APPARATUS, SYSTEMS AND METHODS FOR SECURE AND SELECTIVE ACCESS TO SERVICES IN HYBRID PUBLIC-PRIVATE INFRASTRUCTURES

• US 20120331528A1
• Filed: 11/25/2011
• Published: 12/27/2012
• Est. Priority Date: 06/27/2011
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Osmosix, Inc.
• Inventors: FU, TIANYING, MANGLIK, GAURAV, ZHU, XUEFENG
• Granted Patent: US 8,843,998 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Embodiments of apparatus, systems and methods facilitate deployment of distributed computing applications on hybrid public-private infrastructures by facilitating secure access to selected services running on private infrastructures by distributed computing applications running on public cloud infrastructures. In some embodiments, a secure tunnel may be established between proxy processes on the public and private infrastructures and communication between the distributed computing application and the selected services may occur through the proxy processes over the secure tunnel.

Claims

1. A processor-implemented method for securely accessing at least one service on a private infrastructure from a distributed computing application running on a public cloud infrastructure, the processor implemented method comprising:

instantiating a first proxy on the private infrastructure, wherein the first proxy is identified by a first network address and a first port number;

instantiating a second proxy on the public cloud infrastructure wherein the second proxy is identified by a second network address and a second port number;

configuring the distributed application to access the at least one service using the second network address and second port number; and

establishing at least one secure tunnel between the first proxy and the second proxy, wherein;

the second proxy sends access requests received from the distributed computing application to the first proxy over the secure tunnel using the first network address and first port number, and

the first proxy forwards the access request to the at least one service.

2. The processor-implemented method of claim 1, further comprising:

receiving a response to the access request from the at least one service at the first proxy; and

sending the response from the first proxy to the second proxy over the secure tunnel using the second network address and second port number, and wherein the second proxy forwards the response to the distributed computing application.

3. The processor-implemented method of claim 1, wherein the distributed computing application is a cloud-specific implementation for the public cloud infrastructure that is derived from an infrastructure independent representation of the distributed computing application.

4. The processor-implemented method of claim 3, wherein the at least one cloud-specific implementation of the distributed computing application for the public cloud infrastructure is realized by utilizing a library of program routines that implement system and pattern primitives on the at least one cloud infrastructure.

5. The processor-implemented method of claim 1, wherein the at least one service comprises one or more of a licensing service, a database access service, a user authentication service, a workflow-integration service, a remote service accessible over http, or a remote service accessible over remote method invocation (“

rmi”

) protocol.

6. The processor-implemented method of claim 1, wherein the secure tunnel between the first proxy and second proxy is established using the https protocol.

7. The processor-implemented method of claim 1, wherein configuring the distributed computing application to access the at least one service using the second network address and port number further comprises:

verifying that the distributed computing application is authorized to access the second network address and second port number;

adding the second network address and second port number to a configuration file used by the distributed computing application, wherein the configuration file comprises access information for the at least one service.

8. The processor-implemented method of claim 1, wherein the public cloud infrastructure is one of Amazon EC2, Terremark vCloud, Rackspace Cloudserver, Microsoft Azure, or Savvis.

9. The processor-implemented method of claim 1, wherein the first proxy is configured as a virtual appliance.

10. The processor-implemented method of claim 1, wherein the private infrastructure is protected by a firewall.

11. A system comprising:

a first infrastructure capable of hosting at least one application service used by a distributed application;

a first proxy accessible over a public network, the first proxy being identified by a first network address and a first port number;

a second infrastructure capable of running the distributed computing application; and

a second proxy identified by a second network address and second port number; and

wherein the distributed application is configured to access the at least one application service using the second network address and second port number through a secure tunnel between the first proxy and the second proxy, wherein;

the second proxy sends access requests received from the distributed computing application to the first proxy over the secure tunnel using the first network address and first port number, and

the first proxy forwards the access request to the at least one application service.

12. The system of claim 11, wherein the first infrastructure is private and the second infrastructure is a public cloud infrastructure.

13. The system of claim 12, wherein second proxy runs on the public cloud infrastructure.

14. The system of claim 11, wherein the first proxy and the second proxy run on servers accessible over the Internet.

15. The system of claim 11, wherein the at least one secure tunnel between the first proxy and the second proxy is established using the https protocol.

16. The system of claim 11, wherein:

the first proxy receives a response to the access request from the at least one application service;

the first proxy sends the response to the second proxy over the secure tunnel using the second network address and port number; and

the second proxy forwards the response to the distributed computing application.

17. The system of claim 11, wherein the at least one application service comprises one or more of a licensing service, a database access service, a user authentication service, a workflow-integration service, a remote service accessible over http, or a remote service accessible over remote method invocation (“

rmi”

) protocol.

18. The system of claim 11, wherein configuring the distributed computing application to access the at least one service using the second network address and port number comprises:

verifying that the distributed computing application is authorized to access the second network address and port number;

adding the second network address and port number to a configuration file used by the distributed computing application, wherein the configuration file comprises access information for the at least one service.

19. A computer-readable medium comprising instructions, which when executed by a computer perform steps in a method for securely accessing at least one service on a private infrastructure from a distributed computing application running on a public cloud infrastructure, the computer implemented steps comprising:

instantiating a first proxy on the private infrastructure, wherein the first proxy is identified by a first network address and a first port number;

instantiating a second proxy on the public cloud infrastructure wherein the second proxy is identified by a second network address and a second port number;

configuring the distributed application to access the at least one service using the second network address and the second port number; and

establishing at least one secure tunnel between the first proxy and the second proxy, wherein;

the second proxy sends access requests received from the distributed computing application to the first proxy over the secure tunnel using the first network address and the first port number, and

the first proxy forwards the access request to the at least one service.

20. The computer-readable medium of claim 19, further comprising:

receiving a response to the access request from the at least one service at the first proxy; and

sending the response from the first proxy to the second proxy over the secure tunnel using the second network address and the second port number, and wherein the second proxy forwards the response to the distributed computing application.