentation
AssigneeAmazon Technologies, Inc.
InventorNima Sharifi Mehr
Life of this patent
Estimating the term…
Abstract
Techniques for segmenting a network are described herein. Network locations in a network are grouped such that each group is disjoint with respect to all other groups. The grouping is based on a set of network communication event notifications. The network communication event notifications are used to determine internal and external dependencies for each group and the external and internal dependencies are used to segment the network.
Claims22
A computer-implemented method for segmenting a virtual network of a set of virtual machine instances;
- comprising:
- monitoring the virtual network to produce a set of network traffic data entries, each network traffic data entry of the set of network traffic data entries specifying a source network address of a first virtual machine instance of the set of virtual machine instances and a destination network address of a second virtual machine instance of the set of virtual machine instances;
- determining a set of network traffic patterns from the set of network traffic data entries, each network traffic pattern in the set of network traffic patterns based at least in part on one or more shared characteristics of a corresponding subset of the set of network traffic data entries;
- selecting subsets of the set of virtual machine instances based at least in part on the set of network traffic patterns, wherein each virtual machine instance of the set of virtual machine instances is in exactly one of the subsets;
- generating segmentation profile specifying routing rules for communications between and within subnetworks of the virtual network, each subnetwork of the virtual network corresponding to a subset of the set of virtual machine instances, the segmentation profile at least specifying a routing table for the virtual network;
- and
- segmenting the virtual network based at least in part on the segmentation profile to produce a segmented virtual network comprising the subnetworks, wherein each subnetwork is disjoint from the other subnetworks.
4 more elements
A system, comprising at least one computing device configured to implement one or more services, wherein the one or more services:
- generate a disjoint set of groups of network locations of a network, each group of the disjoint set of groups based at least in part on a set of network communication event notifications, each group of the disjoint set of groups including one or more network locations;
- determine, for each group, a set of internal dependencies for the network locations of the group, each internal dependency of the set of internal dependencies determined based at least in part on a corresponding first subset of the set of network communication event notifications;
- determine a set of external dependencies between the disjoint set of groups, each external dependency of the set of external dependencies determined based at least in part on a corresponding second subset of the set of network communication event notifications;
- provide a segmentation profile specifying configurations for routing communication between and within the disjoint set of groups based at least in part on the set of internal dependencies and based at least in part on the set of external dependencies;
- and
- segment the network based at least in part on the segmentation profile to produce a segmented network.
3 more elements
A non-transitory computer-readable storage medium comprising executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
- monitor a virtual network to determine a set of network traffic patterns of the virtual network, each network traffic pattern of the set of network traffic patterns based at least in part on one or more shared characteristics of a corresponding set of network communication event notifications, the virtual network including a set of virtual machine instances, each network communication event notification of the set of network communication event notifications specifying at least one location corresponding to a virtual machine instance of the set of virtual machine instances;
- generate a first segmentation profile for the virtual network, the first segmentation profile specifying routing rules for communications between and within a plurality of groups of virtual machine instances from the set of virtual machine instances, each group of the plurality of groups including one or more virtual machine instances;
- determine a set of internal dependencies corresponding to each group;
- determine a set of external dependencies corresponding to each group;
- refine the first segmentation profile based at least in part on the set of internal dependencies and the set of external dependencies to produce a second segmentation profile for the virtual network;
- and
- provide the second segmentation profile to an administrator of the virtual network.
4 more elements
Dependencies are inferred from the claim text.