# US 11,909,586 B2 · Managing communications in a virtual network of virtual machines using telecommunications infrastructure systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,586 B2 - Document ID: US11909586B2 - Status: Granted - Kind: B2 - Application number: 18/047,239 - Filed: 2022-10-17 - Published: 2023-03-09 - Granted: 2024-02-20 - Earliest claimed: 2009-03-30 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Daniel Todd Cohn; Eric Jason Brandwine; Andrew J. Doane - Web page: https://patentgrep.com/patent/US11909586B2 ## CPC - G06F 9/5077: {Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455)} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 41/0803: Configuration setting - H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play - H04L 41/0893: Assignment of logical groups to network elements - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L 41/12: Discovery or management of network topologies - H04L 45/00: Routing or path finding of packets in data switching networks (routing or path finding in wireless networks H04W40/00) - H04L 45/02: Topology update or discovery - H04L 45/76: Routing in software-defined topologies, e.g. routing between virtual machines - H04L 61/10: of different types - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - G06F 2209/5011: Pool - H04L 41/0213: Standardised network management protocols, e.g. simple network management protocol [SNMP] - H04L 41/122: of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV] - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques are described for providing logical networking functionality for managed computer networks, such as for virtual computer networks provided on behalf of users or other entities. In some situations, a user may configure or otherwise specify a network topology for a virtual computer network, such as a logical network topology that separates multiple computing nodes of the virtual computer network into multiple logical sub-networks and/or that specifies one or more logical networking devices for the virtual computer network. After a network topology is specified for a virtual computer network, logical networking functionality corresponding to the network topology may be provided in various manners, such as without physically implementing the network topology for the virtual computer network. In some situations, the computing nodes may include virtual machine nodes hosted on one or more physical computing machines or systems, such as by or on behalf of one or more users. ## Claims ### Claim 1 A method, comprising: performing, by one or more computing systems of a telecommunications infrastructure provider: managing, by a communication manager, communications to and from a computing node in a virtual computer network of computing nodes, wherein the computing nodes are virtual machine instances hosted on physical hosts in a substrate network of the telecommunications infrastructure provider, wherein the communication manager is implemented on a first physical host of the physical hosts and includes a switch that physically connects to the substrate network, wherein the managing comprises: storing configuration information about the virtual computer network; receiving, from the substrate network, a first communication addressed to the computing node hosted on the first physical host; based at least in part on the configuration information, modifying the first communication and forwarding the first communication to the computing node; receiving, from the substrate network, a second communication addressed to the computing node; and based at least in part on the configuration information, dropping the second communication without forwarding the second communication to the computing node, and wherein the managing further comprises: in response to an address resolution protocol (ARP) communication from the computing node regarding a second computing node in the virtual computer network, sending a spoofed response to the ARP communication indicating a virtual hardware address of the second computing node. ### Claim 2 (depends on 1) The method of claim 1, wherein the managing comprises: identifying a substrate network address of a destination of the first communication from a header of the first communication; retrieving, from a mapping information, a virtual network address of the computing node that is mapped to the substrate network address; and modifying the first communication to indicate the virtual network address as the destination of the first communication. ### Claim 3 (depends on 2) The method of claim 2, wherein the managing comprises: obtaining the mapping information from a system manager of the telecommunications infrastructure provider. ### Claim 4 (depends on 2) The method of claim 2, wherein the managing comprises: verifying, using the mapping information, that a source substrate network address in the header of the first communication is mapped to a known virtual network address in the virtual computer network. ### Claim 5 (depends on 1) The method of claim 1, wherein: the first physical host hosts computing nodes of at least two virtual computer networks; and the method comprises maintaining, by the communication manager, network isolation among the at least two virtual computer networks. ### Claim 6 (depends on 1) The method of claim 1, wherein the managing comprises: assigning a new virtual network address to a new computing node of the virtual computer network according to a dynamic host configuration protocol (DHCP). ### Claim 7 (depends on 1) The method of claim 1, wherein the configuration information specifies a topology of the virtual computer network. ### Claim 8 (depends on 1) The method of claim 1, wherein: the configuration information for the virtual computer network specifies one or more network access constraints for the virtual computer network; and the method comprises the communication manager enforcing the one or more network access constraints of the virtual computer network. ### Claim 9 (depends on 1) The method of claim 1, wherein the configuration information is