SECURING COMMUNICATION BETWEEN A CLOUD PLATFORM AND AN APPLICATION HOSTED ON AN ON-PREMISE PRIVATE NETWORK

Examples described herein relate to securing communication between a cloud platform and applications running on an on-premise private network of a tenant. The cloud platform includes a communication delegate mapped to a tenant of the cloud platform. The communication delegate may receive data traffic associated with the tenant and directed to an application hosted on an on-premise private network. The communication delegate may encrypt the data traffic to generate an encrypted data traffic using a unique certificate associated with the communication delegate and communicate the encrypted data traffic to the application via a secure communication tunnel specific to the tenant between the communication delegate and the on-premise private network.

BACKGROUND

Data and/or applications may be hosted on an on-premise private network or on a public cloud network, either having computing nodes, such as a server, a storage array, a cluster of servers, a computer appliance, a workstation, a storage system, a converged system, a hyperconverged system, or the like. In some examples, the data and/or applications hosted on the on-premise private network or on the public cloud network may be accessed via cloud based web-portals.

It is emphasized that, in the drawings, various features are not drawn to scale. In fact, in the drawings, the dimensions of the various features have been arbitrarily increased or reduced for clarity of discussion.

DETAILED DESCRIPTION

Data and/or applications may be stored on an on-premise private network or on public cloud network, either having computing nodes, such as a server, a storage array, a cluster of servers, a computer appliance, a workstation, a storage system, a converged system, a hyperconverged system, or the like. The term on-premise may be understood to mean, for example, on location at premises (e.g., real estate, such as a data center) owned (fully or partially), operated, or subscribed by an entity or at a colocation center rented to the entity. Accordingly, the on-premise private network is hereinafter referred to as on-premise private network of the entity. Further, the term ‘entity’ as used herein may refer to an individual or an organization having one or more users (e.g., owners, employees, contractors, or administrators). In the description hereinafter, the individual who is referred to as the entity or the users of the organization referred to as the entity are individually referred to as a user or collectively referred to as users associated with the entity. Also, the term “on-premise private network” is hereinafter interchangeably used as “on-premise network.”

In some examples, the data and/or applications hosted on the on-premise network or on the public cloud network may be accessible via cloud based portals, also referred to as cloud platforms. Certain cloud platforms may provide its tenants a cloud-like experience by allowing management and/or usage of capabilities such as, for example, IT infrastructure and/or services offered by the on-premise network, in a pay-per-use model. To avail such cloud-like experience facilitated by a cloud platform, the entity may be enrolled with the cloud platform as a tenant of the cloud platform. Once enrolled, users associated with the entity that is enrolled with the cloud platform as the tenant, are hereinafter referred to as tenant users. The tenant users can access, depending on respective access permissions, several applications including but not limited to virtual machines (VMs), containers, pods, machine-learning operations, data storage, compute, virtual networking, or the like, hosted on the on-premise network of the entity as services via the cloud platform in a pay-per-use model.

In order to reduce security threats to the applications associated with the entity, the applications are hosted behind a proxy and are safeguarded by firewalls at the on-premise network of the entity. On the other hand, the cloud platforms are generally designed to support a multitude of tenants. In certain cases, the cloud platform may manage IT infrastructure and/or services hosted at several on-premise networks each belonging to different tenants. To avail features offered by the cloud platform, the entities are to be enrolled with the cloud platform as tenants. For example, different entities may be registered/enrolled as different tenants of the cloud platform. Once enrolled, the users of the tenant (e.g., the enrolled entity) can access the applications hosted on respective on-premise networks via the cloud platform. Since, the cloud platform manages the on-premise networks associated with more than one tenant (e.g., enrolled entities) and the cloud platform itself may be hosted on a cloud network, it is useful that the cloud platform enable a secure communication between the cloud platform and the on-premise networks associated with the tenants. In other words, it is useful that the cloud platform does not allow access to the applications to unauthorized tenants.

Therefore, in accordance with the aspects of the present disclosure, a cloud platform is presented that enables secure communication with applications hosted on an on-premise network of a tenant of the cloud platform. The cloud platform may be hosted outside of the on-premise network of the tenant. In some examples, to enable such secure communication, the cloud platform may manage a plurality of communication delegates. In some examples, each of the plurality of communication delegates is mapped to a unique tenant of a plurality of tenants of the cloud platform. In other words, there may exist a separate unique communication delegate mapped to each tenant of the cloud platform. In some examples, the plurality of communication delegates are hosted as containerized applications on one or more clusters of computing nodes. During operation, a communication delegate mapped to the tenant may receive a data traffic associated with the tenant and directed to the application hosted on the on-premise network of the tenant. The communication delegate may encrypt the data traffic to generate an encrypted data traffic using a unique certificate associated with the communication delegate. In some examples, the unique certificate may include an identifier of the communication delegate and an Internet Protocol (IP) address associated with the communication delegate. Moreover, the communication delegate may communicate the encrypted data traffic to the application via a secure communication tunnel that is specific to the tenant between the communication delegate and the on-premise network of the tenant.

Certain aspects of the present disclosure are also directed to establishing the secure communication tunnel specific to the tenant. In some examples, the secure communication tunnel may include a first communication tunnel and a second communication tunnel. Establishing the secure communication tunnel specific to the tenant may include forming the first communication tunnel between the communication delegate mapped to the tenant and a midway server, and forming the second communication tunnel between a remote communication agent linked to the application hosted at the on-premise network of the tenant and the midway server. Once established, the secure communication tunnel may be exposed to the tenant as a unique Uniform Resource Locator (URL) that can be accessed by the tenant users corresponding to the tenant.

As will be appreciated, in some examples, the cloud platform proposed herein enables secure communication between the cloud platform and the application running on the on-premise network of the tenant. This is achieved at least in part by communicating the encrypted data traffic over the secure communication tunnel that is specific to the tenant. Further, in some examples, the secure communication tunnel is established between a communication delegate that is uniquely mapped to the tenant and remote communication agent associated with the application. In particular, the cloud platform includes a separate communication delegate mapped to each tenant of the tenants of the cloud platform. Use of the individual communication delegates for each of the tenants may provide multi-tenancy support while ensuring secure communication. Moreover, the communication delegate may have its respective unique certificate configured with the identifier of the communication delegate and the IP address associated with the communication delegate. These parameters contained in the unique certificate may be used to establish a trust at the midway server that the encrypted data traffic is coming from an authorized communication delegate thereby enhancing data security.

