Cloud Communication Delegate for Secure On-Premise Tenant Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud platforms face challenges in ensuring secure communication between cloud networks and on-premise private networks, particularly in multi-tenancy environments where unauthorized access needs to be prevented.
Innovation Solution
A cloud platform manages a plurality of communication delegates, each mapped to a unique tenant, which encrypts data traffic using a unique certificate and establishes secure communication tunnels specific to each tenant, ensuring secure communication through a network of communication controllers and remote communication agents.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a cloud platform manages multiple communication delegates for multi-tenancy, then the ability to support multiple tenants is improved, but the complexity of managing secure communication channels increases
Solution Approach 1:
The system segments communication management by creating separate communication delegates for each tenant. Each delegate is independently configured with its own certificate and secure communication channel, allowing the cloud platform to manage multiple tenants without creating a single complex monolithic system. This segmentation isolates security contexts and simplifies management of individual tenant communications.
Solution Approach 2:
Communication delegates act as intermediary components between the cloud platform and on-premise networks. These delegates handle the complexity of certificate management, encryption, and secure channel establishment individually for each tenant, shielding the main cloud platform from direct complexity while enabling multi-tenancy.
2Reliability
If unique certificates are used for each communication delegate, then data security is improved, but the complexity of certificate management increases
Solution Approach 1:
The system implements self-service certificate management where communication delegates automatically generate and store their unique certificates. The cloud platform can issue certificates to delegates without manual intervention, and the delegates automatically configure their secure communication channels using these certificates, reducing the operational complexity of managing multiple unique certificates.
Solution Approach 2:
The system dynamically manages certificate parameters including validity periods, key sizes, and renewal schedules for each communication delegate. By automating these parameter changes and adjustments, the system maintains high security through unique certificates while reducing the operational complexity of certificate management.
3Object-affected harmful factors
If secure communication tunnels are established for each tenant, then unauthorized access prevention is improved, but the overhead of establishing and maintaining these tunnels increases
Solution Approach 1:
The system establishes secure communication tunnels in advance during tenant onboarding and configuration phases. By pre-establishing these secure channels before actual data transmission begins, the system reduces the overhead of creating secure connections during active communication. The tunnels are maintained through the lifecycle of the tenant relationship and reused for subsequent communications.
Solution Approach 2:
The secure communication system dynamically adjusts tunnel establishment and maintenance based on actual communication needs. The system can close or suspend unused communication channels to reduce overhead while maintaining active secure tunnels for tenants currently accessing services, optimizing the balance between security and overhead.
Data Source
AI summary
Examples described herein relate to securing communication between a cloud platform and applications running on an on-premise private network of a tenant. The cloud platform includes a communication delegate mapped to a tenant of the cloud platform. The communication delegate may receive data traffic associated with the tenant and directed to an application hosted on an on-premise private network. The communication delegate may encrypt the data traffic to generate an encrypted data traffic using a unique certificate associated with the communication delegate and communicate the encrypted data traffic to the application via a secure communication tunnel specific to the tenant between the communication delegate and the on-premise private network.