Edge Compute Network Security via Reverse Proxy Inversion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information handling systems face challenges in providing secure and isolated network connectivity, especially in edge compute networks, where endpoints are vulnerable to malicious attacks due to open inbound ports and lack of authentication mechanisms.
Innovation Solution
An edge compute network architecture that employs a double reverse proxy pattern with mutual Transport Layer Security (TLS) authentication and a single dedicated network port (443) for initiating connections, ensuring directed, isolated, and secure communication between endpoints and orchestrators, using reverse proxies to authenticate and demultiplex traffic while preventing unsolicited incoming traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If endpoint devices have open inbound network ports to receive connections, then network connectivity is established easily, but security is compromised and devices become vulnerable to malicious attacks
Solution Approach 1:
The patent inverts the traditional connection initiation approach by having the endpoint device initiate the connection to the information handling system rather than allowing incoming connections to the endpoint. The endpoint device opens an outbound request on a predetermined network port, and the information handling system establishes a reverse connection back to the endpoint. This inversion ensures the endpoint never has open inbound ports while maintaining connectivity.
Solution Approach 2:
The patent introduces reverse proxies as intermediary components between the endpoint device and the information handling system. The first reverse proxy receives the outbound request from the endpoint, and the second reverse proxy establishes the connection to the endpoint orchestrator. These intermediaries facilitate secure communication without requiring the endpoint to have open inbound ports, thereby resolving the security vulnerability.
2Object-affected harmful factors
If authentication mechanisms are implemented to secure network connections, then security is improved, but system complexity increases
Solution Approach 1:
The patent implements mutual authentication as a preliminary action during the connection establishment process. The endpoint device authenticates the information handling system before establishing the connection, and the information handling system authenticates the endpoint device. This preliminary authentication ensures security is built into the connection mechanism itself rather than added as a separate complex layer.
Solution Approach 2:
The authentication mechanism leverages the existing outbound request and reverse proxy infrastructure to perform mutual authentication. The endpoint device uses its outbound request to trigger authentication, and the reverse proxies handle the authentication process using the established connection framework. This self-service approach integrates authentication into the existing architecture without adding significant complexity.
3Adaptability or versatility
If multiple network ports are opened for different communication protocols, then communication versatility is improved, but firewall rules become complex and security is reduced
Solution Approach 1:
The patent makes the predetermined network port universal by using it for multiple communication protocols including HTTPS, WebSocket, MQTT, and others. The reverse proxy infrastructure handles protocol demultiplexing, allowing a single port to serve multiple functions. This universality eliminates the need for multiple open ports while maintaining communication versatility.
Solution Approach 2:
The reverse proxies act as intermediaries that handle protocol translation and demultiplexing. The first reverse proxy receives outbound requests on the predetermined port, and the second reverse proxy translates them to the appropriate internal protocols. This intermediary layer enables a single port to support multiple protocols without complicating firewall rules.
4Object-affected harmful factors
If inbound network ports are kept closed for security, then security is improved, but incoming connection requests cannot be received
Solution Approach 1:
The patent inverts the connection initiation direction: instead of the information handling system initiating connections to endpoints (which would require open inbound ports), the endpoint device initiates the connection to the information handling system. The endpoint opens an outbound request, and the information handling system establishes a reverse connection back to the endpoint. This inversion allows the endpoint to maintain closed inbound ports while still receiving necessary connections.
Solution Approach 2:
The reverse proxies serve as intermediaries that enable the information handling system to communicate with the endpoint without the endpoint needing to have open inbound ports. The first reverse proxy receives the outbound request and the second reverse proxy establishes the connection through the endpoint, facilitating communication while maintaining the security benefit of closed inbound ports.
Data Source
AI summary
An edge compute network includes an endpoint device and an information handling system. The endpoint device includes a network interface configured to operate with no open inbound network ports and to provide an outbound request on a predetermined network port. The information handling system includes first and second reverse proxies and instantiates an endpoint orchestrator. The first reverse proxy receives the outbound request and provides the outbound request to the second reverse proxy. The second reverse proxy provides the outbound request to the endpoint orchestrator which authenticates the endpoint device based upon the outbound request and provides authentication information to the endpoint device. The endpoint device authenticates the information handling system based upon the authentication information, and opens the predetermined network port to the information handling system in response to authenticating the information handling system.