Back to results
US 9,313,172 B1Granted
Providing access to remote networks via external endpoints
AssigneeAmazon Technologies, Inc.
InventorEric Jason Brandwine
Life of this patent
Estimating the term…
Abstract
Systems and methods for providing access to a remote network via an external endpoint are provided. A client establishes a secure connection between an external endpoint and a remote network. Transmissions from clients to the external endpoint are supplemented with additional information regarding handling within the remote network, and then transmitted to an internal endpoint within the remote network. The internal endpoint processes the transmission based on the supplemental information and returns a response to the external endpoint. A response is then returned to the client. Access policies may be created by authorized users to establish processing of client transmissions. These policies may be stored and enforced by the internal endpoint or the external endpoint.
Claims31
A method for interacting with a service hosted by a private remote network via an external endpoint hosted on a private client network, the method comprising:
- receiving, at an externally facing endpoint hosted within the private remote network, policy information from a client computing device, the policy information specifying that an external endpoint is authorized to interact with the service, the policy information including rules utilized by the external endpoint for determining whether to allow requests originating from client devices on the private client network to access the service, wherein the external endpoint comprises a computing device hosted on the private client network configured to receive requests to access the private remote network from client computing devices associated with the private client network;
- receiving, over a secure network connection between the private client network and the private remote network, a supplemented request from the authorized external endpoint, the supplemented request comprising information associated with an initial request transmitted from the client computing device to interact with the private remote network and supplemental information provided by the external endpoint, wherein the client computing device and the external endpoint communicate via the private client network, and wherein the supplemental information is independent of information associated with the secure network connection;
- determining how to route the initial request based at least in part on the supplemental information associated with the client computing device;
- determining that the initial request should be transmitted based at least in part on the supplemental information associated with the client computing device and on the rules within the received policy information;
- transmitting the initial request to a computing device connected with the service based at least in part on the determined routing;
- receiving a response from the computing device connected with the service;
- and
- transmitting the received response, via the secure network connection, to the authorized external endpoint.
5 more elements
A system for interacting with a service hosted by a first private network via at least one external endpoint hosted on a second private network, the system comprising:
- at least one data repository hosted within a first private network, the data repository configured to store:
- information specifying that at least one external endpoint hosted on a second private network is authorized to interact with a service hosted on the first private network via a secure network connection, and
- policy information for determining whether to allow a request to access the service via the at least one external endpoint hosted on the second private network,
- wherein the at least one external endpoint hosted on the second private network comprises a computing device configured to receive requests from client computing devices associated with the second private network;
- an externally facing endpoint, hosted within the first private network, within the service in communication with the at least one data repository and in communication with the at least one external endpoint hosted on the second private network via the secure network connection, the externally facing endpoint operable to:
- receive, from a client computing device associated with the second private network, the information specifying that the at least one external endpoint hosted on the second private network is authorized to interact with the service hosted on the first private network via the secure network connection;
- receive a supplemented request from the at least one external endpoint hosted on the second private network via the secure network connection, the supplemented request comprising an initial request from the client computing device associated with the second private network to interact with the service and supplemental information provided by the at least one external endpoint, wherein the supplemental information is independent of information associated with generation of the secure network connection, and wherein the client computing device and the at least one external endpoint communicate via the second private network;
- determine that the initial request should be processed based at least in part on the supplemental information and on policy information associated with the initial request;
- process the initial request;
- and
- transmit a response to the at least one external endpoint hosted on the second private network via the secure network connection.
8 more elements
A method for interacting with a service hosted by a first private network via an external endpoint hosted on a second private network, the method comprising:
- establishing, by the external endpoint hosted on the second private network, a network connection between the external endpoint and the service hosted on the first private network, wherein the external endpoint comprises a computing device configured to receive requests from client computing devices associated with the second private network, and wherein a client computing device associated with the second private network specifies that the external endpoint is authorized to interact with the service hosted on the first private network;
- receiving, by the external endpoint hosted on the second private network, a request to interact with the service from the client computing device associated with the second private network, wherein the client computing device communicates the request via the second private network;
- determining, by the external endpoint, supplemental information associated with the request, wherein the supplemental information is independent of the information associated with the network connection;
- supplementing, by the external endpoint, the received request with the determined supplemental information;
- transmitting, by the external endpoint, the supplemented request to the service hosted by the first private network via the network connection;
- receiving, by the external endpoint, a response to the supplemented request from the service hosted on the first private network, wherein the response to the supplemented request is obtained based on a processing of the supplemented request according to access policy information for determining whether to allow a request to access the service via the external endpoint based on supplemental information included within the supplemented request;
- and
- transmitting, by the external endpoint, the response to the client computing device.
5 more elements
A system for interacting with a service hosted by a first private network via an external endpoint hosted on a second private network, the system comprising:
- at least one data repository configured to store:
- information specifying that at least one externally facing endpoint within a service hosted by a first private network, and
- connection information for connecting to the at least one externally facing endpoint via a network connection, the at least one externally facing endpoint hosted within the first private network;
- an external endpoint hosted on a second private network in communication with the at least one data repository, wherein the external endpoint comprises a computing device within the second private network configured to receive requests from client computing devices associated with the second private network, wherein the external endpoint hosted on the second private network is operable to:
- receive, from a client computing device associated with the second private network, the information specifying that the at least one external endpoint hosted on the second private network is authorized to interact with the service hosted on the first private network via the secure network connection;
- establish a network connection to the at least one externally facing endpoint hosted within the first private network based at least in part on the connection information;
- receive a request from the client computing device associated with the second private network to interact with the service, wherein the client computing device communicates the request via the second private network;
- supplement the received request with supplemental information based at least in part on the received request, wherein the supplemental information is independent of the information associated with the network connection;
- transmit the supplemented request to the at least one externally facing endpoint hosted within the first private network via the network connection;
- receive a response to the supplemented request from the service hosted within the first private network, wherein the response to the supplemented request is processed based on a processing of the supplemented request according to access policy information for determining whether to allow a request to access the service hosted within the first private network based on supplemental information included within the request;
- and
- transmit the response to the client computing device.
9 more elements
Dependencies are inferred from the claim text.