Extending a trust boundary between cloud domains of the same entity

A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor, are configurable to cause said processor to perform operations comprising:

• intercepting, by one or more computing devices at a target cloud domain of an entity, a packet from a source cloud domain received from a public network, wherein the packet includes an implicit certificate having authentication information indicating the source cloud domain of the packet, the authentication information having been added to the packet by egress logic associated with the source cloud domain;
• determining, by the one or more computing devices at the target cloud domain, whether the source cloud domain resides within the entity;
• in response to determining that the source cloud domain resides within the entity, automatically trusting the packet and forwarding the packet to a destination;
• and
• in response to determining that the source cloud domain resides outside the entity:
• extracting, by the one or more computing devices at the target cloud domain, the authentication information from the intercepted packet;
• validating, by the one or more computing devices at the target cloud domain, the intercepted packet based on the authentication information;
• and
• allowing or rejecting, by the one or more computing devices at the target cloud domain, the packet to proceed to a destination responsive to a determination whether the source cloud domain is trusted.

An apparatus comprising:

• a processor,
• a non-transitory machine-readable storage medium that provides instructions that, if executed by the processor, are configurable to cause the apparatus to perform operations comprising,
• intercepting, by one or more computing devices at a target cloud domain of an entity, a packet from a source cloud domain received from a public network, wherein the packet includes an implicit certificate having authentication information indicating the source cloud domain of the packet, the authentication information having been added to the packet by egress logic associated with the source cloud domain;
• determining, by the one or more computing device at the target cloud domain, whether the source cloud domain resides within the entity;
• in response to determining that the source cloud domain resides within the entity, automatically trusting the packet and forwarding the packet to a destination;
• and
• in response to determining that the source cloud domain resides outside the entity:
• extracting, by the one or more computing devices at the target cloud domain, the authentication information from the intercepted packet;
• validating, by the one or more computing devices at the target cloud domain, the intercepted packet based on the authentication information;
• and
• allowing or rejecting, by the one or more computing devices at the target cloud domain, the packet to proceed to a destination responsive to a determination whether the source cloud domain is trusted.