Referring now to the drawings, inFIG. 1, a networked system100is presented, in accordance with an example. As depicted inFIG. 1, in some examples, the networked system100may include an on-premise private network102(also referred to as an on-premise network102) and a cloud network104. The term “on-premise” may be understood to mean, for example, on location at premises (e.g., real estate, such as a data center) owned (fully or partially), operated, or subscribed by an entity or at a colocation center rented to the entity. Accordingly, the on-premise network102is hereinafter referred to as on-premise network102of the entity. Further, the term ‘entity’ as used herein may refer to an individual or an organization having one or more users (e.g., owners, employees, contractors, or administrators). The entity to which the on-premise network102belongs to is hereinafter referred to as a first entity.

The on-premise network102may be a data center including a network of IT resources106hosted on-premise. Examples of the IT resources106hosted in the on-premise network102may include, but are not limited to, servers, storage devices, network switches, routers, mobile communication devices, desktop computers, portable computers, computing system resource enclosures, or wireless local area network (WLAN) access points (some of which are depicted inFIG. 1). The servers may be blade servers, for example. The storage devices may be storage blades or storage arrays, for example. Further, in some examples, the computing system enclosures may be a blade enclosure housing one or more blades (e.g., blade servers, storage blades, etc.). One or more of the IT resources106may allow applications (e.g., an application108) and/or application management platforms (e.g., a container management platform, a VM management system, Machine-learning platforms, and the like, not shown) to run thereon. Such applications running on the IT resources106of the on-premise network102are also alternatively referred as on-premise applications. The on-premise applications, which may provide services and functions, and application management platforms may run on the IT resources, which store data.

The on-premise application108may include any software including a set of instructions executable by a processor. Examples of the on-premise application108may include, but are not limited to, a virtual machine (VM), a container, a containerized application, a pod, or a machine-learning (ML) application. By way of example, the ML application may allow an authorized user to perform various ML operations, including, but not limited to, building, training, deploying, or monitoring of one or more ML models. It is to be noted that the present disclosure is not limited with respect to a particular type of the on-premise application108, use of the on-premise application108, functionalities, and/or features offered by the on-premise application108. For the purpose of illustration, the on-premise application108is described as being a VM. The on-premise applications may be managed (created, deployed, controlled, terminated, etc.) using respective application management platforms hosted on the on-premise network102. For example, the applications such as VMs may be managed via VM management platforms. Further, an application management platform may provide flexibility to deploy and manage the applications (e.g., the on-premise application108) at scale on any infrastructure, for example, on one or more of the IT resources106, colocation facilities, multiple public clouds, or at the edge.

In some examples, communication to and from the on-premise application108may be enabled via one or more remote communication agents (RCAs), for example, RCAs122A and122B, one of which may be active at any given time and another may remain stand-by. For the purpose of illustration hereinafter, the remote communication agent (RCA)122A is described as being operated as an active RCA whereas the RCA122B may be operated as a standby RCA. In some example, the RCA122A,122B may be implemented as a software resource (for example, a VM, a container, a containerized application, or a pod executing on one or more of the IT resources106) or a hardware resource that is capable of or configured to communicate with the on-premise application108. For example, one or both of the RCAs122A,122B may be linked to the on-premise application108by allocating an IP address and a port associated with the on-premise application108to the RCAs122A and122B.

Further, in some examples, the on-premise network102may include a monitoring agent123hosted on one or more of the IT resources106. In some example, the monitoring agent123may be implemented as a software resource (for example, a VM, a container, a containerized application, or a pod executing on one or more of the IT resources106) or a hardware resource that is capable of or configured to monitor the RCAs122A and122B. The monitoring agent123may monitor the RCAs122A,122B for any failure. For example, if the RCA122A is identified to have a failure or stops functioning, the monitoring agent123may restart the RCA122A. In case the RCA122A cannot be restarted, the monitoring agent123may generate a first alert. Similarly, if the RCA122B is identified to have a failure or stops functioning, the monitoring agent123may restart the RCA122B. In case the RCA122B cannot be restarted, the monitoring agent123may generate a second alert. The first alert and/or the second alert may be issued to the administrator (or any other relevant user or system) via one or more messaging techniques, including but not limited to, displaying an alert message on a display, via a text message such as a short message service (SMS), a Multimedia Messaging Service (MMS), and/or an email, via an audio alarm, video, or an audio-visual alarm, a phone call, etc. without limiting the scope of the present disclosure.

The cloud network104may be a public cloud network which may include a network of IT resources (similar to the IT resources106, for example) that are interconnected via the Internet, collocated at a common place or distributed among several locations. The cloud network104is external to the on-premise network102. The services, for example, storage, compute, and/or networking capabilities offered by the IT resources of the cloud network104and/or the on-premise network102may be accessed by authorized users of the cloud network104via a cloud platform system, hereinafter referred to as cloud platform110, hosted on the cloud network104. The cloud platform110may provide its tenants a cloud-like experience by allowing management and/or usage of capabilities such as, for example, information technology (IT) infrastructure and/or services offered by respective on-premise networks in a pay-per-use model. The term ‘tenant’ of the cloud platform110as used herein may refer to an entity that is enrolled/registered with the cloud platform110to avail services offered by the cloud platform110. There may be one or more users associated with the entity that is registered with the cloud platform110as the tenant. Accordingly, the users associated with the entity that is registered with the cloud platform110as the tenant are hereinafter referred to as tenant users. In some examples, all of the tenant users associated with a given tenant may share same subscription or access privileges for a given on-premise application. In certain other examples, the tenant users associated with the given tenant may have different subscription or access privileges among them for the given on-premise application. In the description hereinafter, services offered by the cloud platform110are described with reference to single on-premise network102associated with the first entity that is registered with the cloud platform110as a first tenant. Therefore, the term “first tenant user” refers to a user associated with the first entity.

Accordingly, in some examples, the first tenant users, depending on respective access privileges, can access one or more of several applications including but not limited to VMs, containers, pods, machine-learning operations, data storage, compute, virtual networking, or the like, hosted on the on-premise network102of the entity as services via the cloud platform110in a pay-per-use model. In a similar fashion, the cloud platform110may provide a cloud-like experience to a plurality of its tenants (e.g., registered entities with the cloud platform110) to use applications and/or services hosted on respective on-premise networks on a pay-per-use basis, for example. In some examples, the IT resources106may either be managed by the first entity itself or a third-party organization via a management platform such as the cloud platform110. In certain examples, the IT resources106may be owned and/or managed by the third-party organization, although the IT resources106are deployed in the on-premise network of the first entity to provide enhanced security as implemented by the entity's IT policies and data security norms while providing the cloud-like experience.

