Tunnel connections established using secure protocol

Patent metadata

Field	Value
Publication number	US-11522855-B2
Application number	US-202016937030-A
Country	US
Kind code	B2
Filing date	Jul 23, 2020
Priority date	Jul 23, 2020
Publication date	Dec 6, 2022
Grant date	Dec 6, 2022

Abstract

Embodiments establish a pool of tunnel connections using a secure protocol. A pool of tunnels can be initiated from endpoint connection managers to cloud connection managers, where a request is received from the endpoint connection managers by the cloud connection managers. A request from a cloud client to communicate with a secure computing device using a first of the endpoint connection managers is received at a first of the cloud connection managers. One of the pool of tunnels that is connected to the first endpoint connection manager is identified. The identified tunnel is configured to connect the cloud client and the first endpoint connection manager.

First claim

We claim:

1. A method for establishing a pool of tunnel connections using a secure protocol, the method comprising:
initiating a pool of tunnels from one or more endpoint connection managers to one or more cloud connection managers, wherein a request is received from each endpoint connection manager by at least one of the cloud connection managers;
receiving, from a cloud client at a first of the cloud connection managers, a request to communicate with a secure computing device using a first of the endpoint connection managers;
identifying one of the pool of tunnels that is connected to the first endpoint connection manager; and
configuring the identified tunnel to connect the cloud client and the first endpoint connection manager, wherein the identified tunnel is established between the first cloud connection manager and the first endpoint connection manager prior to the cloud client request to communicate with the secure computing device.

2. The method of claim 1 , wherein the secure computing device comprises a secure database or secure server, and the cloud client is connected to the secure database or secure server using the configured tunnel.

3. The method of claim 2 , wherein the secure computing device comprises a secure database, and data communicated between the cloud client and the first endpoint connection manager over the identified tunnel is database data comprising a query and data retrieved from the secure database using the query.

4. The method of claim 3 , wherein the identified tunnel comprises an Oracle Net tunnel that implements a transparent network substrate (TNS) protocol.

5. The method of claim 2 , wherein each established tunnel comprises an endpoint ID, and the identified tunnel is identified using the endpoint ID for the first endpoint connection manager.

6. The method of claim 5 , wherein the pool of tunnels from each cloud connection manager connect to a plurality endpoint connection managers.

7. The method of claim 6 , wherein identifying one of the pool of tunnels that is connected to the first endpoint connection manager further comprises:
receiving, at the first cloud connection manager, the request to communicate with the first endpoint connection manager;
determining, based on the endpoint ID associated with the first endpoint connection manager, that a tunnel with a connection to the first endpoint connection manager is not available in the pool of tunnels at the first cloud connection manager;
rerouting the request to a second cloud connection manager, wherein it is determined that the pool of tunnels at the second cloud connection manager comprises a tunnel with a connection to the first endpoint connection manager.

8. The method of claim 7 , wherein rerouting the request to the second cloud connection manager further comprises:
rejecting, by the first cloud connection manager, the request to communicate with the first endpoint connection manager when it is determined that a tunnel with a connection to the first endpoint connection manager is not available in the pool of tunnels at the first cloud connection manager; and
initiating an automatic failover to the second cloud connection manager.

9. The method of claim 1 , wherein the identified tunnel is established between the first cloud connection manager and the first endpoint connection manager during a startup process for the first endpoint connection manager.

10. The method of claim 1 , wherein the identified tunnel is a persistent tunnel between the first cloud connection manager and the first endpoint connection manager that is reused by a plurality of cloud clients.

11. The method of claim 10 , wherein the identified tunnel is configured to multiplex a plurality of connections between a single or a plurality of cloud clients and the first endpoint connection manager.

12. The method of claim 1 , wherein the identified tunnel carries network traffic over the public Internet.

13. The method of claim 12 , wherein a security protocol for the first endpoint connection manager or a secure network that includes the first endpoint connection manager disallows incoming requests to establish a connection that arrives over the public Internet.

14. A system for establishing a pool of tunnel connections using a secure protocol, the system comprising:
a processor and memory storing instructions, wherein, when executing the instructions, the processor is configured to:
initiate a pool of tunnels from one or more endpoint connection managers to one or more cloud connection managers, wherein a request is received from each endpoint connection manager by at least one of the cloud connection managers;
receive, from a cloud client at a first of the cloud connection managers, a request to communicate with a secure computing device using a first of the endpoint connection managers;
identify one of the pool of tunnels that is connected to the first endpoint connection manager; and
configure the identified tunnel to connect the cloud client and the first endpoint connection manager, wherein the identified tunnel is established between the first cloud connection manager and the first endpoint connection manager prior to the cloud client request to communicate with the secure computing device.

15. The system of claim 14 , wherein the secure computing device comprises a secure database or secure server, and the cloud client is connected to the secure database or secure server using the configured tunnel.

16. The system of claim 15 , wherein the secure computing device comprises a secure database, and data communicated between the cloud client and the first endpoint connection manager over the identified tunnel is database data comprising a query and data retrieved from the secure database using the query.

17. The system of claim 15 , wherein each established tunnel comprises an endpoint ID, and the identified tunnel is identified using the endpoint ID for the first endpoint connection manager.

18. The system of claim 17 , wherein the pool of tunnels from each cloud connection manager connect to a plurality endpoint connection managers.

19. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to establish a pool of tunnel connections using a secure protocol, wherein, when executed, the instructions cause the processor to:
initiate a pool of tunnels from one or more endpoint connection managers to one or more cloud connection managers, wherein a request is received from each endpoint connection manager by at least one of the cloud connection managers;
receive, from a cloud client at a first of the cloud connection managers, a request to communicate with a secure computing device using a first of the endpoint connection managers;
identify one of the pool of tunnels that is connected to the first endpoint connection manager; and
configure the identified tunnel to connect the cloud client and the first endpoint connection manager, wherein the identified tunnel is established between the first cloud connection manager and the first endpoint connection manager prior to the cloud client request to communicate with the secure computing device.

Assignees

• Oracle Int Corp

Inventors

• Mathur Bhaskar
• Khan Feroz Alam
• Dadhich Abhishek
• Patel Kant C

Classifications

• H04L63/029

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F21/606 Primary

  by securing the transmission between two devices or processes · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• G06F21/6227

  where protection concerns the structure of data, e.g. records, types, queries · CPC title