Multi-tenant Web Relay for On-Premises Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for securing access to on-premises web services from multi-tenant cloud services are prone to security breaches and require complex configurations, including the use of site-to-site IPsec tunnels and sharing sensitive information, which can lead to unintended access and network outages.
Innovation Solution
A multi-tenant web relay service that allows cloud services to access on-premises web services without opening inbound ports or using IPsec tunnels, by using a generic proxy to authenticate requests and establish communication channels using display-friendly names and service-account credentials, thereby reducing the need for sharing sensitive network addresses or credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If site-to-site IPsec tunnel is used to secure access to on-premises web services, then security is improved, but device complexity and configuration difficulty increase
Solution Approach 1:
The patent introduces a cloud service provider gateway as an intermediary component that mediates between the multi-tenant cloud service and the on-premises web service. This gateway establishes the IPsec tunnel and manages security credentials, allowing the cloud service to access on-premises services securely without requiring complex direct configuration between tenants and the cloud provider. The gateway acts as a trusted intermediary that simplifies the overall system architecture while maintaining security.
2Adaptability or versatility
If IPsec tunnel with full network access is configured, then access to internal network resources is improved, but security exposure increases due to potential unintended access
Solution Approach 1:
The patent implements granular access control where the gateway configuration specifies exactly which on-premises web services and network resources the cloud service is permitted to access. Instead of providing broad network access through the IPsec tunnel, the system applies local quality control by defining specific service endpoints, port ranges, and resource identifiers that are accessible. This ensures that even though an IPsec tunnel is established, only authorized specific resources are exposed, minimizing security risk while maintaining necessary access capabilities.
3Reliability
If manual configuration of DMZ and firewall components is performed, then secure access is achieved, but ease of operation deteriorates due to error-prone manual processes
Solution Approach 1:
The patent implements automated configuration mechanisms where the gateway and cloud service work together to self-configure the necessary DMZ components, firewall rules, and network policies. The system uses automated credential management, dynamic port allocation, and programmatic firewall rule generation based on service descriptors and access requirements. This automation eliminates the need for manual, error-prone configuration of complex security infrastructure while maintaining the same security posture, allowing cloud services to securely access on-premises services through automated processes.
4Ease of operation
If permanent publicly-accessible IP addresses are allocated to DMZ components, then inbound access from cloud service is enabled, but security exposure increases and configuration complexity increases
Solution Approach 1:
The patent transitions from traditional inbound access models that require permanent public IP addresses to a reverse proxy architecture where the gateway initiates outbound connections to cloud services. Instead of opening inbound ports on the cloud service side or allocating public IPs to DMZ components, the system uses outbound-initiated connections through the gateway. This dimensional change in connection direction eliminates the need for permanent public IP allocation while maintaining access capability, thereby reducing security exposure and eliminating a source of configuration complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, and computer-readable media for using a multi-tenant web relay service to provide secure access to on-premises web services from a tenant-specific cloud service are described herein. In one or more embodiments, a multi-tenant web relay service may receive from a tenant-specific cloud service a connection request to an on-premises web service hosted within a tenant datacenter. The connection request may comprise data indicating a display-friendly name of the web service and the tenant datacenter. Responsive to receiving the request, the web relay service may forward the connection request to the on-premises web service via a rendezvous support service and a web relay agent. Responsive to receiving the connection request, the on-premises web service may generate a response which may be relayed back to the tenant-specific cloud service by the multi-tenant web relay service.