Per-Application VPN in Container Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing approaches for enabling per-application VPN access in container-based environments are complex and require manual configuration, making it difficult to manage and enforce VPN policies efficiently, especially in automated application delivery scenarios.
Innovation Solution
The integration of network virtualization and virtual machine technologies allows for automated enforcement of per-application VPN access by establishing VPN tunnels and local area networks, using virtual Network Interface Controllers (vNICs) and APIs to manage VPN policies, enabling applications to access specific VPN tunnels while isolating them from others.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual configuration of VPN tunnels is performed in each container, then per-application VPN access can be achieved, but configuration complexity and maintenance overhead increase significantly
Solution Approach 1:
The patent introduces a VPN management system as an intermediary component that automatically configures VPN tunnels and manages container-to-VPN connectivity. This mediator handles the complex configuration tasks automatically, eliminating the need for manual intervention in each container while maintaining reliable per-application VPN access.
Solution Approach 2:
The system enables self-service by allowing the VPN management system to automatically discover containers, retrieve their network interfaces, and configure VPN connections without human intervention. The automated process retrieves container information via API calls and establishes VPN tunnels autonomously, reducing both complexity and maintenance overhead.
2Reliability
If conventional per-application routing configuration is implemented, then per-application VPN access is enabled, but the configuration process becomes complex and time-consuming
Solution Approach 1:
The VPN management system performs preliminary actions by pre-configuring VPN tunnels and policies before containers need access. The system proactively retrieves container information, establishes VPN connections in advance, and prepares routing configurations ahead of time, eliminating the need for time-consuming manual configuration during deployment.
Solution Approach 2:
The patent replaces manual mechanical configuration processes with automated software-based mechanisms. Instead of manually configuring routing tables and VPN tunnels, the system uses programmatic approaches including API calls to retrieve container information, automated tunnel establishment, and software-driven policy enforcement, significantly reducing configuration time.
3Reliability
If VPN tunnels are manually configured in each container, then application security is maintained, but credential management and maintenance overhead increase
Solution Approach 1:
The VPN management system serves as a centralized intermediary that handles credential management and VPN tunnel configuration. This mediator maintains security by centrally controlling authentication credentials and tunnel parameters, while eliminating the need for individual container management of credentials, thus reducing maintenance overhead.
Solution Approach 2:
The system implements universality through a single VPN management system that serves multiple containers and applications. This multi-functional platform handles VPN tunnel establishment, credential management, and policy enforcement for all containers uniformly, eliminating the need for separate credential management in each container and reducing overall maintenance overhead.
Data Source
AI summary
One or more VPN tunnels are established in a site-to-site configuration. A VPN transition subnet is defined and associated with each VPN tunnel. Once the VPN tunnel(s) and the LAN(s) have been configured, a per-application VPN policy can be specified for any applications that require site-to-site VPN access. Whenever a new application is launched, a container is created for executing the VM. The VPN management system reads the VPN policy to determine whether the application is permitted to access any VPN tunnels. If the application is permitted to access a VPN tunnel, a vNIC is generated on the VM for the container of the application and/or a new IP address on the vNIC is assigned to the container. The new IP address and/or the new vNIC are then added to the VPN transition subnet associated with the VPN tunnel to enable the application to access the VPN tunnel.