Patent ID: 8429739

Claim:
A computer-implemented method for authorizing communications between computing nodes, the method comprising: receiving, by one or more configured computing systems associated with a destination computing node, an incoming communication sent from a sending computing node that is intended for the destination computing node, the sending computing node being one of a plurality of computing nodes of a virtual network and being communicatively connected to the destination computing node via at least one intermediate network and having a source location within the at least one intermediate network, the communication having an indicated source address for the sending computing node, the source address including a representation of a virtual network address and including an indication of the source location, wherein the virtual network address is specified in accordance with the virtual network and is not based on the at least one intermediate network; before providing the incoming communication to the destination computing node, determining, by the one or more configured computing systems, the source location within the at least one intermediate network from the indication included in the source address of the incoming communication; identifying, by the one or more configured computing systems, one or more computing nodes that are located at the determined source location within the at least one intermediate network; determining, by the one or more configured computing systems, one of the plurality of computing nodes of the virtual network to which the virtual network address represented in the source address is assigned; and determining, by the one or more configured computing systems, that the incoming communication is authorized for the destination computing node if the determined one computing node is one of the identified one or more computing nodes, and otherwise determining that the incoming communication is not authorized for the destination computing node; and if the incoming communication is determined to be authorized for the destination computing node, initiating forwarding, by the one or more configured computing systems, of the incoming communication to the destination computing node, and otherwise not initiating the forwarding of the incoming communication to the destination computing node.