Method and apparatus for secure hybrid cloud connectivity
System and computer-implemented method for secure hybrid cloud connectivity between an application in a public cloud service and an on-premises service supported by an on-premises appliance includes launching a public cloud gateway appliance in the public cloud service. The public cloud gateway appliance is configured with security information associated with the on-premises appliance. The on-premises appliance is provided with contact information associated with the public cloud gateway appliance. A communication channel is established, using an outbound port, from the on-premises appliance to the public cloud gateway appliance that is secured based on the security information associated with the on-premises appliance and the contact information associated with the public cloud gateway appliance.
1. A computer-implemented method for secure hybrid cloud connectivity between an application in a public cloud service and an on-premises service supported by an on-premises appliance without modifying a configuration of an on-premises firewall, wherein access to the on-premises appliance is restricted via the on-premises firewall, the method comprising:
launching a public cloud gateway appliance in the public cloud service, the public cloud gateway appliance configured with security information associated with the on-premises appliance;
providing the on-premises appliance with contact information associated with the public cloud gateway appliance; and
establishing, by the on-premises appliance using an outbound port of the on-premises appliance, a communication channel from the on-premises appliance to the public cloud gateway appliance, wherein
the contact information associated with the public cloud gateway appliance is used by the on-premises appliance to locate the public cloud gateway for establishing the communication channel,
the communication channel secured based on the security information associated with the on-premises appliance, and
the communication channel provides inbound connectivity for the application in the public cloud service to the on-premises service through the on-premises firewall,
wherein no inbound connection is initiated by the public cloud gateway appliance to the on-premises service through the on-premises firewall.
2. The method of claim 1 , further comprising:
receiving an API command from the application in the public cloud service at the on-premises service over the communication channel, wherein the API command comprises a command to manage one or more virtual computing devices.
3. The method of claim 1 , further comprising:
monitoring a connection status of the communication channel;
after establishing the communication channel, detecting a connectivity loss of the communication channel; and
reestablishing the communication channel initiated from the on-premises appliance to the public cloud gateway appliance based on the connection status.
4. The method of claim 1 , wherein the public cloud gateway appliance, after being launched in the public cloud service, enters into a listening mode to await a connection request without initiating an outbound connection to the on-premises appliance.
5. The method of claim 1 , wherein the security information associated with the on-premises appliance comprises a security certificate for the on-premises appliance.
6. The method of claim 1 , wherein the contact information associated with the public cloud gateway appliance comprises security information for authenticating the public cloud gateway appliance.
7. The method of claim 1 , wherein the security information associated with the on-premises appliance comprises information necessary to authenticate the on-premises appliance.
8. A non-transitory computer-readable storage medium containing program instructions for secure hybrid cloud connectivity between an application in a public cloud service and an on-premises service supported by an on-premises appliance without modifying a configuration of an on-premises firewall, wherein access to the on-premises appliance is restricted via the on-premises firewall, wherein execution of the program instructions by one or more processors causes the one or more processors to perform steps comprising:
launching a public cloud gateway appliance in the public cloud service, the public cloud gateway appliance configured with security information associated with the on-premises appliance;
providing the on-premises appliance with contact information associated with the public cloud gateway appliance; and
establishing, by the on-premises appliance using an outbound port of the on-premises appliance, a communication channel from the on-premises appliance to the public cloud gateway appliance, wherein
the contact information associated with the public cloud gateway appliance is used by the on-premises appliance to locate the public cloud gateway for establishing the communication channel,
the communication channel is secured based on the security information associated with the on-premises appliance, and
the communication channel provides inbound connectivity for the application in the public cloud service to the on-premises service through the on-premises firewall,
wherein no inbound connection is initiated by the public cloud gateway appliance to the on-premises service through the on-premises firewall.
9. The computer-readable storage medium of claim 8 , wherein execution of the program instructions by the one or more processors causes the one or more processors to further perform steps comprising:
receiving an API command from the application in the public cloud service at the on-premises service over the communication channel, wherein the API command comprises a command to manage one or more virtual computing devices.
10. The computer-readable storage medium of claim 8 , wherein execution of the program instructions by the one or more processors causes the one or more processors to further perform steps comprising:
monitoring a connection status of the communication channel;
after establishing the communication channel, detecting a connectivity loss of the communication channel; and
reestablishing the communication channel initiated from the on-premises appliance to the public cloud gateway appliance based on the connection status.
11. The computer-readable storage medium of claim 8 , wherein the public cloud gateway appliance, after being launched in the public cloud service, enters into a listening mode to await a connection request without initiating an outbound connection to the on-premises appliance.
12. The computer-readable storage medium of claim 8 , wherein the security information associated with the on-premises appliance comprises a security certificate for the on-premises appliance.
13. The computer-readable storage medium of claim 8 , wherein the contact information associated with the public cloud gateway appliance comprises security information for authenticating the public cloud gateway appliance.
14. The computer-readable storage medium of claim 8 , wherein the security information associated with the on-premises appliance comprises information necessary to authenticate the on-premises appliance.
15. A system in a cloud architecture for secure hybrid cloud connectivity between an application in a public cloud service and an on-premises service supported by an on-premises appliance without modifying a configuration of an on-premises firewall, wherein access to the on-premises appliance is restricted via the on-premises firewall, the system comprising:
memory; and
one or more processors configured to:
launch a public cloud gateway appliance in the public cloud service, the public cloud gateway appliance configured with security information associated with the on-premises appliance;
provide the on-premises appliance with contact information associated with the public cloud gateway appliance; and
establish, by the on-premises appliance using an outbound port of the on-premises appliance, a communication channel from the on-premises appliance to the public cloud gateway appliance, wherein
the contact information associated with the public cloud gateway appliance is used by the on-premises appliance to locate the public cloud gateway for establishing the communication channel,
the communication channel is secured based on the security information associated with the on-premises appliance, and
the communication channel provides inbound connectivity for the application in the public cloud service to the on-premises service through the on-premises firewall,
wherein no inbound connection is initiated by the public cloud gateway appliance to the on-premises service through the on-premises firewall.
16. The system of claim 15 , wherein the one or more processors are further configured to:
receive an API command from the application in the public cloud service at the on-premises service over the communication channel, wherein the API command comprises a command to manage one or more virtual computing devices.
17. The system of claim 15 , wherein the one or more processors are further configured to cause the public cloud gateway appliance, after being launched in the public cloud service, to enter into a listening mode to await a connection request without initiating an outbound connection to the on-premises appliance.
18. The system of claim 15 , wherein the security information associated with the on-premises appliance comprises a security certificate for the on-premises appliance.
19. The system of claim 15 , wherein the contact information associated with the public cloud gateway appliance comprises security information for authenticating the public cloud gateway appliance.
20. The system of claim 15 , wherein the security information associated with the on-premises appliance comprises information necessary to authenticate the on-premises appliance.