Cloud-based virtual private access systems and methods

A cloud system adapted to implement virtual private access, the cloud system comprising:

• one or more cloud nodes communicatively coupled to one another;
• wherein each of the one or more cloud nodes comprises one or more processors and memory storing instructions that, when executed, cause the one or more processors to receive a request to access resources from a user device, wherein the resources are located in one of a public cloud and an enterprise network and the user device is remote therefrom on the Internet;
• forward the request to a central authority for a policy look up and for a determination of connection information to make an associated secure connection through the cloud system to the resources;
• receive the connection information from the central authority responsive to an authorized policy look up;
• create secure tunnels by and through the cloud system and between the user device and the resources based on the connection information wherein the creating secure tunnels comprises creating connections between one or more cloud nodes in the cloud system, wherein the one or more cloud nodes do not participate in a key exchange, and the one or more cloud nodes do not have data access to traffic on the secure tunnels;
• and provide the secure tunnels for connectivity between the user device and the resources, wherein the secure tunnels are between the user device and the cloud system and between the resources and the cloud system, wherein the user device, the cloud system, and the resources are each in separate networks interconnected by associated tunnels with the user device in a first network, the cloud system in a second network, and the resources in a third network, and wherein the user device has access to the resources based on the authorized policy.

A non-transitory computer readable medium comprising stored software instructions executable by a system, which in response to such execution causes the system to perform operations comprising:

• receiving a request to access resources from a user device, wherein the resources are located in one of a public cloud and an enterprise network and the user device is remote therefrom on the Internet;
• forwarding the request to a central authority for a policy look up and for a determination of connection information to make an associated secure connection through the cloud system to the resources;
• receiving the connection information from the central authority responsive to an authorized policy look up;
• creating secure tunnels by and through the cloud system and between the user device and the resources based on the connection information wherein the creating secure tunnels comprises creating connections between one or more cloud nodes in the cloud system, wherein the one or more cloud nodes do not participate in a key exchange, and the one or more cloud nodes do not have data access to traffic on the secure tunnels;
• and providing the secure tunnels for connectivity between the user device and the resources, wherein the secure tunnels are between the user device and the cloud system and between the resources and the cloud system, wherein the user device, the cloud system, and the resources are each in separate networks interconnected by associated tunnels with the user device in a first network, the cloud system in a second network, and the resources in a third network, and wherein the user device has access to the resources based on the authorized policy.