The management and/or consumption of the IT resources106, the on-premise application management platforms, and the on-premise applications, the on-premise data, and the on-premise services offered by the on-premise network102may be facilitated in a cloud-like manner via the cloud platform110to the first tenant users everywhere one needs. In some examples, the cloud platform110may enable management and/or consumption of such capabilities of the on-premise network102as-a-service in a pay-per-use model at the edge, in colocations, and in a data center. Using the cloud platform110, the first tenant users can use the on-premise applications (e.g., the on-premise application108) hosted on the on-premise network102, rapidly deploy the on-premise services, gain cost and compliance insights, and simplify management across of IT infrastructure of the on-premise network102. Various examples of the on-premise services and/or public cloud services managed by the cloud platform110, in the pay-per-use model, may include, but are not limited to, containers, virtual machines, bare metal, machine learning, database platform, private cloud, SAP HANA® produced by SAP SE, data protection, networking, storage, compute, and high-performance compute. The first tenant user can run various workloads using the foregoing example applications.

In some examples, communication between the cloud platform110and the on-premise networks associated with various tenants may be secured with the use of secure communication tunnels specific to each tenant. The term “secure communication tunnel” as used herein may refer to a secure communication channel established via protocols or techniques such as, but not limited to, one or more of Hyper Text Transfer Protocol Secure (HTTPS), Transport Layer Security (TLS) (e.g., TLS version 1.2), Internet Protocol Security (IPSec), Secure Shell (SSH), TLS over IPsec, SSH over IPsec. For example, the cloud platform110may communicate with the on-premise network102over a secure communication tunnel112that is specific to (i.e., exclusive to) the first tenant to which the on-premise network102belongs. Accordingly, the cloud platform110may communicate with other on-premise networks over respective separate secure communication tunnels specific to the respective tenants. In some examples, the secure communication tunnel112may be mapped to a unique URL which may be accessible by the first tenant. In particular, the secure communication tunnel112may be mapped to an application service121hosted on the cloud platform110. In one example, the application service121may be a Kubernetes service. The application service121may create an ingress which is an external end point as the unique URL. In particular, the first tenant users can open the unique URL via a web-browser or via a mobile application and can access the on-premise application108for various management operations thereon upon successful authentication.

Details of establishing the secure communication tunnel112are described in conjunction withFIGS. 8 and 9. Further, to enable such secure communication with the on-premise network102, in some examples, the cloud platform110may include a communication management system114. The communication management system114may receive data traffic and direct the data traffic to respective destination, for example, respective on-premise network via a secure communication tunnel specific to a tenant associated with the data traffic.

To effect such secure routing of the data traffic to its respective destination, the communication management system114may include a communication controller116and a plurality of communication delegates118A,118B, and118C (hereinafter collectively referred to as communication delegates118A-118C). InFIG. 1, the communication management system114is shown to include three communication delegates118A-118C, for illustration purposes. In some examples, the communication management system114may include a separate communication delegate corresponding each of a plurality of tenants of the cloud platform110. In particular, each of the communication delegates118A-118C may be mapped to a unique tenant of the plurality of tenants of the cloud platform110.

In the description hereafter, for illustration purposes, the communication delegate118A is described as a communication delegate that is mapped to the first tenant of the cloud platform110. The communication delegates118B and118C may be mapped to respective ones of other tenants (e.g., a second tenant and a third tenant, respectively) of the cloud platform110. The tenants mapped to communication delegates118B and118C may have respective on-premise networks (not shown). Details regarding configuration of the communication controller116and operations performed by the communication controller116are described on conjunction withFIGS. 4 and 7. Further, details regarding configuration of the communication delegate118A and operations performed by the communication delegate118A are described on conjunction withFIGS. 5-7. Other communication delegates118B,118C are understood to have similar configuration as that of the communication delegate118A and may perform similar operations as that of the communication delegate118A corresponding to respective data traffic directed to respective tenants.

Each of the plurality of communication delegates118A-118C may securely communicate with an on-premise network associated with a respective tenant via a secure communication tunnel that is specific to the respective tenant. In particular, for illustration purposes, one such secure communication tunnel112is depicted inFIG. 1that is specific to the first tenant and through which the communication delegate118A mapped to the first tenant may communicate with the on-premise network102. Similarly, the other communication delegates118B and118C may communicate with respective on-premise networks (not shown) via respective separate secure communication tunnels (not shown) that are specific to the respective tenants (e.g., the second tenant and the third tenant, respectively).

In some examples, the secure communication tunnels between one or more of the communication delegates118A-118C and respective on-premise networks may be established through a common midway server, such as, a midway server120. In certain other examples, the secure communication tunnels of one or more of communication delegates118A-118C may be established via one midway server (e.g., the midway server120), whereas the secure communication tunnels associated with certain other communication delegates may be established via another midway server (not shown). Examples of the midway server120may include, but are not limited to, a desktop computer, a laptop, a mobile device, a blade server, a computer appliance, a workstation, a storage system, or a converged or a hyperconverged system, or the like. In the description hereinafter, references will be made the secure communication tunnel112between the communication delegate118A and the on-premise network102that is specific to the first tenant. The secure communication tunnels between the other communication delegates118B,118C and the respective on-premise networks may have similar features and may be established in a similar fashion as described with reference to the secure communication tunnel112.

In some examples, the secure communication tunnel112may include a first communication tunnel124A and a second communication tunnel124B. The first communication tunnel124A may be a secure communication channel between the communication delegate118A and the midway server120. Similarly, the second communication tunnel124B may be a secure communication channel between the midway server120and the RCA122A hosted at the on-premise network102. In certain examples, the secure communication tunnel112may include a standby communication tunnel124C that may be a secure communication channel between the midway server120and the RCA122B (which may be in a standby mode). Additionally, in some examples, to enhance speed of data transfer and load balancing within the secure communication tunnel112, a plurality of communication links may be operationalized within the secure communication tunnel112. In some examples, one or more of the first communication tunnel124A, the second communication tunnel124B, or the standby communication tunnel124C may be a secure communication channel established according to one or more of HTTPS, TLS, IPSec, SSH, TLS over IPsec, or SSH over IPsec techniques. In some examples, one or more of the first communication tunnel124A, the second communication tunnel124B, or the standby communication tunnel124C may be formed on-demand, remain persistent, or scheduled and may enable unidirectional communications or bi-directional communications. For example, the data traffic from originated from the on-premise application108may be sent to the cloud platform110through the secure communication tunnel112.

During operation, the first tenant user may login to the cloud platform110and may perform one or more operations pertaining to the on-premise application108or using the on-premise application108. In some examples, actions performed by the first tenant user may generate data traffic directed to the on-premise application108. The actions performed may include, but are not limited to, adding new applications, removing the on-premise application108, modifying the on-premise application108, accessing the on-premise application108, updating user access for the on-premise application108, and the like. It is to be noted that the scope of the present disclosure is not limited with respect to types of operations performed by the tenant user. The term “data traffic” as used herein may refer to any data that is generated in response to the tenant user performing any action and/or any automated action (e.g., monitoring of resource usages, performance checks, automated updates, or any scheduled or event driven actions) performed via the cloud platform110.

