Burst Proxy Secure Authentication in Multitenant Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In provider networks, private networks are often 'locked down' to ensure data security, making it difficult to communicate with external resources, such as additional database clusters, which can lead to exposure risks when trying to access resources outside the network for processing sensitive information.
Innovation Solution
A method for rapid secure authentication and communication through multitenant components, where a source cluster can request and connect to a burst cluster using a shared secret key, ensuring secure communication without intermediaries accessing plaintext data, by establishing encrypted connections and using a burst proxy to authenticate and verify the connection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If private networks are locked down to restrict access to external resources, then data security is improved, but the ability to communicate with external resources (such as additional database clusters) deteriorates
Solution Approach 1:
The patent introduces a network proxy as an intermediary component that sits between the private network and external resources. The proxy receives authenticated requests from private network resources, forwards them to external destinations, and relays responses back. This mediator enables controlled access to external resources while maintaining the security isolation of the private network, as the proxy can enforce authentication and authorization policies without requiring direct access from internal resources.
2Object-affected harmful factors
If private networks are locked down to eliminate external access, then exposure risks are reduced, but the ability to utilize external services (such as burst clusters) deteriorates
Solution Approach 1:
The network proxy serves as a secure gateway that allows private network resources to access external services like burst clusters without direct exposure. The proxy enforces security policies, authenticates requests, and controls the flow of data, thereby enabling service utilization while minimizing exposure risks to the private network infrastructure.
Solution Approach 2:
The patent segments the network architecture into distinct zones: the private network zone, the proxy zone, and the external resources zone. This segmentation allows each zone to have appropriate security controls and access policies. The proxy acts as a controlled boundary between zones, enabling selective access to external services while maintaining strong security boundaries that prevent unauthorized exposure of the private network.
3Speed
If direct connections are established to external resources, then communication efficiency is improved, but security risks (data exposure to wrong destinations) increase
Solution Approach 1:
The network proxy mediates all communications between private network resources and external destinations. It receives requests from internal resources, validates authentication credentials, verifies authorization permissions, and forwards requests to the correct external destinations. This intermediary approach maintains communication efficiency by providing a streamlined proxy path while eliminating security risks through enforced authentication and destination verification.
Data Source
AI summary
Techniques for rapid secure authentication and communications through multitenant components in a provider network are described. A main database cluster can request a burst cluster from a burst service, which can provide the main cluster with a shared secret associated with only a selected burst cluster. The main cluster can use the shared secret to encrypt a value that can be passed, via a proxy, to the selected burst cluster in a connection request. The selected burst cluster can validate that the connection request was truly originated by the main cluster by validating the encrypted value using the shared secret.