CORS-Based Web Interface for On-Prem Storage Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge lies in providing secure and efficient communication for feature updates and management of on-premises storage clusters within private customer networks, as firewalls typically block south-bound communication from publicly hosted applications, limiting the ability to push updates and fixes to resources within these networks.
Innovation Solution
Implementing cross-origin resource sharing (CORS) over HTTP to enable a web browser-based administrative user interface, allowing a publicly hosted web application to instruct the browser to perform CORS requests to on-prem backend services on private networks, bypassing domain name verification and enabling management of storage nodes with private IP addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a firewall is configured to block inbound traffic from the public internet, then security is improved, but the ability of a publicly hosted web application to push updates to on-prem resources is lost
Solution Approach 1:
The patent inverts the traditional communication direction by having the web browser initiate requests to the publicly hosted web application instead of the application pushing updates to on-prem resources. The browser sends CORS requests to the public application, which then forwards them to the on-prem resources, allowing updates without opening the firewall to inbound traffic.
Solution Approach 2:
The publicly hosted web application serves as an intermediary between the web browser and the on-prem resources. It receives CORS requests from the browser, validates them, and forwards them to the appropriate on-prem resources, enabling secure communication without requiring direct access through the firewall.
2Adaptability or versatility
If the firewall is opened to allow south-bound communication, then the ability to push updates is improved, but security is compromised
Solution Approach 1:
Instead of opening the firewall to allow outbound traffic from the application to the browser, the system inverts the approach by having the browser initiate requests to the public application. This eliminates the need to open the firewall while still enabling update distribution.
Solution Approach 2:
The web browser performs the service of initiating and validating CORS requests to the on-prem resources through the public application. The browser's built-in CORS mechanism handles the security validation, eliminating the need for additional firewall configuration or security appliances.
3Reliability
If management software is tightly-coupled and hosted directly on resources, then communication reliability is improved, but the ability to push software updates on demand is lost
Solution Approach 1:
The system segments the management functionality into two parts: the web interface and update distribution logic are separated from the on-prem resources. The publicly hosted web application contains the update distribution logic, while the on-prem resources only need to respond to CORS requests, enabling independent updates without affecting resource availability.
Solution Approach 2:
The publicly hosted web application serves multiple functions: it acts as a web interface for users, a CORS proxy for browser-to-on-prem communication, and an update distribution mechanism. This multi-functionality eliminates the need for separate update mechanisms while maintaining communication reliability.
Data Source
AI summary
A technique implements an administrative user interface of a backend service used to manage and administer on-premises resources, such as storage nodes of a cluster, within a private customer network. The backend service includes a browser configured to issue cross-origin resource sharing (CORS) requests among target storage nodes and a publicly-hosted web application on remote computing systems accessed via a public computer network (i.e., internet) that can be loaded on the browser within the customer network to manage and administer the on-prem resources on the private network. The technique involves the use of CORS over HyperText Transfer Protocol to access an origin that is not reachable via the public internet from a predetermined location of the browser, e.g., within the same customer network as the target storage nodes, particularly to facilitate management of the nodes.