Anycast Application Connectors for Scalable Secure Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ZTNA technologies face high overhead and IP address bloat due to a one-to-one relationship between application connectors and network elements, which complicates scaling and resource management in cloud-hosted environments.
Innovation Solution
Implementing anycast addressing and routing to allocate a shared anycast IP address across multiple application connectors, allowing them to front applications, while utilizing a network controller to manage virtual IP addresses and configure DNS and NAT rules for efficient traffic forwarding and scaling.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a one-to-one relationship between application connectors and network elements is used to ensure secure access, then security is improved, but overhead and IP address bloat increase
Solution Approach 1:
The patent merges the IP address assignment model from one-to-one to one-to-many by implementing anycast addressing. Multiple application connectors share a single anycast IP address, which is announced by multiple network elements. This consolidation reduces IP address consumption and decreases overhead while maintaining the security model through persistent tunnel associations between network elements and application connectors.
Solution Approach 2:
The anycast IP address serves multiple functions simultaneously: it provides a unique identifier for the application connector group, enables load distribution across multiple network elements, and maintains security through tunnel associations. This multi-functional approach eliminates the need for separate IP addresses for each connector while preserving security requirements.
2Ease of operation
If multiple application connectors are assigned unique IP addresses to maintain individual identity, then connectivity is improved, but IP address bloat occurs
Solution Approach 1:
Multiple application connectors are merged under a single anycast IP address identifier. The network elements maintain individual tunnel associations with each connector, preserving connectivity and individual identity, while the shared anycast address reduces IP address consumption from N unique addresses to 1 shared address.
3Device complexity
If a one-to-one mapping between network elements and application connectors is used to simplify routing, then routing complexity is reduced, but scaling capability deteriorates
Solution Approach 1:
The routing model transitions from static one-to-one mapping to dynamic many-to-many relationships. Network elements can dynamically associate with multiple application connectors through the shared anycast address, and new connectors can be added without reconfiguring existing network elements. The anycast routing protocol automatically updates path information as connectors are added or removed.
Solution Approach 2:
The anycast IP address acts as an intermediary that decouples the direct mapping between network elements and application connectors. Network elements route to the anycast address without needing to know individual connector identities, while the anycast routing protocol manages the dynamic associations between connectors and network elements, enabling seamless scaling.
Data Source
AI summary
Anycast addressing is utilized to support the connection of multiple application connectors fronting an application(s) to a network element and anycast routing of network traffic destined for the application(s). When an application is indicated for onboarding in a tenant's network fabric, a network controller allocates virtual and anycast addresses to the application. Allocation of anycast addresses is per domain name and port/protocol combination. Upon determining that the application is available, the application connector(s) advertises reachability of the application via the anycast address. The network controller orchestrates configuration of a domain name system entry that resolves the application name to its virtual Internet Protocol (IP) address and destination network address translation rules that translate the virtual IP address to the anycast address and the anycast address to the application's private IP address. Application network traffic can thus be forwarded to the application via any application connector that advertised the anycast address.