Mesh VPN Node Discovery for Hybrid and Multi-Cloud Clusters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies are unable to automatically build a virtual private network (VPN) in a cloud cluster, particularly in scenarios where direct communication between all nodes is not achievable or secure communication cannot be assured across all nodes.
Innovation Solution
A system and method for building a mesh VPN in a cloud cluster, utilizing an external discovery agent and node discovery agents to automatically discover and configure VPN nodes, enabling secure communication between nodes of private and public clouds using a WireGuard-based peer-to-peer network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If direct communication between all nodes is required for secure VPN setup, then security is improved, but device complexity and difficulty of implementation increase significantly in hybrid/multi-cloud environments
Solution Approach 1:
The patent introduces discovery agents as intermediary components that mediate between VPN nodes in hybrid and multi-cloud environments. These agents automatically discover nodes, establish connections, and manage VPN configurations, eliminating the need for complex manual direct peer-to-peer configuration while maintaining security. The discovery agents handle the complexity of cross-cloud network discovery and connection establishment.
Solution Approach 2:
The VPN system implements self-service capabilities where nodes automatically perform their own discovery, configuration, and connection establishment without requiring manual intervention. The discovery agents enable nodes to autonomously identify other VPN nodes across different cloud environments and automatically configure secure connections, reducing operational complexity.
2Ease of operation
If automated VPN node discovery and configuration is implemented, then ease of operation is improved, but device complexity increases due to additional discovery agents and configuration mechanisms
Solution Approach 1:
The discovery agents are designed as multi-functional components that perform multiple tasks: node discovery, connection establishment, VPN configuration management, and security credential distribution. By consolidating these functions into single agents, the system reduces overall complexity compared to having separate dedicated components for each function.
Solution Approach 2:
The discovery agents serve as intermediaries that simplify the user experience by handling all complex automated processes in the background. Users interact with a simple interface while the agents manage the complex automated discovery and configuration tasks, effectively hiding the complexity from end users.
3Device complexity
If manual VPN configuration is performed in hybrid cloud environments, then device complexity is reduced, but loss of time and productivity decrease due to manual setup requirements
Solution Approach 1:
The discovery agents perform preliminary actions by proactively discovering VPN nodes and pre-configuring connection parameters before actual VPN establishment is needed. This advance preparation automatically handles what would otherwise require time-consuming manual configuration steps.
Solution Approach 2:
The system enables self-service automated configuration where VPN nodes automatically configure their own connections through the discovery agents, eliminating the need for manual configuration operations and significantly reducing setup time without requiring complex user intervention.
4Reliability
If secure communication is ensured across all nodes in multi-cloud cluster, then reliability is improved, but difficulty of detecting and measuring node connectivity increases
Solution Approach 1:
The discovery agents implement feedback mechanisms that continuously monitor and report on VPN node connectivity status, connection quality, and security credential validity. This automated feedback system simplifies the detection and measurement of connectivity across complex multi-cloud environments by providing centralized visibility into the state of all VPN connections.
Data Source
AI summary
Devices, system and methods build a mesh virtual private network (VPN) in a hybrid cloud cluster having a private and a public cloud with connected network nodes. Each node has an operating system (OS) to discover nodes of the VPN by determining IP addresses and port addresses of the nodes from data received from discovery agents. An internal discovery agent of each of the nodes determines IP addresses and port addresses of the nodes. A node discovery agent located within a node determines IP addresses and port addresses of other nodes. An external discovery agent located outside the cluster determines IP addresses and port addresses of nodes. A VPN configuration data generator of the OS generates VPN configuration data of the clouds using the IP addresses and port addresses. A VPN builder of the OS builds a configuration of the VPN of the hybrid cluster using the VPN configuration data.