Cloud Gateway for On-Premise API Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Hybrid cloud portals face challenges in integrating on-premise environments with public clouds due to firewall isolation and private addressing, preventing seamless access to IT infrastructure resources across both environments.
Innovation Solution
A mechanism is deployed in a container cluster to expose on-premise API endpoints, allowing applications to access remote endpoints as local ones by creating connectivity through a tunnel, supporting internal naming, addressing, and RBAC controls, and mapping cluster internal naming to remote communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewall isolation and private addressing are used in on-premise environments, then security and network isolation are improved, but access to remote API endpoints from cloud-based applications is blocked
Solution Approach 1:
The patent introduces a cloud-based gateway service that acts as an intermediary between cloud-based applications and on-premise API endpoints. The gateway receives requests from cloud applications, translates them into appropriate private network requests, and returns responses to the applications. This mediator enables access through the firewall without compromising the security of the on-premise network, as the gateway is the designated entry point for external connections.
Solution Approach 2:
The system segments the network architecture into distinct components: the public cloud network, the gateway service, and the private on-premise network. By dividing the system into these segments with clearly defined boundaries and communication protocols, the patent enables controlled access between segments while maintaining isolation and security within each segment.
2Adaptability or versatility
If cloud-based applications need to access on-premise resources, then hybrid cloud integration is improved, but network complexity and firewall traversal requirements increase
Solution Approach 1:
The gateway service is designed as a universal component that handles multiple functions: receiving HTTP/HTTPS requests from cloud applications, translating them to internal API calls, managing authentication, and routing responses. This multi-functional gateway reduces overall network complexity by consolidating what would otherwise require multiple specialized components and complex firewall rules.
Solution Approach 2:
The gateway serves as a mediator that abstracts the complexity of private network communication from cloud applications. Applications interact with the gateway using standard web protocols, while the gateway handles the complexity of translating these requests into the appropriate private network communication patterns, thereby reducing the perceived complexity for application developers.
3Reliability
If private addressing and naming are used in on-premise environments, then network security is improved, but cloud-based applications cannot resolve or access remote service addresses
Solution Approach 1:
The gateway maintains a mapping between public-facing service identifiers (that cloud applications can resolve) and private network addresses (that maintain security). This copying of address information with different naming schemes allows applications to access services using familiar public addresses while the actual private addresses remain protected and unchanged.
Solution Approach 2:
The gateway acts as an intermediary in the address resolution process. When a cloud application needs to access a service, it queries the gateway with a public service identifier. The gateway translates this identifier into the corresponding private network address and establishes the connection, thereby preserving both address resolution capability and private addressing security.
Data Source
AI summary
Example implementations relate to exposing on-premise API endpoints in a cloud-based application platform. The application platform receives information regarding a forwarding proxy associated with a private network and information regarding a remote application programming interface (API) endpoint within the private network. A mapping between a resource model of the application platform to a tunnel established between a forwarding client of the application platform and the forwarding proxy is created by a controller of the application platform causing the forwarding client to instantiate a port corresponding to a forwarding route for the remote API endpoint based on the information regarding the forwarding proxy and the remote API endpoint. The remote API endpoint is locally represented within the application platform in a form of an instance of a service abstraction provided by the application platform.