SYSTEMS AND METHODS FOR CLOUD BRIDGING BETWEEN INTRANET RESOURCES AND CLOUD RESOURCES

• US 20120281706A1
• Filed: 05/04/2012
• Published: 11/08/2012
• Est. Priority Date: 05/06/2011
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: AGARWAL, PUNEET, Goel, Deepak, Agarwal, Mugdha, Gavini, Anil Kumar, Kurma, Jyotheesh Rao, Kumar, Arkesh, Sharma, Shaleen
• Granted Patent: US 9,253,252 B2
• Time in Patent Office: Days
• US Class Current: 370/395.53
• CPC Class Codes: H04L 12/4625 Single bridge functionality, e.g. connection of two networks over a single bridge
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers

Abstract

Embodiments of the present solution provide a cloud bridge to bring network transparency between the otherwise disparate networks of the datacenter and cloud service provider. For example, appliances may be deployed in the datacenter and on the edge of the cloud. These appliances may be configured or designed and constructed to communicate with each other and recognize and understand the local IP and/or public IP network information of the on-premise datacenter of the enterprise and the cloud datacenter. These appliances may manage the flow of network traffic between the on-premise and cloud datacenters in a manner to appear and act seamlessly and transparently as a single network spanning both the on-premise and cloud data centers.

Claims

1. A method for accessing a service across a private network and a cloud network, the method comprising:

(a) establishing, by a first intermediary device deployed for a private network and a second intermediary device deployed for a cloud network, a network bridge over a secure IP layer tunnel, the network bridge extending IP addressing of the private network to the cloud network;

(b) executing, by the first intermediary device, a virtual server to manage a service provided by a plurality of servers across the private network and the cloud network, a first set of one or more servers of the plurality of servers executing in the private network and a second set of one or more servers of the plurality of servers executing in the cloud network;

(c) receiving, by the virtual server, a request from a client on the private network to access the service identified by an internet protocol address of the private network; and

(d) transmitting, by the first intermediary device via the network bridge responsive to the virtual server, the request to one of the server of the second set of servers in the cloud network.

2. The method of claim 1, further comprising receiving, by the virtual server, a second request from a second client on the private network to access the service identified by the internet protocol address of the private network and transmitting, by the first intermediary device via the network bridge responsive to the virtual server, the second request to one of the servers of the first set of servers in the private network.

3. The method of claim 1, further comprising receiving, by the client a web page comprising uniform resource locators to resources on the private network and resources on the cloud network and displaying on the client via the web page both resources on the private network and resources on the cloud network.

4. The method of claim 1, wherein step (a) further comprises establishing the secure IP layer tunnel by establishing IPsec communications over a layer 2 tunnel.

5. The method of claim 1, wherein step (a) further comprises establishing the network bridge to extend a virtual local area network (VLAN) of the private network to the cloud network.

6. The method of claim 1, wherein step (b) further comprises executing, by the first intermediary device, the virtual server to manage the service by load balancing the service across the private network and the cloud network.

7. The method of claim 1, wherein step (b) further comprises executing, by the first intermediary device, the virtual server to manage the service by content switching traffic to the service across the private network and the cloud network.

8. The method of claim 1, wherein step (c) further comprises identifying, by the virtual server, that the request matches a listening policy comprising a predetermined virtual local area network (VLAN) identifier.

9. The method of claim 1, further comprising receiving, by the second intermediary device, a response to the request from a server on the cloud network and forwarding the response to the first intermediary device, the response identifying the IP address of the client on the private network.

10. The method of claim 9, further comprising communicating, by the virtual server, the response to the client on the private network.

11. A method for providing multi-tenant access across a private network and a cloud network, the method comprising:

(a) executing, by the first intermediary device deployed for a private network, a first plurality of virtualized packet processing engines, each virtualized packet processing engine of the first plurality of virtualized packet processing engines corresponding to a tenant of a plurality of tenants to be serviced by the first intermediary device;

(b) executing, by a second intermediary device deployed for a cloud network, a second plurality of virtualized packet processing engines, each virtualized packet processing engine of the second plurality of virtualized packet processing engines establishing a network bridge over a secure IP layer tunnel with a corresponding virtualized packet processing engine of the first plurality of virtualized packet processing engines of the first intermediary device, the network bridge extending IP addressing of the private network to the cloud network;

(c) receiving, by a first virtualized packet processing engine of the first intermediary device, a request from a device of a first tenant of the plurality of tenants, the request identifying a virtual local area network (VLAN) corresponding to the first tenant; and

(d) transmitting, by the first virtualized packet processing engine via the network bridge, the request to a corresponding virtualized packet processing engine executing on the second intermediary device to transmit the request on the cloud network on the VLAN corresponding to the first tenant.

12. The method of claim 11, wherein step (a) further comprises executing, by the first intermediary device, each virtualized packet processing engine of the first plurality of virtualized packet processing engines on a corresponding core of a plurality of cores of the first intermediary device.

13. The method of claim 11, wherein step (a) further comprises operating, on each virtualized packet processing engine of the first plurality of virtualized packet processing engines, a virtual server comprising a listening policy identifying a virtual local area network (VLAN) of a corresponding tenant of the plurality of tenants.

14. The method of claim 11, wherein step (b) further comprises establishing each secure IP layer tunnel by establishing IPsec communications over a layer 2 tunnel.

15. The method of claim 11, wherein step (b) further comprises establishing each network bridge to extend a virtual local area network (VLAN) of the private network of a corresponding tenant to the cloud network.

16. The method of claim 11, wherein step (c) further comprises identifying, by a virtual server operating on the first virtualized packet processing engine, that the request matches a listening policy comprising a predetermined virtual local area network (VLAN) identifier of the tenant.

17. The method of claim 11, further comprising receiving, by the device a web page comprising uniform resource locators to resources on the private network and resources on the cloud network and displaying on the device via the web page both resources on the private network and resources on the cloud network.

18. The method of claim 11, wherein step (d) further comprises receiving, by the corresponding virtualized packet processing engine of the second intermediary device, a response to the request, the response identifying the IP address of the device on the private network.

19. The method of claim 18, further comprising identifying, by the corresponding virtualized packet processing engine of the second intermediary device, that the response to the request matches a listening policy comprising a predetermined virtual local area network (VLAN) identifier of the tenant.

20. The method of claim 18, further comprising transmitting, by the second intermediary device, the response to the first intermediary device via the network bridge between the corresponding virtualized packet processing engine and the first virtualized packet processing engine.