The communication controller116may direct the data traffic to a communication delegate, from the plurality of communication delegates, that is mapped to the tenant associated with the data traffic. For example, if the data traffic is generated due to any action performed by the first tenant user associated with the tenant, the communication controller116may direct the data traffic to the communication delegate118A mapped to the first tenant. Accordingly, the communication delegate118A may receive the data traffic. The communication delegate118A may encrypt the data traffic to generate an encrypted data traffic using a unique certificate associated with the communication delegate118A and communicate the encrypted data traffic to the on-premise application108via the secure communication tunnel112that is specific to the first tenant. In some examples, the unique certificate may include an identifier of the communication delegate118A and an IP address associated with the communication delegate. An example unique certificate associated with the communication delegate118A is depicted inFIG. 3.

In some examples, the communication management system114may include a certificate store119. The certificate store119represent a repository of data, for example, a repository that stores unique certificates corresponding to each of the communication delegates118A-118C. In some examples, the unique certificate associated with the communication delegate118A may be stored in the certificate store119. The unique certificate associated with the communication delegate118A may be retrieved by the communication delegate118A to encrypt the data traffic.

In some examples, the communication controller116, during operation, may monitor the communication delegate118A to keep a check on failure of any of a first plurality of communication links established in the secure communication tunnel112between the communication delegate118A and the active RCA122A. In case failure of any communication links of the first plurality of communication links is detected, the communication controller116may reestablish the failed communication link. In case a threshold number (or more) of the first plurality of communication links are found broken, the communication controller116may switch the secure communication tunnel112to the standby RCA122B. In such situation, the secure communication tunnel112may be formed of the first communication tunnel124A and the standby communication tunnel124C. In some examples, the threshold number may be determined based on a predefined data transfer bandwidth. For example, the threshold number may represent a number of communication links that are useful to achieve the predefined data transfer bandwidth. In certain other examples, the threshold number may be same as a number of communication links in the first plurality of communication links.

As will be appreciated, in some examples, the cloud platform110proposed herein enables secure communication between the cloud platform110and the on-premise application108running on the on-premise network102of the first tenant. This is achieved at least in part by communicating the encrypted data traffic over the secure communication tunnel112that is specific to the first tenant. Further, in some examples, the secure communication tunnel112is established between the communication delegate118A that is uniquely mapped to the first tenant. In particular, the cloud platform110includes separate communication delegate for each of the tenants of the cloud platform110. Use of the individual communication delegates for each of the tenants may provide multi-tenancy support while ensuring secure communication. Moreover, the communication delegate118A may have its respective unique certificate300configured with the delegate ID302and the IP address304associated with the communication delegate118A. These parameters contained in the unique certificate300may be used to establish a trust at the midway server120to ensure that the encrypted data traffic is coming from an authorized communication delegate thereby enhancing data security and ensuring that secure communication tunnel112does not interfere with secure communication tunnels associated with other tenants (not shown).

Furthermore, in some examples, the secure communication tunnel112proposed herein is highly-available as it is monitored continuously for any failures. More particularly, in a situation when the first RCA122A fails and the second communication tunnel124B is broken, the secure communication tunnel112may remain stable as the RCA122B may be made active and the second communication tunnel124B may be made operational. Further, the administrator may be alerted by the monitoring agent123in case of failure of one or more of the RCAs122A,122B so that the administrator can take relevant corrective actions. Additionally, use of the plurality of communication links within the secure communication tunnel112may enhance speed of data transfer and load balancing within the secure communication tunnel112.

Referring now toFIG. 2, a portion200of a cloud network104is presented, in accordance with an example. In some examples, the portion200of the cloud network104depicted inFIG. 2may include one or more network clusters, such as, network clusters202,204, and206each of which may be uniquely reachable via respective IP addresses. InFIG. 2, three network clusters202-206are depicted for illustration purposes. In some examples, the cloud network104may include any number of network clusters, without limiting the scope of the present application. As depicted inFIG. 2, each of the network cluster may include a network of one or more computing systems, for example computing systems208,210,212,214,216,218,220,222, or224(hereinafter collectively referred to as computing systems208-224). In the example ofFIG. 2, the network cluster202is shown to include computing systems208,210, and212; the network cluster204is shown to include computing systems214,216, and218; and the network cluster204is shown to include computing systems220,222, and224. It is to be noted that the network clusters202-206may include same or different number of computing systems. Also, the scope of the present disclosure is not limited with reference to the number of computing systems that can be included in each of the network clusters202-206. Examples of the computing systems208-224may include, but are not limited to, desktop computers, laptops, mobile devices, servers, computer appliances, workstations, storage systems, or converged or hyperconverged systems, or the like. Further, in some examples, the network cluster202-208may be coupled to each other via a network (not shown).

In some examples, the network clusters202-206may be Kubernetes clusters. In such an implementation, in a given network cluster of the network clusters202-206, one computing system may act as a master node (also referred to as a management node) and the rest of the computing systems may operate as worker nodes (also referred to as member nodes). The master node may run container management platform to manage deployment, monitoring, and/or migration of workloads on the worker nodes in the given cluster. For purpose of illustration, the computing systems208,214, and220may be operated as management nodes in the network clusters202,204, and206, respectively. Whereas, the rest of the computing systems210,212,216,218,222, and224may be configured to be operated as worker nodes that may provide resources (e.g., compute, storage, networking, etc.) for execution of workloads running thereon.

In some examples, the communication delegates118A-118C may be deployed on one or more of the network clusters204-206as workloads (in the form of containers or pods). For illustration purposes, the communication delegates118A,118B, and118C are shown as deployed on the network clusters202,204, and206, respectively. For example, the communication delegates118A,118B, and118C may be respectively deployed on the computing systems212,218, and224as containers or pods. In some examples, all of the communication delegates118A,118B, and118C may be deployed in a common network cluster. In certain other examples, the communication delegates118A,118B, and118C may be distributed (e.g., as depicted inFIG. 2) among two or more of the network clusters202-206. In some examples, although not depicted inFIG. 2, the communication controller116and the certificate store119may also be hosted on the worker nodes of one or more of the network clusters202-206.

