Multi-Tenant VPN Gateway via Shared Public IP
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current VPN solutions require a separate public IP address for each tenant due to the need for SSL connections to use TCP port 443, leading to high costs and inefficiencies, as public IP addresses are scarce and expensive, and existing VPN gateways are single-tenanted, necessitating separate machines for each tenant.
Innovation Solution
Implementing a system where multiple tenants can share the same public IP address by using a common SSL proxy server and mapping tenant identifiers within the HTTPS payload to appropriate VPN gateways, allowing multiple tenants to be serviced using a single public IP address.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a separate public IP address is dedicated for each tenant to enable SSL connections on TCP port 443, then reliable secure communication is achieved, but resource cost and complexity increase significantly due to public IP scarcity and expense
Solution Approach 1:
The patent merges multiple tenants' SSL connections into a single public IP address by introducing a gateway server that consolidates incoming HTTPS traffic. The gateway server acts as a unified entry point that receives all SSL connections on port 443 and then distributes them to appropriate tenant-specific servers, eliminating the need for each tenant to have a dedicated public IP address while maintaining secure communication reliability.
Solution Approach 2:
The gateway server functions as an intermediary between external clients and tenant-specific servers. It receives SSL-encrypted traffic on the standard HTTPS port 443, performs SSL termination, extracts tenant identification information from the connection string, and then establishes appropriate internal connections to the corresponding tenant server. This intermediary approach allows multiple tenants to share a single public IP while maintaining secure, isolated communication channels.
2Reliability
If a separate machine is deployed for each tenant in single-tenanted VPN gateway solutions, then tenant isolation and security are maintained, but system complexity and deployment cost increase
Solution Approach 1:
The gateway server is designed with multi-functionality to handle connections from multiple tenants simultaneously. It can identify different tenants based on connection string parameters, route their traffic appropriately, and manage multiple SSL sessions all through a single server instance. This universal design eliminates the need for separate single-tenanted gateway machines while maintaining tenant isolation through logical separation rather than physical separation.
Solution Approach 2:
While the gateway server itself is unified, the patent segments tenant identification and routing at the software level by parsing connection strings to extract tenant-specific information. This logical segmentation allows the single gateway server to maintain distinct, isolated communication channels for each tenant, achieving tenant isolation without requiring separate physical machines.
3Productivity
If multiple tenants share the same public IP address through connection string mapping, then resource utilization and cost efficiency improve, but connection management complexity increases
Solution Approach 1:
The system implements self-service connection management by embedding tenant identification information directly in the connection string that clients provide. The gateway server automatically parses these connection strings, extracts tenant identifiers, and routes connections without requiring manual configuration or intervention. This self-service approach manages the complexity of multi-tenant connections through automated, client-driven identification rather than server-side configuration overhead.
Solution Approach 2:
The patent utilizes parameter changes in the connection string (specifically the host parameter containing tenant identification) to differentiate between tenants sharing the same public IP address. By monitoring and responding to changes in connection string parameters, the gateway server dynamically routes traffic to the appropriate tenant server, managing connection complexity through parameter-based differentiation rather than structural complexity.
Data Source
AI summary
A service is provided that supports a plurality of tenants. Server(s) of the service are communicatively coupled with a plurality of gateways of the service. Each gateway is configured to support at least one tenant. The server(s) of the service include a network interface, a tenant mapper, and a gateway interface. The network interface is configured to receive connection strings from client devices. Each received connection string includes a service portion that maps to the same public IP address of the service, and also includes a corresponding tenant portion that identifies a tenant. The tenant mapper maps the tenant portions of the connection strings to corresponding gateways. The gateway interface is configured to enable the gateways to establish tunnels between the corresponding client devices and identified tenants. Accordingly, clients are enabled to access multiple tenants of the service via a same public IP address.