Multi-Network Bastion Host Scaling for Secure Instance Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Connecting to instances within a network in cloud services requires a public IP, which is limited and exposes internal instance information, necessitating a method to manage connections through a bastion host while minimizing exposure and optimizing security and network load.
Innovation Solution
A system and method for connecting to and managing instances across multiple networks using a single bastion host, which includes a bastion Equipment Account Management System (EAMS) and a bastion manager to authenticate users, locate bastion workers, monitor traffic, and adjust the number of bastion workers based on subnet traffic, using connection specifications and container images.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If bastion hosts are installed across all networks where instances are configured, then security is improved by preventing external communication exposure, but device complexity and management burden increase due to needing to manage all account information and execute SSH tunneling for each instance
Solution Approach 1:
The patent merges multiple bastion host functions into a single centralized bastion host that can manage connections to instances across multiple networks. The bastion host includes a bastion manager that consolidates authentication management, connection control, and SSH tunneling execution into one system, eliminating the need to install and manage separate bastion hosts in each network while maintaining security.
Solution Approach 2:
The bastion host is designed with universal functionality to handle connections to instances in multiple networks through a single deployment. The bastion manager can authenticate users, manage SSH keys, and establish secure tunnels to various target instances across different networks using a unified interface, making the system adaptable to multi-network environments without requiring network-specific installations.
2Ease of operation
If bastion hosts are installed in only one network, then management is simplified, but additional routing settings such as VPC peering are required between the bastion host network and other networks
Solution Approach 1:
The bastion host acts as an intermediary system that mediates connections between external users and target instances in other networks. The bastion manager handles the complexity of routing and network communication internally, allowing users to connect to instances in different networks through the single bastion host without requiring users to configure VPC peering or other routing settings manually.
3Ease of operation
If public IPs are used to connect to instances, then connection ease is improved, but security deteriorates due to exposure of internal instance information to the outside
Solution Approach 1:
The bastion host serves as a secure intermediary between external users and internal instances. Users connect to the bastion host using public IP, and the bastion manager establishes secure SSH tunnels to target instances through private networks. This intermediary approach maintains connection ease while preventing direct exposure of internal instance information, as all communication routes through the bastion host which masks internal network details.
Data Source
AI summary
A method of connecting to and managing connections to instances in a multi-network environment includes: accessing, by a bastion host, a bastion worker among bastion workers, the bastion workers being included in subnets of a plurality of networks, and connecting to a target instance connected with the accessed bastion worker; monitoring, by the bastion host, a connection to the target instance; and comparing, by the bastion host, a traffic of a subnet, in which the target instance is located, with a predefined threshold, and adjusting a number of a bastion worker included in the subnet, in which the target instance is located, based on a result of the comparing, wherein the traffic includes data obtained from a result of the monitoring the connection to the target instance.