{"id":32372,"date":"2018-06-29T10:28:48","date_gmt":"2018-06-29T02:28:48","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=32372"},"modified":"2018-06-29T10:28:48","modified_gmt":"2018-06-29T02:28:48","slug":"two-ways-to-connect-external-users-to-cloud-apps-2","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2018\/06\/29\/two-ways-to-connect-external-users-to-cloud-apps-2\/","title":{"rendered":"Two ways to connect external users to cloud apps"},"content":{"rendered":"

By Alan Zeichick<\/em><\/strong>
\nPrincipal Analyst, Camden Associates<\/em><\/strong><\/p>\n

For enterprises, the ultimate purpose of the network is to connect end-users to applications. What the best way to make that connection \u2013 and make it affordable, scalable, secure, and reliable?<\/strong><\/p>\n

Let\u2019s start with scoping this discussion. Those end-users may be employees or customers. They may be connecting laptops or desktops; mobiles like phones or tablets; or embedded systems like kiosks or IoT (Internet of Things) devices. They may be inside or outside the enterprise \u2013 i.e., connecting via the internet, LAN, or external networks not owned by the organization.<\/p>\n

The applications themselves may be primarily resident on the end-user\u2019s device and talk to a remote host to exchange data \u2013 think about apps. Or the applications might live entirely in the cloud or enterprise data center \u2013 think about applications accessed through a browser or via a virtual machine.<\/p>\n

In all of these cases, reliable, scalable, affordable, secure connectivity is essential. If customers can\u2019t access their applications, or if applications can\u2019t access data, the customer will have a poor experience and may go elsewhere. If employees can\u2019t reliably access applications, they can\u2019t do their jobs \u2013 and productivity and profitability will suffer.<\/p>\n

For this discussion, let\u2019s make some assumptions: The application is running locally on a laptop computer, the user is an employee, and the user is accessing the applications from an external location \u2013 which may change from time to time (think sometimes a home office, sometimes coffee shops, sometimes hotel rooms). The enterprise-written application is running in a cloud data center using an Infrastructure-as-a-Service (IaaS) architecture, which gives the enterprise maximum flexibility on how that cloud service is configured and managed.<\/p>\n

You\u2019ll see that much of this discussion applies no matter how the user, application, and back-end services are configured \u2013 but making some assumptions here will make the conversation easier to follow. Remember, the goal is to connect the user (or the IoT) device to applications securely, with performance, and with reliability.<\/p>\n

Connection Method 1: Application Links Directly to Cloud<\/h2>\n

The most common method of connecting remote applications to cloud servers is to simply have the application open a port to the back-end software, and begin talking. Of course, there\u2019s no expectation of either quality-of-service or security \u2013 so nobody actually would create such a simple connection. Instead, some nature of security and QoS are designed into the application, and into the back-end software.<\/p>\n

QoS must be coded into both ends of the communication path, though the requirements will vary depending on the app\u2019s needs \u2013 which can vary from time to time. A simple transmission of telemetry data from a mobile device will require little bandwidth and short-duration connections. Streaming video requires a lot of bandwidth and a high QoS, with low delay and little jitter. In all cases, no matter the connection method, programmers must take these factors into consideration.<\/p>\n

There may be a combination of needs: Sometimes the end-user sends up telemetry, and sometimes the server sends down new firmware, which must arrive with no corruption. Or for an end-user device, users may need to load documents from the cloud service, and then sometimes save them back.<\/p>\n

Both the end-user application and server software must request the proper type of connection, and measure what they receive \u2013 and if the connection has low bandwidth, degrade services as appropriate. For example, a video stream might be lowered in resolution or in frame rate. If the connection drops, or is temporarily unavailable, the application may need to cache data being transmitted. Similarly, the back-end software may need to cache messages until the end user is connected again.<\/p>\n

Security is a trickier challenge. Worried that packets will be intercepted? That\u2019s relatively easy: Use encryption, such as SSL. This leaves it to the programmers to acquire and maintain the digital certificates.<\/p>\n

How about ensuring trust \u2013 that is, guaranteeing the identity of either party? It is possible for either remote clients or for cloud services to be spoofed \u2013 to trick the transmission of data to a third party, either directly or through a man-in-the-middle attack. When using direct communications, it\u2019s up to the programmers and enterprise system administrators to develop an authentication scheme, or to find and leverage the appropriate libraries.<\/p>\n

Another challenge: Compliance. There may be corporate or regulatory rules stating that, for example, sessions accessed by the client while in the United States must be with a server in the U.S. Similarly, if the client is in Europe, the session must be established with a cloud service in the European Union, or with a specific country like Germany. Finally, if the client is in some countries, the software must not permit a session to be established for governmental reasons or because fears of hacking.<\/p>\n

