US 10,951,586 B2Granted

Providing location-specific network access to remote services

AssigneeAmazon Technologies, Inc.

InventorsDaniel Todd Cohn, Eric Jason Brandwine, Andrew J. Doane

Life of this patent

Estimating the term…

Loading patent…

Abstract

Techniques are described for providing users with access to computer networks, such as to enable users to create and configure computer networks that are provided by a remote configurable network service for the users' use. Computer networks provided by the configurable network service may be configured to be private computer networks that are accessible only by the users who create them, and may each be created and configured by a client of the configurable network service to be an extension to an existing computer network of the client, such as a private computer network extension to an existing private computer network of the client. In addition, access to remote resource services may be configured and provided from such computer networks in various manners, such as to automatically include access control information to limit access to particular resources to computing nodes at the location of that provided computer network.

Claims20

Dependent claims

A computer-implemented method, comprising:

providing, by a configurable virtual network service implemented by at least one computer system, a plurality of virtual networks to respective customers of the configurable virtual network service, wherein each individual virtual network of the plurality of virtual networks includes one or more respective virtual machines executing on respective physical machines of the configurable virtual network service and wherein each individual virtual network of the plurality of virtual networks is associated with multiple specified Internet Protocol (“IP”) addresses to be assigned within the individual virtual network;
receiving, by the configurable virtual network service, one or more requests to make an online service available from within a virtual network of the plurality of virtual networks, wherein the online service is external to the virtual network;
assigning, by the configurable virtual network service, a first IP address of the multiple specified IP addresses of the virtual network to a first access mechanism for the online service from within the virtual network;
assigning, by the configurable virtual network service, a second IP address of the multiple specified IP addresses of the virtual network to a second access mechanism for the online service from within the virtual network;
configuring, by the configurable virtual network service, a communication manager executing on a physical machine hosting one or more virtual machines in the virtual network, to route communications sent by the one or more virtual machines to the first IP address to the first access mechanism via a substrate network, and to route communications sent by the one or more virtual machines to the second IP address to the second access mechanism via the substrate network;
configuring, by the configurable virtual network service, the first access mechanism to modify communications from the virtual network directed to the online service to include a first unique identifier representative of authorized access to a first namespace within the online service that corresponds to a first subset of resources;
configuring, by the configurable virtual network service, the second access mechanism to modify communications from the virtual network directed to the online service to include a second unique identifier representative of authorized access to a second namespace within the online service that corresponds to a second subset of resources;
and
configuring, by the configurable virtual network service, the first access mechanism and the second access mechanism to forward communications from the virtual network to the online service.

6 more elements

A non-transitory computer-readable medium with stored contents that cause one or more computing systems of a configurable virtual network service to:

provide a plurality of virtual computer networks to respective customers of the configurable virtual network service, wherein each individual virtual computer network of the plurality of virtual computer networks includes one or more respective virtual machines executing on one or more respective physical machines of the configurable virtual network service and wherein each individual virtual computer network of the plurality of virtual computer networks is associated with multiple specified Internet Protocol (“IP”) addresses to be assigned within the individual virtual computer network;
receive one or more requests to make an online service available from within a virtual computer network of the plurality of virtual computer networks, wherein the online service is external to the virtual computer network;
assign a first IP address of the multiple specified IP addresses of the virtual computer network to a first access mechanism for the online service from within the virtual computer network;
assign a second IP address of the multiple specified IP addresses of the virtual computer network to a second access mechanism for the online service from within the virtual computer network;
configure a communication manager executing on a physical machine hosting one or more virtual machines in the virtual computer network, to route communications sent by the one or more virtual machines to the first IP address to the first access mechanism via a private network of the configurable virtual network service, and to route communications sent by the one or more virtual machines to the second IP address to the second access mechanism via the private network;
configure the first access mechanism to modify communications from the virtual computer network directed to the online service to include a first unique identifier representative of authorized access to a first namespace within the online service that corresponds to a first subset of resources;
configure the second access mechanism to modify communications from the virtual computer network directed to the online service to include a second unique identifier representative of authorized access to a second namespace within the online service that corresponds to a second subset of resources;
and
configure the first access mechanism and the second access mechanism to forward communications from the virtual computer network to the online service.

6 more elements

A system, comprising:

one or more hardware processors;
and
one or more memories with stored instructions that, when executed by at least one of the one or more hardware processors, cause the system to implement a configurable virtual network service that performs:
providing a plurality of virtual computer networks to respective customers of the configurable virtual network service, wherein each individual virtual computer network of the plurality of virtual computer networks includes one or more respective virtual machines executing on one or more respective physical machines of the configurable virtual network service and wherein each individual virtual computer network of the plurality of virtual computer networks is associated with multiple specified Internet Protocol (“IP”) addresses to be assigned within the individual virtual computer network;
receiving a request from a customer of the respective customers to make an online service available from within a virtual computer network of the plurality of virtual computer networks, wherein the online service is external to the virtual computer network;
assigning a first IP address of the multiple specified IP addresses of the virtual computer network to a first access mechanism for the online service from within the virtual computer network;
assigning a second IP address of the multiple specified IP addresses of the virtual computer network to a second access mechanism for the online service from within the virtual computer network;
configuring a communication manager executing on a physical machine hosting one or more virtual machines in the virtual computer network, to route communications sent by the one or more virtual machines to the first IP address to the first access mechanism via one or more computer networks external to the virtual computer network, and to route communications sent by the one or more virtual machines to the second IP address to the second access mechanism via the one or more computer networks external to the virtual computer network;
configuring the first access mechanism to modify communications from the virtual computer network directed to the online service to include a first unique identifier representative of authorized access to a first namespace within the online service that corresponds to a first subset of resources,
configuring the second access mechanism to modify communications from the virtual computer network directed to the online service to include a second unique identifier representative of authorized access to a second namespace within the online service that corresponds to a second subset of resources;
and
configuring the first access mechanism and the second access mechanism to forward communications from the virtual computer network to the online service.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/382,403Filed 16 Dec 2016 · continuation
Priority: 10 Dec 2008
Published: US 2017/0099260 A16 Apr 2017
Granted: 16 Mar 2021
Term ends: Not estimatedThe source records don’t support an estimate.

Classification14 codes

H04L 63/0272
For separating internal from external traffic, e.g. firewalls: virtual private networks
G06F 9/30098
Arrangements for executing machine instructions, e.g. instruction decode: register arrangements
G06F 9/384
Dependency mechanisms, e.g. register scoreboarding: register renaming
G06F 9/3842
Instruction issuing, e.g. dynamic instruction scheduling or out of order instruction execution: speculative instruction execution