Moving now toFIG. 3, a unique certificate300associated with the communication delegate118A is depicted, in accordance with an example. An example of the unique certificate300may include a digital certificate that uses widely accepted international X.509 public key infrastructure (PKI) standard to verify that a public key belongs to the tenant identified in the certificate300. In some examples, the unique certificate associated with a given communication delegate may include, among other information, an identifier of the given communication delegate (hereinafter referred to as a delegate ID) and an IP address associated with the given communication delegate. The delegate ID may represent a unique identifier of the given communication delegate. The IP address associated with the given communication delegate may include an IP address of a cluster of the one or more network clusters202-208that hosts the given communication delegate. In the example ofFIG. 3, the unique certificate300associated with the communication delegate118A is shown to include a delegate ID302of the communication delegate118A and an IP address304associated with the communication delegate118A. The IP address304represents an IP address of the network cluster202hosting the communication delegate118A. Further, the delegate ID302may be a unique combination of one or more of numbers, letters, or symbols. For example, inFIG. 3, the certificate300is shown to include the delegate ID302having an example value of “4651654616546546” and the IP address304having example value of 24.219.117.108. The values of the delegate ID302and the IP address304depicted inFIG. 3are for example purposes only, any resemblance of these values with other IDs or IP addresses may be a mere coincidence.

In certain other examples, although not depicted inFIG. 3, the certificate300may include additional information including, but not limited to, a version number of the certificate300, a serial number of the certificate300, a signature algorithm ID of the certificate300, a name of an issuer of the certificate300, a validity period of the certificate300, a name of the communication delegate (e.g., the communication delegate118A), public key information of the communication delegate118A, a public key algorithm, a public key of the communication delegate118A, a unique ID of the issuer of the certificate300, a signature algorithm of the certificate300, a signature of the certificate300, or any combination of the foregoing. In some examples, the certificate300may be signed by a trusted certificate authority or may be validated by other means. Accordingly, someone holding the certificate300can rely on the public key contained in the certificate300to establish secure communications with another party, or validate documents or data digitally signed/encrypted by the corresponding private key.

Turning now toFIG. 4, a block diagram400depicting the communication controller116of the communication management system114(seeFIG. 1) is presented, in accordance with an example. In some examples, the communication controller116may be a processor-based system that performs various operations to direct data traffic to respective communication delegate of the communication delegates118A-118C in the cloud platform110ofFIG. 1. In some examples, the communication controller116may be a device including a processor or a microcontroller and/or any other electronic component, or a device or system that may facilitate various compute, data storage, and/or data processing, for example. In certain other examples, the communication controller116may be deployed as a software resource, for example, a VM, a container, a containerized application, or a pod executing on one or more of the IT resources hosted in the cloud network104. In some examples, the communication controller116may be deployed as the software resource in one or more of the network clusters202-206.

In some examples, the communication controller116may include a processing resource402and a machine-readable medium404. The machine-readable medium404may be any electronic, magnetic, optical, or other physical storage device that may store data and/or executable instructions406. For example, the machine-readable medium404may include one or more of a Random Access Memory (RAM), an Electrically Erasable Programmable Read-Only Memory (EEPROM), a storage drive, a flash memory, a Compact Disc Read Only Memory (CD-ROM), and the like. The machine-readable medium404may be non-transitory. As described in detail herein, the machine-readable medium404may be encoded with the executable instructions406to perform operations at one or more blocks of a method described inFIG. 7(described later).

Further, the processing resource402may be a physical device, for example, one or more central processing unit (CPU), one or more semiconductor-based microprocessors, one or more graphics processing unit (GPU), application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), other hardware devices capable of retrieving and executing instructions406stored in the machine-readable medium404, or combinations thereof. The processing resource402may fetch, decode, and execute the instructions406stored in the machine-readable medium404to direct data traffic to respective communication delegate of the communication delegates118A-118C. As an alternative or in addition to executing the instructions406, the processing resource402may include at least one integrated circuit (IC), control logic, electronic circuits, or combinations thereof that include a number of electronic components for performing the functionalities intended to be performed by the communication controller116. Moreover, in certain examples, where the communication controller116is implemented as the software resource, the processing resource402and the machine-readable medium404may represent a processing resource and a machine-readable medium of a hardware or a computing system that hosts the communication controller116as the software resource.

In some examples, the machine-readable medium404may also include a delegate-tenant mapping408. The delegate-tenant mapping408may include a mapping between the tenants of the cloud platform110and communication delegates118A-118C. Each of the tenants of the cloud platform110may be assigned a unique tenant identifier (ID) which may be a unique combination of one or more of numbers, letters, or symbols. Accordingly, the delegate-tenant mapping408may include mapping between the tenant IDs and communication delegates118A-118C. In one example, if the tenant IDs corresponding to the first tenant, the second tenant, and the third tenant are1234,1235,1236, respectively, Table-1 depicted below may represent an example delegate-tenant mapping408. As previously noted, the first tenant is associated with the on-premise network102hosting the on-premise application108.

In certain examples, the communication controller116may allow an administrator to define one or more additional tenant IDs upon onboarding of new tenants and allocate respective communication delegates and update the delegate-tenant mapping408to include respective entries. Although, the content of the delegate-tenant mapping408is shown in the form of a table (e.g., Table-1), the content of the delegate-tenant mapping408may be stored in any suitable form including but not limited to, a syntax or a script. The delegate-tenant mapping408may be referenced by the processing resource402to identify a communication delegate corresponding to a tenant ID identified from a data traffic. The communication controller116may then forward the data traffic to the identified communication delegate. Details regarding the operations performed by the communication controller116are described on conjunction with a method depicted inFIG. 7.

Turning now toFIG. 5, a block diagram500depicting a communication delegate, such as, the communication delegate118A is presented, in accordance with an example. In some examples, the communication delegate118A may be a processor-based system that performs various operations to communicate the data traffic from the cloud platform110hosted on the cloud network104to the on-premise application108hosted on the on-premise network102. In some examples, the communication delegate118A may be a device including a processor or a microcontroller and/or any other electronic component, or a device or system that may facilitate various compute, data storage, and/or data processing, for example. In certain other examples, the communication delegate118A may be deployed as a software resource, for example, a VM, a container, a containerized application, or a pod executing on one or more of the IT resources hosted in the cloud network104. In some examples, as depicted inFIG. 2, the communication delegate118A may be deployed as the software resource in one or more of the network clusters202-206.