Programming these governance issues into both the mobile device and the backend services can be done \u2013 and is done every day, using tokens and a variety of schemes. However, depending on the complexity of the rules, this can be challenging to maintain. The complexity multiplies if various employees have different policies, or if there are a few exceptions to these rules. It\u2019s also a challenge if the traffic is going over multiple Internet connections.<\/p>\n

One challenge that the programmers may not be able to handle: Preventing traffic from transiting outside a specific geography, or to exclude specific geographies. You can make sure the end user and the cloud server are both in Europe\u2026 but can you guarantee that none of the packets will leave the E.U.? Generally speaking, no, not without extensive work with the carrier(s) involved.<\/p>\n

That\u2019s where the second method of communications can offer advantages, albeit with a financial cost.<\/p>\n

\"\"<\/a>

Security is a trickier challenge. Worried that packets will be intercepted? That\u2019s relatively easy: Use encryption, such as SSL. This leaves it to the programmers to acquire and maintain the digital certificates.<\/em>
IMAGE FROM PIXABAY.COM<\/p><\/div>\n

Connection Method 2: Use an Intermediate gateway<\/strong><\/h2>\n

Instead of coding all the QoS, security, trust, and government issues in the application \u2013 well, into both ends of the communications link \u2013 a better idea may be to engage a third party. The organization works with a cloud-based service provider that has a point-of-presence in many countries. The service includes a console where IT staff can specify policies for making connections \u2013 when and where they are permitted, how trust and authentication works, and what the QoS will be.<\/p>\n

In practice, once the service is configured, both the back-end cloud application and the client application connect with the third party\u2019s intermediate gateway using a local point-of-presence. The communications service applies policies to authenticate, and if the organization\u2019s policies are satisfied, enables the connection directly \u2013 using its own network, in some cases, instead of the public Internet.<\/p>\n

In other words, except perhaps for the client\u2019s mobile device going to a local point-of-presence, none of the traffic ever touches the Internet. And even when the Internet is involved, there are multiple layers of encryption and tunneling, to keep traffic secure.<\/p>\n

The downside to this approach? Cost. Third-party intermediate gateway services like this are businesses, after all. However, it would appear that those costs may be less than the costs of creating and maintaining a home-grown platform to handle security, QoS, trust, and governance between the mobile application and the enterprise\u2019s IaaS cloud service.<\/p>\n

The most comprehensive offering I\u2019ve seen in this space is from\u00a0NetFoundry, which is a subsidiary of global telecom giant Tata Communications. That\u2019s where the NetFoundry system gets its local points-of-presence.<\/p>\n

NetFoundry uses the term Application Specific Network (ASN) for its method of linking an enterprise\u2019s mobile application to the enterprise\u2019s back-end services. As the company says, \u201cWe deployed transit nodes, proxies, session controllers, & security infrastructure across multiple Internet service providers’ footprints all over the world. This allows the NetFoundry platform to dynamically choose network paths to meet application-specific needs while maximizing route availability and resiliency.\u201d<\/p>\n

All that\u2019s required are APIs accessed by the mobile application and the back-end software, to create what NetFoundry calls AppWANs: \u201cWith our cloud-native global network control fabric as a canvas, you use NetFoundry’s web console and APIs to define your networks by designing and instantly deploying AppWANs. AppWANs are software defined encrypted overlays capable of dynamically adjusting to meet performance requirements, that define how endpoints are permitted to access services (such as applications) across the Internet and\/or existing private networks such as MPLS. One major benefit of AppWANs is that since they are abstracted above network infrastructure, they are completely service provider agnostic.\u201d<\/p>\n

For small-scale applications, and for those without critical security, trust, compliance, and performance needs, using SSL to create a direct connection between the end-user application and the cloud may suffice.<\/p>\n

For complex scenarios, including those where security, authentication and trust are paramount, looking at a third-party intermediate gateway service might be a better enterprise end-user-to-cloud-application strategy. This will be the best way to ensure robust, trustworthy communication \u2013 and maximize employee productivity, customer satisfaction, and business competitiveness.<\/p>\n","protected":false},"excerpt":{"rendered":"

For small-scale applications, and for those without critical security, trust, compliance, and performance needs, using SSL to create a direct connection between the end-user application and the cloud may suffice.<\/p>\n","protected":false},"author":7,"featured_media":32373,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[6155,107,148,6151,5535,96],"class_list":["post-32372","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-opinions","tag-application-specific-network","tag-cloud","tag-cloud-computing","tag-high-tech","tag-netfoundry","tag-technology"],"_links":{"self":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/32372","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/comments?post=32372"}],"version-history":[{"count":0,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/32372\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media\/32373"}],"wp:attachment":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media?parent=32372"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/categories?post=32372"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/tags?post=32372"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}