Accessing network services from external networks

• US 9,756,135 B2
• Filed: 09/11/2014
• Issued: 09/05/2017
• Est. Priority Date: 07/31/2014
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Sama, Venkatababji, Balabine, Igor V., Desai, Suril, Sundarraj, Akkamapet Palaniappan
• Primary Examiner(s): Bates, Kevin
• Assistant Examiner(s): KENNEDY, LESA M
• Application Number:
  US14/483,747
• Publication Number:
  US 20160036920A1
• Time in Patent Office: 1,090 Days
• Field of Search: None
• CPC Class Codes: H04L 49/15 Interconnection of switching modules
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70

Abstract

A method for accessing network services from external networks includes receiving at a cloud-based server a bridge setup request from a private communication system, establishing a bridge connection between the cloud-based server and the private communication system, establishing a communication path between the cloud-based server and a cloud-based application, receiving a request from a cloud-based entity that is directed to an enterprise service hosted within the private communication system, transmitting the request to the enterprise service over the bridge connection, receiving a response from the enterprise service over the bridge connection, and transmitting the response to the cloud-based entity. Related computer program products and systems are also disclosed.

Claims

1. A method, comprising:

receiving, at a cloud-based server, a bridge setup request from a tenant application in a private communication system;

in response to the bridge setup request, establishing a secure outbound bridge connection and a secure inbound bridge connection between the cloud-based server and the tenant application in the private communication system, wherein the secure outbound bridge connection and the secure inbound bridge connection comprise separate connections;

establishing a communication path between the cloud-based server and a cloud-based entity, wherein establishing the communication path between the cloud-based server and the cloud-based entity comprises associating a cloud-side network object identifier, NOID-C, with the cloud-based entity;

receiving a first request from the cloud-based entity that is directed to an enterprise service hosted within the private communication system;

determining an enterprise service identifier, ESID, associated with the enterprise service;

transmitting the first request, the NOID-C, and the ESID to the tenant application over the secure outbound bridge connection;

receiving a first response from the tenant application over the secure inbound bridge connection wherein the first response comprises the NOID-C, the ESID and a private side network identifier, NOID-P, associated with the enterprise service; and

transmitting the first response to the cloud-based entity;

wherein the cloud-based entity comprises a first cloud-based entity, the communication path comprises a first communication path, and the enterprise service comprises a first enterprise service, the method further comprising;

receiving a second request from a second cloud-based entity that is directed to a second enterprise service hosted within the private communication system;

combining the first request and the second request into a transmission block; and

transmitting the transmission block including the first request and the second request over the secure outbound bridge connection to the tenant application within the private communication system;

wherein receiving the first response from the tenant application comprises receiving a second response that is combined with the first response, the method further comprising;

separating the second response from the first response; and

transmitting the second response to the second cloud-based entity.

2. The method of claim 1, wherein the first enterprise service and the second enterprise service comprise different instances of a same enterprise service.

3. The method of claim 1, wherein the first enterprise service and the second enterprise service are the same service.

4. The method of claim 1, wherein establishing the bridge connection comprises authenticating the private communication system to the cloud-based server.

5. The method of claim 1, wherein the cloud-based entity comprises a cloud-based service and/or a cloud-based client application.

6. A computer program product comprising:

a non-transitory computer readable storage medium having computer readable program code embodied in the medium, the computer readable program code comprising computer readable program code configured to;

receive, at a cloud-based server, a bridge setup request from a tenant application in a private communication system;

in response to the bridge setup request, establish a secure outbound bridge connection and a secure inbound bridge connection between the cloud-based server and the tenant application in the private communication system, wherein the secure outbound bridge connection and the secure inbound bridge connection comprise separate connections;

establish a communication path between the cloud-based server a cloud-based entity, wherein establishing the communication path between the cloud-based server and the cloud-based entity comprises associating a cloud-side network object identifier, NOID-C, with the cloud-based entity;

receive a request from the cloud-based entity that is directed to an enterprise service hosted within the private communication system;

determine an enterprise service identifier, ESID, associated with the enterprise service;

transmit the request, the NOID-C and the ESID to the tenant application over the secure outbound bridge connection;

receive a first response from the tenant application over the secure inbound bridge connection wherein the first response comprises the NOID-C, the ESID and a private side network identifier, NOID-P, associated with the enterprise service; and

transmit the response to the cloud-based entity;

wherein the cloud-based entity comprises a first cloud-based entity, the request comprises a first request, the communication path comprises a first communication path, and the enterprise service comprises a first enterprise service, the computer readable code further configured to;

receive a second request from a second cloud-based entity that is directed to a second enterprise service hosted within the private communication system;

bundle the first request and the second request into a transmission block; and

transmit the transmission block including the first request and the second request over the secure outbound bridge connection to the tenant application in the private communication system;

wherein receiving the first response from the tenant application comprises receiving a second response that is combined with the first response, wherein the computer readable program code further comprises computer readable program code configured to;

separate the second response from the first response; and

transmit the second response to the second cloud-based entity.

7. A computer system, comprising:

a processor; and

a memory coupled to the processor, the memory comprising computer readable program code embodied therein that, when executed by the processor, causes the processor to perform operations comprising;

receiving, at a cloud-based server, a bridge setup request from a tenant application in a private communication system;

in response to the bridge setup request, establishing a secure outbound bridge connection and a secure inbound bridge connection between the cloud-based server and the tenant application in the private communication system, wherein the secure outbound bridge connection and the secure inbound bridge connection comprise separate connections;

establishing a communication path between the cloud-based server and a cloud-based entity, wherein establishing the communication path between the cloud-based server and the cloud-based entity comprises associating a cloud-side network object identifier, NOID-C, with the cloud-based entity;

receiving a request from the cloud-based entity that is directed to an enterprise service hosted within the private communication system;

determining an enterprise service identifier, ESID, associated with the enterprise service;

transmitting the request, the NOID-C, and the ESID to the tenant application over the secure outbound bridge connection;

receiving a first response from the tenant application over the secure inbound bridge connection wherein the first response comprises the NOID-C, the ESID and a private side network identifier, NOID-P, associated with the enterprise service; and

transmitting the response to the cloud-based entity;

wherein the cloud-based entity comprises a first cloud-based entity, the communication path comprises a first communication path, and the enterprise service comprises a first enterprise service, the operations further comprising;

receiving a second request from a second cloud-based entity that is directed to a second enterprise service hosted within the private communication system;

combining the first request and the second request into a transmission block; and

transmitting the transmission block including the first request and the second request over the secure outbound bridge connection to the tenant application within the private communication system;

wherein receiving the first response from the tenant application comprises receiving a second response that is combined with the first response, the method further comprising;

separating the second response from the first response; and

transmitting the second response to the second cloud-based entity.