Amazon Technologies, Inc.

Stewart Allen

Joseph Elmar Magerramov

Anthony Nicholas Liguori

Andrew Davenport

Ciprian Dan Cosma

Nachiappan Arumugam

Christopher Thomas

Dheerendra Talur

Venkat Maithreya Paritala

Harshit Vijayvargia

Rajagopal Subramaniyan

Rashid Michael Aga

Reuben Alexander Hawkins

Nicholas Gene Kalteux

Gregory Skoczek

Ethan Joseph Torretta

A network function virtualization service includes an action implementation layer and an action decisions layer. On a flow of network traffic received at the service, the action implementation layer performs a packet processing action determined at the action decisions layer.

Scalable network function virtualization service

Techniques for compiling firewall rules into byte code or assembly code that can be loaded into cache memory of a processor and executed to evaluate received data packets. Rather than representing firewall rules in mid- or high-level languages stored in main memory, the techniques described herein include compiling the firewall rules into bytecode or assembly code, and distributing the code to the data plane. A packet-processing device may load the code representing the firewall rules into instruction cache of the processor. Further, the packet-processing device receives a data packet and extracts packet context data indicating attributes of the packet, and load the packet context data into a data cache of the processor. The processor can then execute the byte code or assembly code representing the firewall rules to evaluate the packet context data without having to access main memory to determine whether allow or block the data packet.

Compiling firewall rules into executable programs

Indications of packet processing operations to be performed for packets of a resource group, as well as configuration settings of the group, are obtained. A packet that satisfies a requirement of the configuration settings and meets a fast path criterion is processed at a fast path node configured for the group. In response to determining that another packet does not satisfy a criterion for fast path processing, the other packet is transmitted to an exception path target.

Serverless packet processing service with configurable exception paths

Respective destination groups are provided to routing intermediaries associated with a packet processing application. The destination group comprises a set of fast-path packet processing nodes of a packet processing service to which the routing intermediaries are to transmit packets to be processed. After a determination is made that the set of fast-path nodes to be included in the destination groups has changed, the destination groups are modified gradually during an update propagation interval.

Packet processing service configuration change propagation management

Executable programs representing firewall rules for evaluating data packets

A program to be executed to perform a packet processing operation on a packet associated with a resource group, as well as security settings of the resource group, are received. The program is transmitted to a set of fast path nodes which were assigned to the resource group based on the group's metadata. With respect to a particular packet, security operations based on the settings are performed and the program is executed at a fast path node. Based at least partly on the results of the program, a packet routing action corresponding to the received packet is performed.

Serverless packet processing service with isolated virtual network integration

A representation of packet processing operations is obtained from a client of a provider network. A set of packet processing nodes is configured at a premise external to the provider network, and the representation is transmitted to the premise. In response to a reception of a network packet, the set of packet processing nodes perform the packet processing operations at the external premise.

Packet processing service extensions at remote premises

In certain aspects, where a network resource is configured (e.g., created, launched, modified, etc.) the dependencies between the network resource and other resources can be determined and stored. Subsequently, then a request is made to reconfigure the network resource, the stored dependencies can be accessed to determine whether or not to allow such a requested reconfiguration.

Growing community of inventors

Seattle, WA, United States of America

Stewart Allen