Securely determining internet connectivity
AssigneeAmazon Technologies, Inc.
InventorJacob Gabrielson
Life of this patent
Estimating the term…
Abstract
External network connectivity of an internal host can be measured by giving an external computer a payload identifying the internal host and instructions to deliver the payload to an external host. The external host may receive the payload and contact the internal host. The internal host's response and receipt of the payload may then determine the Internet connectivity of the internal host. The path from the computer through the trusted host to the internal server shows external network connectivity without exposing the internal host to the external network directly.
Claims18
A computer-implemented method, comprising:
- preparing, by a computer system, a list of internal hosts to contact within a period of time based at least in part on a policy of determining network connectivity of internal hosts, the list forming a subset of the internal hosts;
- determining when to send a message based at least in part on the list;
- sending, by the computer system, the message to an external computing system on an external network, the message having forgery-resistant information and instructions, the forgery-resistant information identifying an internal host on an internal network;
- receiving, from the external computing system, the forgery-resistant information;
- contacting the internal host through the internal network to measure connectivity of the internal host;
- and
- determining, by the computer system, a measurement of connectivity to the internal host from the external computing system on the external network based at least in part on receiving the forgery-resistant information from the external computing system on the external network.
One or more non-transitory computer-readable storage media having executable instructions stored thereon that, when executed by one or more processors of a computer system, cause the computer system to perform operations comprising at least:
- preparing a list of internal hosts to contact within a period of time based at least in part on a policy of determining network connectivity of the internal hosts, the list forming a subset of the internal hosts;
- determining when to send a message based at least in part on the list;
- creating the message based at least in part on the list, the message comprising at least a secure portion including protected information and an unsecure portion having instructions for contacting a bridge host reachable by the external system and for delivering the secure portion to the bridge host;
- communicating the message to an external system, the external system being outside of a first network;
- receiving, by the bridge host having connectivity outside the first network and with the first network, at least the secure portion of the message from the external system;
- and
- communicating with an internal host through the first network, the internal host identified by the secure portion of the message received by the bridge host.
A system, comprising:
- a memory that stores computer-executable instructions;
- and
- a processor configured to access the memory and execute the computer-executable instructions to collectively at least:
- prepare a list of hosts to contact within a period of time based at least in part on a policy of determining network connectivity of hosts, the list forming a subset of the hosts;
- determine when to send an information set based at least in part on the list;
- send the information set to an untrusted computing system, the information set including instructions and protected information;
- receive, by a trusted computer, at least the protected information from the untrusted computing system outside a secure network;
- and
- test, by the trusted computer, connectivity over the secure network to a host residing on the secure network and identified in the protected information.
Dependencies are inferred from the claim text.