Cloud Shell Multi-vNIC Isolation for Secure External Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud-based platforms face challenges in securing cloud shells against unauthorized access, particularly when connecting to external networks, which can compromise core IaaS resources and user data.
Innovation Solution
Implementing multiple virtual network interface cards (vNICs) with directional controls, isolating secure shell instances within separate virtual cloud networks, using a primary vNIC for unidirectional inbound communication and a secondary vNIC for unidirectional outbound communication, and employing network address translation (NAT) gateways to manage network traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If cloud shells connect to external networks, then users can access external resources, but unauthorized access and security breaches become possible
Solution Approach 1:
The system segments network communication into two separate virtual network interface cards: a primary vNIC for receiving commands and a secondary vNIC for sending output. This segmentation isolates the cloud shell instance from direct external network access, allowing users to access external resources through controlled pathways while preventing unauthorized direct connections to core IaaS resources.
Solution Approach 2:
The patent introduces a network gateway as an intermediary component that sits between the cloud shell instance and external networks. The gateway receives output from the secondary vNIC, performs network address translation, and forwards traffic to external destinations. This intermediary architecture enables external resource access while maintaining security isolation and preventing direct unauthorized access to the cloud shell instance.
2Reliability
If multiple virtual network interface cards are used for directional communication, then security is enhanced, but device complexity increases
Solution Approach 1:
The primary vNIC is configured with multi-functional capabilities: it accepts inbound traffic from users, rejects outbound traffic from the cloud shell instance, and can forward return messages to users. The secondary vNIC similarly handles multiple functions: receiving output from the cloud shell instance, accepting external responses, and forwarding traffic to the network gateway. This multi-functionality reduces the need for additional network components while maintaining the security architecture.
3Reliability
If the primary vNIC rejects outbound messages, then security is improved, but communication flexibility is reduced
Solution Approach 1:
The system resolves communication restrictions by adding a dimensional shift: instead of attempting bidirectional communication through a single network interface, the patent introduces a second network dimension (secondary vNIC) dedicated to outbound communication. This dimensional change allows the primary vNIC to maintain strict inbound-only security while the secondary vNIC handles outbound traffic, effectively eliminating communication flexibility restrictions without compromising security isolation.
Data Source
AI summary
Techniques for utilizing multiple network interfaces for a cloud shell are provided. The techniques include receiving, by a computer system, a request including a command to execute an operation on a cloud resource of the first virtual cloud network, the request being received from a network external to the first virtual cloud network via a secondary virtual network interface card, the secondary virtual network interface card being configured to permit outgoing traffic from the virtual machine instance. The techniques further include rejecting, by the computer system, the request. The techniques further include transmitting, by the computer system, an error message to a router via a primary virtual network interface card configured to permit incoming traffic to the virtual machine instance.