VPC Gateway Filtering for Secure Cloud Data Transfer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for transferring data between public cloud storage services and on-premises networks lack effective access control mechanisms, leading to potential security threats such as confidential data leakage.
Innovation Solution
A system and method that utilize a virtual private cloud network (VPC) with a network load balancer (NLB) and filtering gateways to securely transfer data by directing access messages to a private IP address, filtering based on whitelists and blacklists, and performing destination address translation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a public virtual interface (VIF) is used to advertise the entire S3 public address range to on-premises users, then data transfer speed and accessibility are improved, but security control deteriorates as all authorized users can access any S3 bucket including personal buckets
Solution Approach 1:
The patent segments the S3 address range into multiple virtual interfaces (VIFs), each advertising a specific subset of S3 buckets. Instead of one public VIF advertising the entire S3 address range, multiple VIFs are created where each VIF is configured to advertise only the S3 buckets that should be accessible to particular on-premises users or groups, thereby maintaining security while enabling fast access.
Solution Approach 2:
The patent introduces a Virtual Private Cloud (VPC) as an intermediary layer between the on-premises network and S3 buckets. The VPC acts as a controlled environment where traffic from on-premises users is routed through virtual gateways that enforce access policies, preventing direct access to unauthorized buckets while maintaining the performance benefits of Direct Connect.
2Reliability
If AWS authorization mechanisms are used to control access to S3 buckets, then user authentication is improved, but access control granularity deteriorates as AWS cannot prevent specific types of security threats like confidential data leakage
Solution Approach 1:
The patent segments access control into two layers: AWS handles user authentication and basic bucket authorization, while the custom VPC-based solution segments and controls the actual network traffic flow. By creating multiple VIFs that advertise specific S3 bucket subsets, the system adds granular access control that prevents users from accessing buckets they shouldn't reach, even if AWS authorization would permit it.
Solution Approach 2:
The patent implements preliminary filtering at the network level before traffic reaches S3 buckets. The VPC configuration pre-establishes which S3 buckets are accessible from the on-premises network through specific VIFs, blocking unauthorized access attempts before they can reach the buckets, thus preventing confidential data leakage proactively.
3Speed
If Direct Connect is used to provide dedicated high-speed network connection, then data transfer performance is improved, but security control worsens as it relies on public VIF for S3 access
Solution Approach 1:
The patent segments the Direct Connect capability into multiple virtual interfaces (VIFs) within the VPC. Each VIF is configured to advertise only specific S3 buckets to authorized on-premises users. This segmentation maintains the high-speed dedicated connection benefits of Direct Connect while implementing granular access control, as each VIF acts as a controlled gateway to specific data subsets.
Solution Approach 2:
The VPC acts as an intermediary that sits between the Direct Connect connection and S3 buckets. It receives the high-speed dedicated connection traffic and routes it through virtual gateways that enforce access policies, maintaining Direct Connect's performance advantages while adding a layer of security control that prevents unauthorized access to S3 buckets.
Data Source
AI summary
In an embodiment, a secure object transfer system is described. The system features a virtual private cloud network (VPC) and a controller. The VPC includes a plurality of gateways and a network load balancer, which configured to conduct a load balancing scheme on access messages from computing devices deployed within an on-premises network to direct the access memory to one of the plurality of gateways for storage or retrieval of an object from a cloud-based storage element. Each gateway includes filtering logic to restrict access of the computing devices to certain cloud-based storage elements in accordance with a security policy. The controller is configured to maintain and update the security policy utilized by each gateway of the plurality of gateways.