Amazon Technologies, Inc.

Paul John Tillotson

Bashuman Deb

Omer Hashmi

Baihu Qian

Thomas Nguyen Spendley

Alexander Justin Penney

Ramin Ali Dousti

Mohamed Nader Farahat Hassan

Indira Radhika Pulla

Steve Ge

Anoop Dawani

Shridhar Kulkarni

Nicholas Ryan Lombardi

Nick Matthews

Brandon Michael LaRue

Guru Kannan

Fahed Hijazi

Xiyuan Gou

Yuxin Ren

Jaywant U Kapadnis

Christopher Ian Hendrie

Connectivity is enabled between a first and second isolated network using a virtual traffic hub that includes resources of a cloud computing environment. The connectivity may include respective first and second Virtual Private Network (VPN) connections between the hub and the first and second isolated network at respective premises external to the cloud computing environment. At least a portion of a first packet received at the hub from the first isolated network via the first VPN connection is transmitted from the hub to the second isolated network via the second VPN connection.

Virtual traffic hub management

Metadata indicating that a virtual traffic hub enabling connectivity between a plurality of isolated networks has been established is stored. A determination is made that a first entry of a first isolated network attached to the hub is to be represented in a second routing table of a second isolated network attached to the hub, e.g., to enable network packets originating at resources of the second isolated network to be transmitted via the hub to the first isolated network. A new entry corresponding to the first entry is included in the second routing table.

Automated route propagation among networks attached to scalable virtual traffic hubs

Network pathways are identified to transfer packets between a pair of regional virtual traffic hubs of a provider network. At a first hub of the pair, a first action is performed, resulting in a transmission of a packet received from a first isolated network to the second hub along a pathway selected using dynamic routing parameters. At the second hub, a second action is performed, resulting in the transmission of the packet to a destination within a second isolated network.

Global-scale connectivity using scalable virtual traffic hubs

A message indicating an auxiliary task associated with traffic transmitted via a virtual router between a pair of isolated networks is received at an offloading device. A stack multiplexer at the offloading device selects a protocol stack instance to process the message. A result of the auxiliary task is obtained by the multiplexer from the selected protocol stack instance and transmitted to the virtual router, where it is used to transmit a packet between the isolated networks.

Multi-tenant offloaded protocol processing for virtual routers

Connectivity is enabled between a first and second isolated network using a virtual traffic hub that includes a decision master node responsible for determining a routing action for a packet received at the hub. At the hub, a determination is made that a particular domain name system (DNS) message being directed to a first resource in the first isolated network is to include an indication of a second resource in the second isolated network. The second resource is assigned a network address within a private address range of the second isolated network, which overlaps with a private address range being used in the first isolated network. The hub causes a transformed version of the network address to be included in the DNS message delivered to the first resource.

Domain name system operations implemented using scalable virtual traffic hub

A pair of virtual routers is configured. In response to programmatic requests, dynamic transfer of routing information between the routers in accordance with configuration settings indicated by a client is enabled. The routing information is associated with a set of isolated networks to which the virtual routers are attached. A network packet originating at an address in a first isolated network is transmitted to an address in a second isolated network using a route determined from routing information transmitted between the virtual routers according to the configuration settings.

Dynamic routing for peered virtual routers

An indication of a set of premises between which network traffic is to be routed via a private fiber backbone of a provider network is obtained. Respective virtual routers are configured for a first premise and a second premise, and connectivity is established between the virtual routers and routing information sources at the premises. Contents of at least one network packet originating at the first premise are transmitted to the second premise via the private fiber backbone using routing information obtained at the virtual routers from the routing information source at the second premise.

Wide area networking service using provider network backbone network

A category of auxiliary tasks (such as routing configuration management or packet content transformation) associated with transmission of network packets between sets of network endpoints is determined. A virtual router is configured to transmit the packets between the sets of network endpoints. Connectivity is enabled between the virtual router and an auxiliary task offloading resource. Results of an auxiliary task performed at the offloading resource are used to transmit at least some packets between the sets of network endpoints.

Virtual router workload offloading

Packets of a network flow are received at a virtual traffic hub, which includes an action implementation layer at which routing actions generated at a decisions layer are performed. One or more properties of one or more packets of the flow are analyzed at the virtual traffic hub. An indication of an anomaly of the flow, detected based at least in part on the analysis, is provided to one or more destinations.

Configurable detection of network traffic anomalies at scalable virtual traffic hubs

Metadata indicating that an action implementation node and a routing decision master node have been assigned to a virtual traffic hub programmatically associated with one or more isolated networks is stored. The routing decision master node determines a first action to be implemented for packets of a network flow using state information of the isolated networks, and provides a representation of a first action to the first action implementation node. Based on performing the first action at the action implementation node, contents of a data packet received from one isolated network are transmitted to another isolated network.

Growing community of inventors

Herndon, VA, United States of America

Paul John Tillotson