Secure application delivery system with dynamic stitching of network connections in the cloud

1. A system to deliver an application, hosted by a private application provider, over a network to a user device comprising:

an application delivery system that includes at least one CPU and at least one non-transitory storage device configured to provide,

a first network interface that includes a plurality of first network interface instances that includes multiple second connection endpoints;

a network security interface that includes a plurality of security interface instances that each includes multiple second connection endpoints and multiple fourth connection endpoints;

a second network interface that includes a plurality of second network interface instances that each includes multiple third connection endpoints; and

multiple application agents, disposed within one or more private application provider systems;

a first information structure in the at least one non-transitory storage device that associates first network interface instances with one or more security interface instances;

a second information structure in the at least one non-transitory storage device that associates second network interface instances with one or more security interface instances;

wherein respective first network interface instances are configured to receive one or more user or device requests for access to a hosted application and in response to each received user or device request, to create a respective second network connection with an associated security interface instance, wherein each respective second connection includes one endpoint within a respective first network interface instance and includes one endpoint within an associated security interface instance, and to send the received user or device request to the associated security interface instance over the respective second network connection;

wherein respective second network interface instances are configured to have respective pools of respective third network connections with one or more agents and to have corresponding respective fourth connections with one or more associated security interface instances, wherein each respective fourth connection includes one endpoint within a respective second network interface instance and includes one endpoint within an associated security interface instance; and

wherein respective security interface instances are configured to receive one or more user or device requests from respective first interface instances and in response to each received user or device request, to determine whether the received user or device request is valid, and in response to determining that the received user or device request is valid, to couple a respective second network connection endpoint to a respective fourth network connection endpoint, and to send the received user or device request over the a respective coupled fourth network connection for delivery to a respective agent over an associated third network connection.

2. The system of claim 1 ,

wherein each respective first network interface instance is configured to, for each of the one or more received user or device requests, create a respective first network connection with the respective requesting user device and to receive the respective user or device request over the respective first network connection and to send the respective user or device request over a respective second network connection to an associated security interface instance.

3. The system of claim 1 ,

wherein each respective application agent is configured to send one or more requests that identify a corresponding application served by the agent to one or more respective second network interface instances to create the respective pools of respective third network connections with one or more agents; and

wherein each respective second network interface instance is configured to send a corresponding request for a fourth connection to a respective associated security interface instance in response to each received request for a third network connection, wherein each corresponding fourth request identifies the application identified in the request for a third network connection that it is sent in response to.

4. The system of claim 1 ,

wherein the first information structure in the non-transitory storage device associates first network interface instances with security interface instances based at least in part upon a respective application identified in a user or device request.

5. The system of claim 1 ,

wherein the first information structure in the non-transitory storage device associates first network interface instances with one or more security interface instances based at least in part upon a respective application identified in a user or device request; and

wherein the second information structure in the non-transitory storage device associates second network interface instances with one or more security interface instances based at least in part upon a respective application identified in an agent request sent over a third network connection.

6. The system of claim 1 ,

wherein each respective security interface instance is configured to, in response to determining that the user or device request is not valid, redirect the user or device request to a login server.

7. The system of claim 1 , further including:

a management system configured to,

monitor first network interface instance load information and to determine based at least in part upon the first network interface instance load information whether to add or to terminate one or more first network interface instances;

monitor security interface instance load information and to determine based at least in part upon the security interface instance load information whether to add or to terminate one or more security interface instances;

monitor second network interface instance load information and to determine based at least in part upon the second network interface instance load information whether to add or to terminate one or more second network interface instances;

wherein the application delivery system is configured to,

add or to terminate one or more first network interface instances in response to the management system determination;

add or to terminate one or more security interface instances in response to the management system determination; and

add or to terminate one or more second network interface instances in response to the management system determination.

8. The system of claim 1 further including:

an information structure that is shared among the plurality of security interface instances that stores user validation information and that is disposed in non-transitory storage device.

9. The system of claim 1 further including:

an information structure that is shared among the plurality of security interface instances that stores user validation information and that is disposed in a non-transitory storage device; and

multiple respective non-transitory cache storage instances, each respectively associated with a respective security interface instance that stores user validity information corresponding to users that have recently requested access to an application associated with the respective security interface instance.

10. The system of claim 1 further including:

a service designation information structure that associates different services with one or more applications based at least in part upon application identity and that is stored in non-transitory storage device;

wherein the security interface instances are configured to provide services to user or device requests based at least in part upon information in the information structure.

11. The system of claim 10 ,

wherein the associated services include one or more of traffic encryption/decryption, end user identity management, end user authorization, end user session state storage, Layer 7 firewalling, intrusion prevention services (IPS), threat detection, anti-virus protection, and analytics and business logic.