Tunneling Component for Secure Cloud Resource Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Accessing shared cloud resources via virtual networks in cloud computing systems poses security risks due to the need for public network addresses, which can expose data to unauthorized access when using SQL servers or cloud storage.
Innovation Solution
Implementing pseudo VNET injection to allow access to shared resources using private domain names and VNET addresses, enabling firewall policies to deny public network access and enhance data security by using a tunneling component to encapsulate connection packets with VNET information and route them through an underlay network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If public network addresses are used to access shared cloud resources, then accessibility to cloud storage and SQL servers is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The patent introduces a tunnel component as an intermediary between virtual machines and cloud resources. This tunnel establishes encrypted connection tunnels that route traffic through the underlay network, allowing access to cloud resources without exposing them to public networks. The tunnel component acts as a secure mediator that maintains accessibility while blocking unauthorized direct access attempts.
Solution Approach 2:
The patent transitions from direct public network access to a multi-dimensional routing approach. Instead of single-hop direct connections, it implements multi-hop routing through underlay networks and tunnel components. This dimensional change in network pathing allows resources to remain inaccessible from public networks while maintaining accessibility through authorized tunnel routes.
2Ease of operation
If firewall openings are created to access shared resources, then connectivity to cloud storage and SQL servers is improved, but exposure to internet-based attacks increases
Solution Approach 1:
The patent extracts the access pathway from the public network domain and relocates it to a private underlay network domain. Instead of creating firewall openings that expose resources to the internet, it extracts the connection path and routes it through dedicated tunnel components in the underlay network, effectively removing the security vulnerability while preserving connectivity.
Solution Approach 2:
The patent converts the potential harm of required network openings into a benefit by implementing encrypted tunneling. The tunnel component takes the necessary connectivity requirement and transforms it into a secure, encrypted pathway that prevents data exfiltration while maintaining access. The firewall opening requirement is converted into a benefit of enforced secure routing.
3Reliability
If virtual networks use private addresses, then security isolation is improved, but ability to access shared cloud resources deteriorates
Solution Approach 1:
The tunnel component implements multi-functionality by simultaneously providing security isolation and resource accessibility. It performs multiple functions: encrypting traffic, routing through underlay networks, maintaining private address space isolation, and enabling access to cloud resources. This universal component resolves the contradiction by making a single system element capable of achieving both security and accessibility goals.
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
Techniques for allowing access to shared cloud resource using private network addresses are disclosed herein. In one embodiment, a connection packet representing a connection request to a shared cloud resource in the cloud computing system can be intercepted. In response, the connection packet can be encapsulated with data representing one or more of a VNET ID, a VNET source address, or a VNET destination address of a virtual network from which the connection packet is received. The encapsulated connection packet can then be forwarded to the shared cloud resource while retaining the data representing one or more of the VNET ID, the VNET source address, or the VNET destination address for access control at the shared cloud resource..