Cloud Routing System for IP Address Reduction and Secure Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing and cloud storage face challenges in IP address usage and sharing cryptographic keys between trusted locations and computing clouds, leading to inefficiencies in resource management and security.
Innovation Solution
A system is implemented that uses a cloud computing environment with a routing system to direct traffic from external workloads to internal cloud addresses, enabling the use of a single IP address and providing cryptographic keys for secure traffic and storage, utilizing a secure bridge and virtual router to create a secure connection and manage port mappings, ensuring endpoint security and efficient resource utilization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If cloud computing environments use multiple IP addresses for different cloud workloads, then each workload can be accessed independently, but IP address consumption increases and resource utilization decreases
Solution Approach 1:
The patent introduces a gateway as an intermediary component that sits between external networks and cloud workloads. This gateway maintains a single persistent IP address and uses cryptographic key pairs to establish secure tunneling connections to multiple cloud workloads. The gateway acts as a mediator that translates external access requests into internal cloud workload communications, eliminating the need for each workload to have its own public IP address while maintaining independent accessibility.
2Reliability
If cryptographic keys are shared between trusted locations and cloud workloads, then secure communication is enabled, but key management complexity increases
Solution Approach 1:
The patent segments the cryptographic key management into distinct components: each cloud workload generates its own cryptographic key pair and stores the private key locally, while only the public key is shared with the gateway. This segmentation eliminates the need for centralized key management and reduces complexity, as each workload independently manages its own security credentials without requiring trust establishment with every other workload.
Solution Approach 2:
The gateway serves as a cryptographic intermediary that facilitates secure communication without requiring direct key sharing between all cloud workloads. The gateway holds public keys of cloud workloads and uses them to establish encrypted tunnels, while cloud workloads only need to trust the gateway. This intermediary approach simplifies key management by reducing the number of direct cryptographic relationships needed from O(n²) to O(n).
Data Source
AI summary
System and method for providing cloud computing services are described. In one embodiment, the system comprises a cloud computing environment comprising resources for supporting cloud workloads, each cloud workload having associated therewith an internal cloud address; and a routing system disposed between external workloads of an external computing environment and the cloud workloads, the routing system for directing traffic from an external address to the internal cloud addresses of the cloud workloads. A designated one of the cloud workloads obtains one key of a first pair of cryptographic keys, the first pair of cryptographic keys for decrypting encrypted storage hosted within the cloud computing environment.