received via a graphical user interface implemented by the one or more computing systems. ### Claim 10 (depends on 1) The method of claim 1, wherein the configuration information is received via a programmatic interface implemented by the one or more computing systems. ### Claim 11 A system, comprising: one or more computing systems of a telecommunications infrastructure provider, wherein the one or more computing systems include one or more hardware processors and associated memory that stores instructions that are executable on the one or more hardware processors to cause the one or more computing systems to: manage, using a communication manager, communications to and from a computing node in a virtual computer network of computing nodes, wherein the computing nodes are virtual machine instances hosted on physical hosts in a substrate network of the telecommunications infrastructure provider, wherein the communication manager is implemented on a first physical host of the physical hosts and includes a switch that physically connects to the substrate network, wherein to manage the communications to and from the computing node, the communication manager is configured to: store configuration information about the virtual computer network; receive, from the substrate network, a first communication addressed to the computing node hosted on the first physical host; based at least in part on the configuration information, modify the first communication and forward the first communication to the computing node; receive, from the substrate network, a second communication addressed to the computing node; and based at least in part on the configuration information, drop the second communication without forwarding the second communication to the computing node, and wherein the communication manager is further configured to: in response to an address resolution protocol (ARP) communication from the computing node regarding a second computing node in the virtual computer network, send a spoofed response to the ARP communication indicating a virtual hardware address of the second computing node. ### Claim 12 (depends on 11) The system of claim 11, wherein the communication manager is configured to manage communications of multiple computing nodes hosted on the first physical host. ### Claim 13 (depends on 11) The system of claim 11, wherein the communication manager is configured to: identify a substrate network address of a destination of the first communication from a header of the first communication; retrieve, from a mapping information, a virtual network address of the computing node that is mapped to the substrate network address; and modify the first communication to indicate the virtual network address as the destination of the first communication. ### Claim 14 (depends on 11) The system of claim 11, wherein: the first physical host hosts computing nodes of at least two virtual computer networks; and the communication manager is configured to maintain network isolation among the at least two virtual computer networks. ### Claim 15 (depends on 11) The system of claim 11, wherein: the configuration information specifies one or more network access constraints for the virtual computer network; and the communication manager is configured to enforce the one or more network access constraints of the virtual computer network. ### Claim 16 (depends on 11) The system of claim 11, wherein the communication manager is configured to: assign a new virtual network address to a new computing node of the virtual computer network according to a dynamic host configuration protocol (DHCP). ### Claim 17 (depends on 11) The system of claim 11, wherein the instructions are executable on the on the one or more hardware processors to perform the modification of the first communication via a hypervisor executing on the first physical host. ### Claim 18 (depends on 11) The system of claim 11, wherein the communication manager is a proxy computing device or networking device associated with the first physical host. ### Claim 19 (depends on 11) The system of claim 11, wherein the instructions are executable on the on the one or more hardware processors to cause the one or more computing systems to: provision the computing nodes of the virtual computer network on the physical hosts; and store, at a system manager of the telecommunications infrastructure provider, provisioning information indicating respective locations of the computing nodes. ### Claim 20 One or more non-transitory computer-readable media storing program instructions that when executed on or across one or more processors of a telecommunications infrastructure provider cause the one or more processors to: manage, using a communication manager, communications to and from a computing node in a virtual computer network of computing nodes, wherein the computing nodes are virtual machine instances hosted on physical hosts in a substrate network of the telecommunications infrastructure provider, wherein the communication manager is implemented on a first physical host of the physical hosts and includes a switch that physically connects to the substrate network, wherein the management comprises to: store configuration information about the virtual computer network; receive, from the substrate network, a first communication addressed to the computing node hosted on the first physical host; based at least in part on the configuration information, modify the first communication and forward the first communication to the computing node; receive, from the substrate network, a second communication addressed to the computing node; and based at least in part on the configuration information, drop the second communication without forwarding the second communication to the computing node, and wherein the management further comprises: in response to an address resolution protocol (ARP) communication from the computing node regarding a second computing node in the virtual computer network, send a spoofed response to the ARP communication indicating a virtual hardware address of the second computing node.