Firewall Proxy Using Unsolicited Messages for Bidirectional Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewalls restrict communication from outside hosts to servers located behind them, creating a 'post-only' environment where servers cannot initiate responses, limiting accessibility and increasing security risks.
Innovation Solution
A method and system that allow communication between a client and server behind a firewall by using unsolicited-type messages, where the client sends messages and receives responses with embedded requests, enabling the server to process and send back data through a firewall that only allows post-type messages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a host behind a firewall is configured with private IP address and NAT proxy to maintain security, then security is improved, but accessibility from outside the firewall deteriorates
Solution Approach 1:
Instead of allowing the server behind the firewall to initiate connections outward (which would require firewall configuration changes and public IP exposure), the invention inverts the approach by having external clients send unsolicited HTTP POST requests to a public-facing proxy server. This proxy then forwards these requests to the private server, and returns responses back through the same path, effectively reversing the traditional client-server initiation model to work within post-only firewall constraints.
Solution Approach 2:
The invention introduces a proxy server as an intermediary component between the external network and the private server behind the firewall. This proxy server receives unsolicited POST requests from external clients, translates and forwards them to the private server, and mediates the response flow back to clients. The intermediary handles the complexity of firewall navigation, allowing private servers to remain hidden while still being accessible.
2Ease of operation
If the firewall allows access to the host from the public Internet, then accessibility is improved, but security risk increases
Solution Approach 1:
The proxy server acts as a security intermediary that all external traffic must pass through to reach the private server. This intermediary can implement security policies, validate requests, and filter malicious traffic before it reaches the private server, reducing security risks while maintaining accessibility. The private server never directly exposes its private IP address to the public Internet.
Solution Approach 2:
The invention applies different communication modes to different parts of the system: external clients use unsolicited POST requests to the proxy, the proxy uses standard HTTP communication with the private server, and responses flow back through the same controlled path. This localized differentiation of communication patterns allows security to be maintained at the boundary while enabling functionality internally.
3Reliability
If a post-only environment is used to restrict traffic, then security is improved, but bidirectional communication deteriorates
Solution Approach 1:
The invention uses periodic HTTP POST requests from external clients to the proxy server to initiate communication. Each POST request triggers a response cycle where the proxy forwards the request to the private server and returns the response. This periodic, request-driven action pattern enables bidirectional communication flow within the unidirectional post-only firewall constraint by repeatedly initiating new POST cycles.
Solution Approach 2:
The invention embeds multiple communication layers within the HTTP POST request-response framework. External client requests are nested within POST messages to the proxy, which then nest additional requests to the private server, and responses are nested back through the same structure. This nesting allows complex bidirectional communication to be packaged within the simple unidirectional POST-only protocol.
Data Source
AI summary
The disclosure is directed to a method for communicating with a monitoring device. The method includes sending an unsolicited-type message from a client program resident on the monitoring device coupled to a first secure network. The unsolicited-type message is sent to a computing system coupled to a second network separated from the first secure network by a firewall. The method also includes receiving a response message to the unsolicited-type message from the computing system. The response message includes an embedded unsolicited-type message. The client program is resident on the monitoring device receiving the response message. The method further includes providing the embedded unsolicited-type message to a server program resident on the monitoring device.