Dedicated Egress IP for Cloud Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for securing applications or services over networks, such as VPNs and token validation, are inadequate in preventing unauthorized access due to IP address vulnerabilities, especially in distributed cloud computing environments, where protecting the origin IP address is challenging and deploying mutual Transport Layer Security (mTLS) at scale is impractical.
Innovation Solution
Implementing a dedicated egress IP address system in a distributed cloud computing network, where traffic to an origin server is only allowed from a specific, static IP address, eliminating the need for software agents or application modifications, and allowing customers to configure their firewalls to accept traffic only from this dedicated IP address.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional VPN with IP allowlist is used, then access control is implemented, but unauthorized users can still access the application through the VPN
Solution Approach 1:
The patent introduces a distributed cloud computing network as an intermediary between users and the origin server. This intermediary verifies user identity through zero trust policies (identity verification, device posture checks, MFA) before allowing access to the application, preventing unauthorized users from bypassing security controls
2Reliability
If zero trust policy enforcement is used, then user identity verification is improved, but the origin IP address remains vulnerable to bypass attacks
Solution Approach 1:
The patent changes the network architecture parameter by introducing a dedicated egress IP address for the distributed cloud computing network to communicate with the origin server. The origin server is configured to accept connections only from this dedicated IP address, creating a network-level security barrier that prevents origin IP bypass attacks even when applications are accessible via hostname
3Reliability
If agent-based secure tunnel is used, then origin server protection is improved, but deployment complexity increases due to agent installation requirements
Solution Approach 1:
The patent extracts the security enforcement mechanism from the origin server environment by implementing protection at the distributed cloud computing network layer. Instead of requiring agents on origin servers, the security controls (zero trust verification, dedicated egress IP) are implemented in the cloud network infrastructure, eliminating deployment complexity while maintaining protection
4Reliability
If token validation is used, then authentication security is improved, but legacy application modification becomes cumbersome or impossible
Solution Approach 1:
The patent moves security enforcement to a different dimension - from application-level token validation to network-level protection. By implementing zero trust policies and dedicated egress IP addresses at the network infrastructure layer, the solution provides authentication security without requiring any modifications to legacy application code
5Reliability
If mTLS is deployed at scale, then network and application protection is improved, but deployment and management complexity increases significantly
Solution Approach 1:
The patent implements a simplified approach where the distributed cloud computing network automatically manages security credentials and establishes secure connections with the origin server using the dedicated egress IP address. This eliminates the need for manual mTLS certificate management across multiple applications, providing automated security that scales without increasing operational complexity
Data Source
AI summary
A first compute server of a distributed cloud computing network receives traffic that is destined for a private application or service running on a server of a customer external of the distributed cloud computing network. That server is connected with the distributed cloud computing network through a network interconnect. One or more policies that are configured for the customer are used to determine whether the traffic is allowed to access the private application or service. The first compute server transmits the traffic to a second compute server of the distributed cloud computing network that has the network interconnect. The second compute server transmits the traffic to the server over the network interconnect using as its source IP address an IP address that is dedicated to the customer.