Cloud Appliance Management via Inverted Connection Routing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In a multi-tenant cloud service environment, customers face challenges in managing on-premise network appliances due to firewalls that prevent incoming communications, making it difficult for cloud service providers to initiate connections with these appliances.

Innovation Solution

The method involves initiating a connection from an appliance in the customer's data center to a cloud service provider infrastructure, establishing a connection, and storing this information in a connections table. When a request is made to perform an operation on the appliance, a load balancer selects a server that has a pre-established connection and generates a redirect response with server identification information, allowing subsequent requests to be forwarded through this connection.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a firewall is deployed to protect on-premise network appliances, then security is improved, but incoming communications from cloud service providers are blocked

Engineering Contradiction:

ImprovesecurityVSAvoidcloud provider access

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

Instead of allowing incoming connections from the cloud service provider to the appliance (traditional approach), the patent inverts the connection direction by having the appliance initiate outgoing connections to the cloud service provider. This reversal allows the firewall to remain in place and block incoming traffic while still enabling necessary communications through outbound connections from the appliance.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The patent introduces a connections table as an intermediary component that stores mapping information between appliances and cloud service provider endpoints. This table acts as a mediator that enables the firewall to maintain its security position while still allowing authorized communications by referencing pre-established connection mappings rather than blocking all incoming traffic.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If traditional incoming connection methods are used, then cloud service provider access is simplified, but firewall security requirements cannot be met

Engineering Contradiction:

Improvecloud provider accessVSAvoidfirewall security

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent applies the inversion principle by reversing the traditional connection initiation direction. Instead of the cloud service provider initiating incoming connections to appliances (which conflicts with firewall security), the appliance initiates outgoing connections to the cloud service provider. This maintains both security requirements and operational simplicity.

Inventive Principle:

Principle #13The other way round (Inversion)

3Productivity

If direct connections are established between cloud servers and appliances, then communication efficiency is improved, but scalability is limited when servers need to be replaced or moved

Engineering Contradiction:

Improvecommunication efficiencyVSAvoidserver scalability

Core Design Contradiction:

ProductivityVSAdaptability or versatility

Solution Approach 1:

The patent creates a logical copy or mapping relationship in the connections table that associates appliances with cloud service provider endpoints without establishing rigid physical connections. This allows the system to maintain efficient communication pathways while enabling flexibility to replace or move servers, as the connections table can be updated to reflect new mappings without affecting the fundamental communication architecture.

Inventive Principle:

Principle #26Copying

4Reliability

If load balancers distribute requests across multiple servers, then system availability is improved, but tracking which server has active connections to appliances becomes complex

Engineering Contradiction:

Improvesystem availabilityVSAvoidconnection tracking

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a connections table as an intermediary data structure that centralizes the tracking of active connections between appliances and cloud service provider endpoints. This mediator component simplifies the load balancer's task by providing a single source of truth for connection state, eliminating the need for complex distributed tracking mechanisms across multiple servers while maintaining high system availability.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS20240283852A1Routing of web requests to on-premise network in a multi-tenant environment

Publication Date: 2024.08.22 ORACLE INT CORP

AI summary

When a cloud services provider infrastructure (CSPI) receives a request from an administrator to perform an operation on an appliance, a load balancer may select a first server within the CSPI to process the request. If the first server does not have a connection with the appliance, the first server may generate a redirect response that includes server identification information identifying a particular server having a pre-established connection with the appliance. The first server may send the redirect response to the application that the administrator used to send the request. The application may then generate a second request that includes the server identification information, and send the second request to the CSPI. A load balancer in the CSPI may then forward the second request to the particular server, and the particular server may use the pre-established connection to send a request to the appliance requesting performance of the operation.