In some examples, the communication delegate118A may include a processing resource502and a machine-readable medium504. The machine-readable medium504may be non-transitory and is representative of one example of the machine-readable medium404. Further, the machine-readable medium504may include one or more example devices as that of the machine-readable medium404. As described in detail herein, the machine-readable medium504may be encoded with the executable instructions506to perform operations at one or more blocks of methods described inFIGS. 6 and 7(described later). Further, the processing resource502may be representative of one example of the processing resource402and may include one or more example devices as that of the processing resource402. The processing resource502may fetch, decode, and execute the instructions506stored in the machine-readable medium504to communicate the data traffic from the cloud platform110hosted on the cloud network104to the on-premise application108hosted on the on-premise network102. As an alternative or in addition to executing the instructions506, the processing resource502may include at least one integrated circuit (IC), control logic, electronic circuits, or combinations thereof that include a number of electronic components for performing the functionalities intended to be performed by the communication delegate118A. Moreover, in certain examples, where the communication delegate118A is implemented as the software resource, the processing resource502and the machine-readable medium504may represent a processing resource and a machine-readable medium of a hardware or a computing system that hosts the communication delegate118A as the software resource.

In the description hereinafter, several operations performed by the communication controller116or the communication delegate118A will be described with help of flow diagrams depicted inFIGS. 6-7. For illustration purposes, the flow diagrams depicted inFIGS. 6-7are described in conjunction with the networked system100ofFIG. 1and the block diagram400and500ofFIGS. 4-5, however, the methods ofFIG. 6-7should not be construed to be limited to the example configuration of networked system100(e.g., with respect to quantity of on-premise network, communication delegates, etc.). The methods described inFIGS. 6-7include a plurality of blocks, operations at which may be performed by a processor-based system such as, for example, any of the communication controller116or the communication delegate118A. In particular, operations at each of the plurality of blocks may be performed by the respective processing resource402or502by executing one or more of the instructions406,506, respectively stored in the machine-readable mediums404,504. In particular, the methods described inFIGS. 6-7may represent an example logical flow of some of the several operations performed by the communication controller116or the communication delegate118A. However, in some other examples, the order of execution of the blocks depicted inFIGS. 6-7may be different than the order shown. For example, the operations at various blocks may be performed in series, in parallel, or a series-parallel combination.

Referring now toFIG. 6, a flow diagram of a method600for providing secure communication between the on-premise application108hosted on the on-premise network102and the cloud platform110is presented, in accordance with an example. The method600may include blocks602,604, and606that are performed by the communication delegate118A. In some examples, operations at blocks602,604, and606may be performed by the processing resource502by executing one or more of the instructions506stored in the machine-readable medium504.

At block602, the communication delegate118A may receive the data traffic associated with a tenant, in particular, the first tenant, and directed to the on-premise application108hosted on the on-premise network102of the first tenant. The data traffic is forwarded to the communication delegate118A by the communication controller116. Details of forwarding the data traffic to the communication delegate118A by the communication controller116are described inFIG. 7.

Further, at block604, the communication delegate118A may encrypt the data traffic to generate an encrypted data traffic using a unique certificate (e.g., the certificate300) associated with the communication delegate118A. In some examples, communication delegate118A may implement one or more encryption techniques (e.g., encryption using public key cryptography and digital certificates such as the X.509 certificates). In some examples, the encryption of the data traffic may include linking the data traffic to the unique certificate of the communication delegate. For example, the communication delegate118A may link the unique certificate300with the data traffic received from the communication controller116so that the recipient (e.g., the midway server120or the on-premise application108) of the encrypted data traffic can verify the identity of the communication delegate118A. Only the communication delegate118A may be in possession of a private key associated with the public key listed in the certificate300. Accordingly, in some examples, the communication delegate118A may encrypt (e.g., sign) the data traffic using the private key. The recipient can validate the encrypted data traffic using the public key contained in the unique certificate300.

Moreover, at block606, the communication delegate118A may communicate the encrypted data traffic to the on-premise application108via the secure communication tunnel112that is specific to the first tenant. Details regarding the transmission of the encrypted data traffic over the secure communication tunnel112is described in conjunction withFIG. 7.

Moving now toFIG. 7, a detailed flow diagram of a method700for providing secure communication between the on-premise application108hosted on the on-premise network102and the cloud platform110is presented, in accordance with an example. The method700may include blocks702,704,706,708,710,712,714,716, and718. Amongst these blocks, operations at blocks702,704, and706may be performed by the communication controller116. Further, operations at blocks708,710,712, and714may be performed by the communication delegate118A. Furthermore, operations at blocks716and718may be performed by the midway server120.

At block702, the communication controller116may receive data traffic. The data traffic may include information data and a unique identifier associated with a tenant (alternatively referred to as a tenant ID) associated with the tenant user that is logged-in while the data traffic is generated. In some examples, the communication controller116may identify/extract the tenant ID from the data traffic. For example, if the data traffic relates to the first tenant, the data traffic may include the tenant ID1234. Accordingly, the communication controller116may extract the tenant ID1234from the data traffic. Further, at block704, the communication controller116may identify a communication delegate mapped to the tenant from among the plurality of communication delegates118A-118C based on the tenant ID. For example, the processing resource402may reference the delegate-tenant mapping408to identify a communication delegate corresponding to the tenant ID identified from the data traffic. For example, if the tenant ID identified from a data traffic is1234, the processing resource402may identify the communication delegate118A as the communication delegate mapped to the first tenant using the delegate-tenant mapping408. Once the communication delegate mapped to the first tenant is identified, at block706, the processing resource402may forward the data traffic to the communication delegate identified at block704. For example, if the tenant ID identified from a data traffic is1234, the processing resource402may forward the data traffic to the communication delegate118A. Accordingly, at block708, the data traffic may be received by the communication delegate118A, for example.

Further, in some examples, at block710, the communication delegate118A may retrieve the unique certificate (e.g., the certificate300) associated with the communication delegate118A. For example, the communication delegate118A may perform a search in the certificate store119using parameters including, but not limited to, delegate ID or the serial number of the certificate300and retrieve the matching certificate—that is the certificate300associated with the communication delegate118A. Once retrieved, at block712, the processing resource502may encrypt the data traffic to generate the encrypted data traffic using the certificate300in a similar fashion as described in conjunction withFIG. 6. Moreover, the processing resource502may communicate the encrypted data traffic to the on-premise application108via the secure communication tunnel112that is specific to the first tenant. As previously noted, the secure communication tunnel112is formed of two communication tunnels—the first communication tunnel124A and the second communication tunnel124B. In some examples, at block714, the processing resource502may send the encrypted data traffic to the midway server120via the first communication tunnel124A.

