Back to results
US 2023/0412507 A1Published application
Enabling isolated virtual network configuration options for network function accelerators
AssigneeAmazon Technologies, Inc.
InventorsUpendra Bhalchandra Shevade, Ximeng Simon Yang, Benjamin Wojtowicz, Diwakar Gupta
Life of this patent
Estimating the term…
Abstract
A first security rule set for traffic of a compute instance run at a virtualization server is stored in response to a programmatic request. A second security rule set for traffic of a network function accelerator of the virtualization server is stored in response to another programmatic request. Prior to delivery of network messages to the compute instance or from the accelerator, compliance with the applicable security rule set is verified.
Claims20
A system, comprising:
- a control plane server of a virtualized computing service of a cloud provider network;
- and
- a virtualization server which includes a network function accelerator for radio-based applications;
- wherein the control plane server is configured to:
- establish an isolated virtual network on behalf of a client of the virtualized computing service;
- store, within a repository of metadata of the isolated virtual network in response to a first request submitted via a programmatic interface of the virtualized computing service by the client, a representation of a first security group associated with a compute instance launched at the virtualization server, wherein the compute instance is assigned a network address within the isolated virtual network, wherein the first security group includes a first restriction on sources of inbound traffic directed to the compute instance, and wherein the compute instance executes a first network function of a radio-based application;
- store, within the repository in response to a second request submitted via the programmatic interface by the client, a representation of a second security group associated with the network function accelerator, wherein the second security group includes a second restriction on destinations of outbound traffic from the network function accelerator, and wherein the network function accelerator executes a second network function of the radio-based application;
- cause a verification, prior to delivery of a first network message of the radio-based application to the compute instance using the network address as a destination address, that the first network message is compliant with the first restriction, wherein the first network message results at least in part in an execution of the first network function;
- and
- cause a verification, prior to transmission of a second network message of the radio-based application to a destination from the network function accelerator, that the second network message is compliant with the second restriction, wherein output of an execution of the first network function results at least in part in an execution of the second network function.
7 more elements
A computer-implemented method, comprising:
- storing, in response to a first programmatic request, a representation of a first collection of configuration settings of a compute instance launched at a virtualization server and configured within an isolated virtual network, wherein the compute instance implements a first network function of a radio-based application, wherein the virtualization server includes a network function accelerator for radio-based applications, and wherein the first collection of configuration settings includes a first network security rule set to be applied to traffic of the compute instance;
- storing, in response to a second programmatic request, a representation of a second collection of configuration settings of the network function accelerator, wherein the second collection of configuration settings includes a second network security rule set to be applied to traffic of the network function accelerator;
- verifying, prior to delivering a first network message to the compute instance, that the first network message is compliant with the first network security rule set, wherein delivery of the first network message to the compute instance results in execution of the first network function at the compute instance;
- and
- verifying, prior to transmitting a second network message from the network function accelerator to a destination external to the virtualization server, that the second network message is compliant with the second network security rule set, wherein the second network message comprises output of a second network function which is executed at the network function accelerator.
2 more elements
A non-transitory computer-accessible storage medium storing program instructions that when executed on a processor implement a control plane server of a virtualized computing service, wherein the control plane server is configured to:
- store, in response to a first programmatic request, a representation of a first collection of configuration settings of a compute instance launched at a virtualization server and configured within an isolated virtual network, wherein the compute instance implements a first network function of a radio-based application, wherein the virtualization server includes a network function accelerator for radio-based applications, and wherein the first collection of configuration settings includes a first network security rule set to be applied to traffic of the compute instance;
- store, in response to a second programmatic request, a representation of a second collection of configuration settings of the network function accelerator, wherein the second collection of configuration settings includes a second network security rule set to be applied to traffic of the network function accelerator;
- cause to be verified, prior to delivery of a first network message to the compute instance, that the first network message is compliant with the first network security rule set, wherein delivery of the first message to the compute instance results in execution of the first network function at the compute instance;
- and
- cause to be verified, prior to transmitting a second network message from the network function accelerator to a destination external to the virtualization server, that the second network message is compliant with the second network security rule set, wherein the second network message comprises output of an execution of a second network function.
2 more elements
Dependencies are inferred from the claim text.