Resource Access Gateway for Secure Cloud-to-Enterprise Connectivity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Virtual Private Network (VPN) solutions for cloud services require dedicated hardware, are resource-intensive, and do not efficiently support dynamic and secure connections between cloud and on-premise resources, leading to security issues and infrastructure challenges when users access internal enterprise resources from external networks.
Innovation Solution
A Resource Access System (RAS) that enables external network access to internal computing resources through a gatekeeper and resource gateway, performing pass-through authentication and impersonation, allowing external devices to access internal resources via API calls and leveraging existing directory services like ACTIVE DIRECTORY, with a focus on minimal infrastructure and secure connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VPN is used for cloud service connection, then secure connection is achieved, but device complexity and infrastructure requirements increase
Solution Approach 1:
The patent introduces a gateway server as an intermediary component that mediates between cloud services and internal enterprise resources. This gateway handles authentication, authorization, and resource routing, replacing the need for complex VPN infrastructure while maintaining security. The gateway acts as a controlled access point that simplifies the overall system architecture.
Solution Approach 2:
The patent extracts the core security and resource management functions from the VPN infrastructure and consolidates them into a dedicated gateway server. This extraction allows the system to maintain security capabilities while reducing the overall infrastructure complexity by removing redundant VPN components.
2Adaptability or versatility
If VPN is deployed for cloud access, then external network access is enabled, but resource intensity and performance overhead increase
Solution Approach 1:
The gateway server implements self-service mechanisms for connection management, authentication, and resource allocation. Cloud services and internal resources independently interact with the gateway using standardized protocols, eliminating the need for resource-intensive VPN client software on each device and reducing overall system resource consumption.
3Ease of operation
If traditional access methods are used, then simple connection is achieved, but security control and data protection are insufficient
Solution Approach 1:
The gateway server performs preliminary authentication, authorization, and security policy enforcement before any actual resource access occurs. User credentials are validated against Active Directory, access rights are determined in advance, and security policies are applied proactively, ensuring both simplicity for users and robust security control.
Solution Approach 2:
The system implements feedback mechanisms where the gateway continuously monitors access patterns, validates operations against security policies, and provides real-time authorization decisions. This feedback loop ensures that simple user operations are automatically subjected to rigorous security checks without requiring user awareness of the complex security processes.
Data Source
AI summary
A system for enabling an endpoint residing in an external network to perform resource operations on an internal resource, the system including a directory service managing authentication and authorization operations for the internal resource, a gatekeeper device residing in the external network, and a gateway device residing in an internal network. The gatekeeper device is configured to receive a resource operation request from the endpoint, the resource operation request is associated with a user and transmit the resource operation request to the gateway device. The gateway device is configured to receive the resource operation request from the gatekeeper device, authenticate with the directory service as the user, using credentials of the user, authorize the resource operation request with the directory service, and initiate the resource operation request with the internal resource.