At block716, the midway server120may verify a delegate ID and an IP address associated with the encrypted data traffic received at the midway server120. The IP address associated with the encrypted data traffic may refer to an IP address contained appended with the encrypted data traffic indicative of a source address of the encrypted data traffic. The delegate ID associated with the encrypted data traffic may represent an identifier of a communication delegate from which the encrypted data traffic is received and may be appended with the encrypted data traffic received at the midway server120. In particular, the midway server120may compare the IP address associated with the incoming encrypted data traffic with the IP address304stored in the certificate300. Further, the midway server120may compare a delegate ID associated with the incoming encrypted data traffic with the delegate ID302stored in the certificate300. In some examples, the midway server120may determine that the verification is successful if the delegate ID and IP address associated with the incoming encrypted data traffic matches with the delegate ID302and the IP address304, respectively, contained in the certificate300. In some examples, upon successful verification of the delegate ID and IP address, at block718, the midway server120may forward the encrypted data traffic to the RCA122A via the second communication tunnel124B. The encrypted data traffic may then be communicated from the RCA122A to the on-premise application108hosted on the on-premise network.

Turning now toFIG. 8, a flow diagram of a method800for establishing a secure communication tunnel, such as, the secure communication tunnel112, is presented, in accordance with an example. In some examples, operations at various blocks802,804,806,808, and810of the method800may be performed during an onboarding phase of the first tenant with the cloud platform110.

At block802, the second communication tunnel124B may be established between the midway server120and the RCA122A. In particular, to establish the second communication tunnel124B, the RCA122A may be configured with the delegate ID302of the communication delegate118A. Once configured with the delegate ID302, the RCA122A may be operationalized (i.e., is run/executed) so that the RCA122A connects securely to the midway server120via a secure communication channel that is the second communication tunnel124B. In some examples, the RCA122A may be configured with the delegate ID302to ensure that RCA122A accept the encrypted data traffic associated only with the delegate ID302. Further, at block804, the RCA122A may be linked to the on-premise application108hosted at the on-premise network102by allocating an IP address and a port associated with the on-premise application108to the RCA122A.

Further, at block806, the first communication tunnel124A may be established between communication delegate118A and the midway server120. In particular, to establish the first communication tunnel124A, the communication delegate118may be mapped the RCA122A based on one or more of the tenant ID, a time-bound token, and an identifier associated with a RCA122A (hereinafter referred to as an agent ID) hosted at the on-premise network102. Once configured, the communication delegate118A may be operationalized (i.e., is run/executed) so that the communication delegate118A securely connects to the midway server via a secure communication channel that is the first communication tunnel124A. Upon establishing the first communication tunnel124A and the second communication tunnel124B, the secure communication tunnel112is said to be successfully established.

Furthermore, at block808, the secure communication tunnel112may be mapped to a unique Uniform Resource Locator (URL) accessible by the first tenant. In some examples, authorized users of the first tenant (i.e., the first tenant users) can access the on-premise application108via the unique URL that is mapped to the secure communication tunnel112. In particular, the first tenant users can open the unique URL via a web-browser or via an application and can access the application for various management operations thereon upon successful authentication. During operation, all data traffic corresponding to the tenant ID associated with the first tenant and directed to the on-premise application108may be transmitted through the secure communication tunnel112specific to the first tenant as described in conjunction with one or more of the previous drawings. Additionally, in some examples, to enhance speed of data transfer and load balancing within the secure communication tunnel112, a plurality of communication links may be operationalized within the secure communication tunnel112, as indicated by block810. For example, multiple communication channels are mapped to the application service121, which is in-turn mapped to the unique URL. The first tenant users can open this unique URL through browser and hence access the multiple communication channels to communicate with the on-premise application108. Detailed sequence of operations performed to establish the secure communication tunnel112is described in conjunction withFIG. 9.

Moving now toFIG. 9, a sequence diagram900depicting example sequence of operations for setting-up the secure communication tunnel112between the communication delegate118A and the on-premise network102is presented, in accordance with an example.

At operation902, an administrator (labeled as ADMIN inFIG. 9) may install the RCA122A on one of the IT resources106at the on-premise network102and configure the RCA122A with the delegate ID302of the communication delegate118A so that the RCA122A can communicate with the communication delegate118A. Similarly, at operation904, the administrator may install the RCA122B on one of the IT resources106and configure the RCA122B with the delegate ID302of the communication delegate118A so that the RCA122B can communicate with the communication delegate118A. Installation may be performed through an automated computer-based process, such as via scripts or the like. At operation906, a communication path is established between the RCA122A and the on-premise application108by linking a port and an IP address associated with the on-premise application108with the RCA122A so that the RCA122A can communicate data (e.g., the encrypted data traffic) to the on-premise application108or receive data from the on-premise application108. Moreover, at operation908, the RCA122A is operationalized (i.e., is run/executed) so that it establishes a secure communication channel with the midway server120. This secure connection channel between the RCA122A and the midway server120is referred to as the second communication tunnel124B. It may be noted that in some examples, the order of operations906and908may be reversed without limiting the scope of the present disclosure.

Further, in certain examples, at operation910, a communication path is established between the RCA122B and the on-premise application108by linking the port and the IP address associated with the on-premise application108with the RCA122B so that the RCA122B can communicate data (e.g., the encrypted data traffic) to the on-premise application108or receive data from the on-premise application108. Moreover, at operation912, the RCA122B is operationalized (i.e., is run/executed) so that it establishes a secure communication channel with the midway server120. This secure connection channel between the RCA122B and the midway server120is referred to as the standby communication tunnel124C. It may be noted that in some examples, the order of operations906and908may be reversed without limiting the scope of the present disclosure.

By now, the second communication tunnel124B and the standby communication tunnel124C have been established. In order to fully establish the secure communication tunnel112, the communication controller116and the communication delegate118A may be configured to map the communication delegate118A with the RCA122A and the RCA122B. Accordingly, at operation914, the administrator may provide an identifier of the RCA122A (alternatively referred to as a station ID (SSID) of the RCA122A), the tenant ID, and a time-bound token via a user interface (UI, not shown). The UI may call an application programming interface (API) that supplies the inputted information regarding the SSID of the RCA122A, the tenant ID, and the time-bound token to the communication controller116hosted on the cloud platform110. Similarly, at operation916, the administrator may provide the SSID of the RCA122B, the tenant ID, and a time-bound token (which may be different from the time-bound token used at operation914) via the UI. The UI may call the API that supplies the inputted information regarding the SSID of the RCA122B, the tenant ID, and the time-bound token to the communication controller116hosted on the cloud platform110. As will be appreciated, in some examples, the actions performed at operations914and916are out-of-band actions, wherein the information, such as, the SSIDs, the time-bound tokens, and the tenant ID, is provided by the customer (e.g., the first tenant) or the administrator, thus proving that the customer (e.g., the first tenant) or the administrator providing this information is in control of the on-premise network102and the process of configuring the secure communication tunnel112.

