Distributed Gateway Tunneling for Cross-Network Access Compatibility
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing tunneling technologies face challenges with compatibility across different terminals and network environments, leading to performance degradation, increased costs, and security vulnerabilities, particularly when accessing geographically segmented networks and cloud resources.
Innovation Solution
A node with a communication circuit, processor, and memory, equipped with an access control application, identifies authorized data flows and tunnels based on external server information, dynamically generating and managing tunnels to optimize routing and security across distributed gateways.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IPSec tunneling is used for encryption and encapsulation at OS level, then performance and stability are improved, but compatibility and accessibility across diverse terminals are worsened
Solution Approach 1:
The system dynamically changes tunneling parameters by selecting different tunneling technologies (IPSec, SSL/TLS, Wireguard) and protocol versions based on terminal type, operating system, and network environment. The external server receives terminal information and configures appropriate tunneling parameters, allowing the system to maintain high performance where IPSec is supported while ensuring compatibility on terminals that require alternative approaches.
2Reliability
If IPSec tunneling is implemented in site-to-site network environment, then encryption and encapsulation are improved, but double encapsulation difficulty causes terminal accessibility to worsen
Solution Approach 1:
The system introduces an external server as an intermediary that manages tunnel configuration between terminals and gateways. The external server receives terminal information, determines the appropriate tunneling technology, and configures the tunnel parameters. This intermediary layer abstracts the complexity of double encapsulation issues, allowing terminals to access the site-to-site network environment without directly handling the encapsulation complexity.
3Productivity
If UDP port 500 and 4500 are used for IPSec tunneling, then key exchange is improved, but vulnerability to DoS attacks and protocol blocking worsens accessibility
Solution Approach 1:
The system dynamically selects tunneling protocols and ports based on network conditions and terminal capabilities. Instead of statically using UDP port 500/4500 for all connections, the external server evaluates the network environment and terminal type, then configures appropriate tunneling methods (IPSec over UDP, SSL/TLS over TCP, Wireguard). This dynamic adaptation allows the system to maintain efficient key exchange when UDP is available while switching to alternative protocols when ports are blocked or DoS attacks are detected.
4Speed
If dedicated line service is provided between countries for remote cloud access, then communication performance is improved, but introduction and maintenance costs worsen
Solution Approach 1:
The external server provides a universal tunnel configuration service that handles multiple tunneling technologies and network scenarios through a single platform. Instead of requiring separate dedicated line infrastructure for each remote access scenario, the system uses a multi-functional external server that can configure IPSec, SSL/TLS, or Wireguard tunnels based on the specific needs of each connection. This universal approach achieves remote cloud access with significantly reduced infrastructure costs while maintaining communication performance.
Data Source
AI summary
A node includes a communication circuit, a processor, and a memory storing an access control application. The memory stores instructions, when executed by the processor, causing the node to detect a network access event for a destination network, via the access control application, identify whether there are data flow and a tunnel corresponding to the destination network and authorized from an external server, via the access control application, and transmit a data packet through the tunnel, when there are the authorized data flow and the authorized tunnel. The tunnel is generated between the node and a gateway based on tunneling information received from the external server. The tunneling information includes information about tunnels and gateways in which the node is able to perform tunneling among the tunnels and gateways listed by the external server based on a node environment of the node and a network environment.