Granted Patent B1

US 12,647,498 · App. 18/333,219 · Granted Jun 2, 2026

Inventors: Jacob Adam Meisler (Silver Spring, MD); Pallavi Ravishankar (Seattle, WA); Nicole Marie Catron (Mount Dora, FL); Stewart Allen (Seattle, WA); Daniel Lawrence Iannuzzi (Vienna, VA)

Assignee: Amazon Technologies, Inc.

H04L69/16H04L61/50

Abstract

Claims (53)

1 . A computer-implemented method comprising:

receiving, at a service of a cloud provider network, one or more messages from an electronic device to establish a WebSocket connection, the one or more messages including a virtual network endpoint identifier and a first address of an instance hosted by the cloud provider network, wherein the first address is an address of the instance on a first virtual network;

establishing, by the service, the WebSocket connection between the electronic device and the service;

identifying the first virtual network based at least in part on the virtual network endpoint identifier, the first virtual network including a virtual network endpoint associated with the virtual network endpoint identifier, wherein the virtual network endpoint has a second address on the first virtual network;

receiving, via the WebSocket connection, a first WebSocket message including a first payload from the electronic device;

generating, by the service, a first Transmission Control Protocol/Internet Control (TCP/IP) message including at least a portion of the first payload to the instance, wherein the first TCP/IP message includes the second address of the virtual network endpoint as a source address;

sending, from the service to the virtual network endpoint, the first Transmission Control Protocol/Internet Control (TCP/IP) message;

receiving, by the service, a second TCP/IP message including a second payload from the instance, wherein the second TCP/IP message includes the second address of the virtual network endpoint as a destination address;

generating, by the service, a second WebSocket message including at least a portion of the second payload; and

sending, from the service to the electronic device via the WebSocket connection, the second WebSocket message to the electronic device.

2 . The computer-implemented method of claim 1 , further comprising:

copying the portion of the first payload from the first WebSocket message into the first TCP/IP message; and

copying the portion of the second payload from the second TCP/IP message into the second WebSocket message.

3 . The computer-implemented method of claim 1 , further comprising establishing, by the service, a TCP session with the instance hosted by the cloud provider network, wherein a handshake associated with the WebSocket connection is completed after establishing the TCP session with the instance.

4 . A computer-implemented method comprising:

receiving, from an electronic device to a service of a provider network via a WebSocket connection, a first WebSocket message including a first payload from an electronic device;

generating, by the service of the provider network, a first Transmission Control Protocol/Internet Protocol (TCP/IP) message including at least a portion of the first payload;

sending the first TCP/IP message to an instance hosted by a cloud provider network, wherein the instance has a first network address on a first virtual network, and wherein the first TCP/IP message includes a second network address as a source address, wherein traffic originating from the second network address is routable to the first virtual network;

receiving, by the service of the provider network, a second TCP/IP message including a second payload from the instance, wherein the second TCP/IP message includes the second network address as a destination address;

generating, by the service of the provider network, a second WebSocket message including at least a portion of the second payload; and

sending, from the service of the provider network to the electronic device via the WebSocket connection, the second WebSocket message to the electronic device.

5 . The computer-implemented method of claim 4 , wherein the second network address is associated with a virtual network endpoint of the first virtual network.

6 . The computer-implemented method of claim 4 , further comprising:

copying the portion of the first payload from the first WebSocket message into the first TCP/IP message; and

copying the portion of the second payload from the second TCP/IP message into the second WebSocket message.

7 . The computer-implemented method of claim 4 , wherein the WebSocket connection is between a service of the cloud provider network and the electronic device, and further comprising:

receiving, at the service, one or more messages from the electronic device to establish the WebSocket connection, the one or more messages including a virtual network endpoint identifier and the first address of the instance; and

establishing the WebSocket connection with the electronic device.

8 . The computer-implemented method of claim 7 , wherein the virtual network endpoint identifier is associated with a virtual network endpoint of the first virtual network, the virtual network endpoint having (a) the second network address and (b) an associated security group that permits traffic to transit from the virtual network endpoint to the instance.

9 . The computer-implemented method of claim 7 , wherein the virtual network endpoint identifier is or is associated with a Geneve protocol virtual network identifier.

10 . The computer-implemented method of claim 7 , wherein the one or more messages from the electronic device include an identity credential, and further comprising authenticating the identity credential with an identity and access management service of the cloud provider network.

11 . The computer-implemented method of claim 7 , further comprising logging establishment of the WebSocket connection with a logging service of the cloud provider network.

12 . The computer-implemented method of claim 7 , further comprising establishing, by the service, a TCP session with the instance hosted by the cloud provider network.

13 . The computer-implemented method of claim 12 , wherein a handshake associated with the WebSocket connection is completed after establishing the TCP session with the instance.

14 . The computer-implemented method of claim 7 , wherein the first TCP/IP message is sent to the instance by the service via a routing service of the cloud provider network, and wherein the second TCP/IP message is received from the instance by the service via the routing service.

15 . A system comprising:

a first one or more electronic devices to host an instance in a cloud provider network; and

a second one or more electronic devices to implement an instance connect service in the cloud provider network, the instance connect service including instructions that upon execution cause the instance connect service to:

receive, from a third electronic device to the instance connect service via a WebSocket connection, a first WebSocket message including a first payload from an electronic device;

generate, by the instance connect service, a first Transmission Control Protocol/Internet Protocol (TCP/IP) message including at least a portion of the first payload;

send the first TCP/IP message to the instance, wherein the instance has a first network address on a first virtual network, and wherein the first TCP/IP message includes a second network address as a source address, wherein traffic originating from the second network address is routable to the first virtual network;

receive, by the instance connect service, a second TCP/IP message including a second payload from the instance, wherein the second TCP/IP message includes the second network address as a destination address;

generate, by the instance connect service, a second WebSocket message including at least a portion of the second payload; and

send, from the instance connect service to the third electronic device, via the WebSocket connection, the second WebSocket message to the electronic device.

16 . The system of claim 15 , wherein the second network address is associated with a virtual network endpoint of the first virtual network.

17 . The system of claim 15 , wherein the instance connect service includes further instructions that upon execution cause the instance connect service to:

copy the portion of the first payload from the first WebSocket message into the first TCP/IP message; and

copy the portion of the second payload from the second TCP/IP message into the second WebSocket message.

18 . The system of claim 15 , wherein the WebSocket connection is between a service of the cloud provider network and the electronic device, and wherein the instance connect service includes further instructions that upon execution cause the instance connect service to:

receive, at the service, one or more messages from the electronic device to establish the WebSocket connection, the one or more messages including a virtual network endpoint identifier and the first address of the instance; and

establish the WebSocket connection with the electronic device.

19 . The system of claim 18 , wherein the virtual network endpoint identifier is associated with a virtual network endpoint of the first virtual network, the virtual network endpoint having (a) the second network address and (b) an associated security group that permits traffic to transit from the virtual network endpoint to the instance.

20 . The system of claim 18 , wherein the virtual network endpoint identifier is or is associated with a Geneve protocol virtual network identifier.

Assignments (1)

References Cited (12)