Profile-Based Routing for Secure Multi-Tenant Management Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Service providers face challenges in securely providing self-service network management capabilities over public networks while preventing unauthorized access and ensuring secure routing to customer-specific network resources.
Innovation Solution
Implementing profile-based routing and access control using a reverse proxy/load balancer (RP/LB) server that authenticates users, retrieves user profiles, and dynamically generates routing rules to authorized customer controllers, ensuring secure and load-balanced access to network management services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If self-service network management services are made accessible via public networks for customer convenience, then ease of operation is improved, but security risks increase due to potential unauthorized access
Solution Approach 1:
The patent introduces a reverse proxy server as an intermediary between customers and network management services. This intermediary authenticates customer requests, retrieves appropriate routing rules based on customer profiles, and forwards requests to the correct customer-specific network resources. This resolves the contradiction by enabling public network access while maintaining security through centralized authentication and authorization control.
2Adaptability or versatility
If multiple customer web servers are used for different customers, then adaptability is improved, but device complexity increases due to routing management
Solution Approach 1:
The reverse proxy server implements a universal routing rule structure that can handle multiple customers through a single standardized mechanism. Instead of requiring complex custom routing logic for each customer, the system uses a unified approach where routing rules are retrieved based on customer profiles. This reduces device complexity while maintaining the ability to serve multiple customers adaptively.
3Device complexity
If static routing rules are used for simplicity, then device complexity is reduced, but adaptability decreases when customer requirements change
Solution Approach 1:
The patent implements dynamic routing rules that are retrieved from a data store based on customer profiles rather than using static pre-configured rules. When a customer request arrives, the reverse proxy server dynamically retrieves the appropriate routing rule associated with that customer's profile. This enables the system to adapt to changing customer requirements while keeping the routing configuration management simple through centralized profile-based control.
Data Source
AI summary
Systems and methods described herein provide profile-based routing and access control for a management interface of virtual network services with multiple tenants. A network device receives a request from a user device to access a webpage for an assisted network management service, and obtains, in response to the request, a user profile associated with a user of the user device. The network device retrieves an Internet Protocol (IP) address for a customer web server, of multiple customer web servers for the assisted network management service, that corresponds to the user profile. The network device generates, based on the IP address, a routing rule to route the request to the customer web server.