Cloud Access Layer for Private VPC and VPN Resources

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing integration platforms face challenges in securely and cost-effectively accessing private resources, such as SQL databases and API services within customer VPNs or VPCs, due to inefficiencies in managing and monitoring access, generating isolated infrastructure, and configuring network policies.

Innovation Solution

A solution that combines software and infrastructure resources to provide dynamic access to private resources, leveraging cloud-based services and Kubernetes environments, enabling ephemeral and long-term connectivity through ENIs, PrivateLinks, and network load balancers, with management and monitoring capabilities via Private-Resource-Experience-API, Private-Resource-Management-Service, and Private-Resource-Monitoring-Service.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If traditional integration platforms are used to access private resources, then access is possible, but device complexity and management overhead increase significantly

Engineering Contradiction:

ImproveEase of access to private resourcesVSAvoidComplexity of managing access

Core Design Contradiction:

Ease of operationVSDevice complexity

Solution Approach 1:

The patent introduces a cloud-based access management system as an intermediary layer between integration platforms and private resources. This mediator handles the complex tasks of infrastructure generation, network policy configuration, and access monitoring automatically, allowing integration platforms to access private resources without direct management complexity.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system enables self-service by automatically generating isolated infrastructure components (ENIs, PrivateLinks, network load balancers) and configuring network policies based on access requests. The cloud-based service autonomously manages the entire access lifecycle, eliminating manual configuration complexity.

Inventive Principle:

Principle #25Self-service

2Reliability

If isolated infrastructure is generated for each access request, then access security is improved, but execution costs increase

Engineering Contradiction:

ImproveSecurity of accessVSAvoidExecution costs

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The patent implements dynamic infrastructure generation where isolated components (ENIs, PrivateLinks) are created only when needed and can be dynamically allocated/deallocated based on access requests. This dynamic approach ensures security through isolation while controlling costs by avoiding permanent infrastructure allocation.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system discards temporary isolated infrastructure components after use and recovers cloud resources. The cloud-based service manages the lifecycle of generated infrastructure, cleaning up resources post-access to minimize execution costs while maintaining security during active use.

Inventive Principle:

Principle #34Discarding and recovering

3Reliability

If network policies are manually configured, then access control is precise, but device complexity and time consumption increase

Engineering Contradiction:

ImproveAccess control accuracyVSAvoidTime for configuration

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The cloud-based service performs preliminary action by pre-configuring network policies and isolated infrastructure components before access requests are made. The system proactively sets up the necessary network rules and connectivity components, eliminating the need for manual policy configuration and reducing access setup time.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent replaces manual mechanical configuration of network policies with automated cloud-based service. The system uses programmatic generation and automatic policy application instead of manual networking configuration, maintaining precise access control while dramatically reducing configuration time and complexity.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

4Ease of operation

If cloud-based services are used for access management, then ease of operation improves, but dependency on external services increases

Engineering Contradiction:

ImproveEase of access managementVSAvoidIndependence from cloud services

Core Design Contradiction:

Ease of operationVSAdaptability or versatility

Solution Approach 1:

The cloud-based access management service provides universal functionality by handling multiple tasks (infrastructure generation, network policy configuration, access monitoring, cost management) through a single integrated platform. This multi-functional approach simplifies operations while the service is designed to work with various private resource types and integration platforms.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS12476975B2Cloud-based dynamic access to private resources

Publication Date: 2025.11.18 SALESFORCE INC

AI summary

Methods, systems, and storage media are described for providing access to private resources such as in a Virtual Private Cloud (VPC) or in a database which is behind a Virtual Private Network (VPN). The solution involves configuring access to the privately owned resource, then using an integration platform to solve design operations or execute the full integration against the private resources. Ephemeral (short-term) or long-term connectivity can be provided.