Cloud Shell Network Interfaces With Directional Traffic Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud-based platforms face challenges in securing cloud shells against unauthorized access, particularly when connecting to external networks, which can compromise core IaaS resources and user data.
Innovation Solution
Implementing multiple virtual network interface cards (vNICs) with directional controls, isolating secure shell instances within separate virtual cloud networks, using primary vNICs for ingress-only communication and secondary vNICs for egress-only communication, and employing network address translation (NAT) gateways to manage unidirectional data transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If cloud shells are connected to external networks, then communication capability is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The cloud shell's network interface is segmented into multiple virtual network interface cards (vNICs), each dedicated to specific communication directions. The primary vNIC handles ingress traffic from external networks, while the secondary vNIC handles egress traffic to external networks. This segmentation allows independent security control of each interface, enabling the shell to communicate with external networks while preventing unauthorized access through strict directional traffic management.
Solution Approach 2:
A network gateway is introduced as an intermediary component between the cloud shell and external networks. The gateway enforces security policies and controls all traffic flowing between the shell environment and external networks, allowing authorized communication while blocking unauthorized access attempts. This intermediary layer provides an additional security boundary that protects the shell instance.
2Reliability
If multiple virtual network interface cards are used, then security control is improved, but device complexity increases
Solution Approach 1:
The primary and secondary vNICs are configured with universal security rules that apply to all cloud shell instances. The primary vNIC universally accepts ingress traffic on specified ports, while the secondary vNIC universally handles egress traffic. This multi-functionality approach allows the same interface configuration pattern to be applied across multiple shells, reducing operational complexity despite the increased number of network interfaces.
Data Source
AI summary
Techniques for utilizing multiple network interfaces for a cloud shell are provided. The techniques include receiving, by a computer system, a command to execute an operation by the computer system, the command being received from a router via a primary virtual network interface card (vNIC), the primary vNIC being configured to permit incoming traffic. The computer system may execute the operation, generating an output of the operation. The techniques also include transmitting, by the computer system, a message comprising the output of the operation to a shell subnet via a secondary vNIC, the secondary vNIC being configured to permit outgoing traffic from the computer system to the shell subnet.