Further, once the information (e.g., the SSIDs, the time-bound tokens, and the tenant ID) is received by the communication controller116, the communication controller116, at operation918, may select a communication delegate that is mapped to the provided tenant ID. In the current example, if the tenant ID provided at operations914and916is ‘1234’ which is corresponding to the first tenant associated with the on-premise network102, the communication controller116may select the communication delegate118A using the delegate-tenant mapping408. Moreover, at operation920, the communication delegate118A may be operationalized (i.e., is run/executed) so that it establishes a secure communication channel with the midway server120. This secure connection channel between the communication delegate118A and the midway server120is referred to as a first communication tunnel124A. In some examples, the operations914,916of supplying the information via the UI, selecting the communication delegate mapped to the tenant ID, and establishing the first communication tunnel124A by operationalizing (i.e., is run/executed) the communication delegate118A are collectively referred to as a pinning operation. Accordingly, at the end of the pinning operation, the secure communication tunnel112may be established between the communication delegate118A and the on-premise network102. As will be appreciated, use of time-bound tokens in the pinning operation enhances security of the pinning operation.

Furthermore, in some examples, at operation922, a first plurality communication links may be established within the secure communication tunnel112between the communication delegate118A and the RCA122A, wherein the encrypted data traffic is transported over one or more of the first plurality of communication links. Also, in some examples, at operation924, a second plurality of communication links may be established within the secure communication tunnel112between the communication delegate118A and the RCA122B, wherein the encrypted data traffic is transported over one or more of the second plurality of communication links when the RCA122A is non-operational.

Although the secure communication tunnel112has been established, it may not be accessible to tenant users. In order for the tenant users to access and use the secure communication tunnel112, in some examples, at operation926, the communication controller116, may map the secure communication tunnel112to a unique URL accessible by the tenant. In particular, in order to map the secure communication tunnel112to the unique URL, in some examples, the communication controller116may first map the secure communication tunnel112to the application service121(e.g., a Kubernetes service). The application service121may create an ingress which is an external end point as the unique URL. In particular, the tenant users can open the unique URL via a web-browser or via a mobile application and can access the on-premise application108for various management operations thereon upon successful authentication.

FIG. 10is a block diagram1000depicting a processing resource1002and a machine-readable medium1004encoded with example instructions to direct data traffic to respective communication delegates of the communication delegates118A-118C in the cloud platform110, in accordance with an example. The machine-readable medium1004may be non-transitory and is alternatively referred to as a non-transitory machine-readable medium1004. In some examples, the machine-readable medium1004may be accessed by the processing resource1002. In some examples, the processing resource1002may represent one example of the processing resource402of the communication controller116. Further, the machine-readable medium1004may represent one example of the machine-readable medium404of the communication controller116. As described in detail herein, the machine-readable medium1004may be encoded with executable instructions1006,1008, and1010(hereinafter collectively referred to as instructions1006-1010) to direct the data traffic to respective communication delegate of the communication delegates118A-118C. Although not shown, in some examples, the machine-readable medium1004may be encoded with certain additional executable instructions to perform operations at one or more blocks in the method700described inFIG. 7, and/or any other operations performed by the communication controller116, without limiting the scope of the present disclosure.

In some examples, the processing resource1002may fetch, decode, and execute the instructions1006-1010stored in the machine-readable medium1004to enable routing of the data traffic to respective one of the communication delegates118A-118C. In certain examples, as an alternative or in addition to retrieving and executing the instructions1006-1010, the processing resource1002may include at least one integrated circuit, other control logic, other electronic circuits, or combinations thereof that include a number of electronic components for performing the functionalities intended to be performed by the communication controller116.

The instructions1006, when executed by the processing resource1002, may cause the processing resource1002to receive the data traffic that is supposed to be communicated to any external recipient from the cloud platform110. Further, the instructions1008, when executed by the processing resource1002, may cause the processing resource1002to identify a communication delegate mapped to the tenant from among a plurality of communication delegates118A-118C based on the tenant ID identified from the data traffic received by the communication controller116. Each of the plurality of communication delegates118A-118C may be mapped respectively to a unique tenant of a plurality of tenants of the cloud platform110. Further, the instructions1010, when executed by the processing resource1002, may cause the processing resource1002to forward the data traffic to the communication delegate that is mapped to the tenant.

FIG. 11is a block diagram1100depicting a processing resource1102and a machine-readable medium1104encoded with example instructions to communicate the data traffic from the cloud platform110hosted on the cloud network104to the on-premise application108hosted on the on-premise network102, in accordance with an example. The machine-readable medium1104may be non-transitory and is alternatively referred to as a non-transitory machine-readable medium1104. In some examples, the machine-readable medium1104may be accessed by the processing resource1102. In some examples, the processing resource1102may represent one example of the processing resource502of the communication controller116. Further, the machine-readable medium1104may represent one example of the machine-readable medium504of the communication controller116. As described in detail herein, the machine-readable medium1104may be encoded with executable instructions1106,1108, and1110(hereinafter collectively referred to as instructions1106-1110) to communicate the data traffic from the cloud platform110hosted on the cloud network104to the on-premise application108hosted on the on-premise network102. Although not shown, in some examples, the machine-readable medium1104may be encoded with certain additional executable instructions to perform operations at one or more blocks in the methods600and700described inFIGS. 6-7, and/or any other operations performed by the communication delegate118A, without limiting the scope of the present disclosure.

In some examples, the processing resource1102may fetch, decode, and execute the instructions1106-1110stored in the machine-readable medium1104to communicate the data traffic from the cloud platform110to the on-premise application108. In certain examples, as an alternative or in addition to retrieving and executing the instructions1106-1110, the processing resource1102may include at least one integrated circuit, other control logic, other electronic circuits, or combinations thereof that include a number of electronic components for performing the functionalities intended to be performed by the communication delegate118A.

The instructions1106, when executed by the processing resource1102, may cause the processing resource1102to receive data traffic associated with a tenant (e.g. the first tenant) and directed to the on-premise application108hosted on an on-premise network102of the first tenant. Further, the instructions1108, when executed by the processing resource1102, may cause the processing resource1102to encrypt the data traffic to generate an encrypted data traffic using a unique certificate (e.g., the certificate300) associated with the communication delegate (e.g., the communication delegate118A). Furthermore, the instructions1106, when executed by the processing resource1102, may cause the processing resource1102to communicate the encrypted data traffic to the on-premise application108via the secure communication tunnel112specific to the first tenant between the communication delegate118A and the on-premise network102.

While certain implementations have been shown and described above, various changes in form and details may be made. For example, some features and/or functions that have been described in relation to one implementation and/or process can be related to other implementations. In other words, processes, features, components, and/or properties described in relation to one implementation can be useful in other implementations. Furthermore, it should be appreciated that the systems and methods described herein can include various combinations and/or sub-combinations of the components and/or features of the different implementations described.