Gateway Mediator for Secure Remote Application Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for remote access to host computers are cumbersome, particularly in managing cryptographic data distribution and revocation, and expose internal networks to vulnerabilities like malware and distributed denial of service attacks.
Innovation Solution
A method involving a controller computer that manages application entitlements, sends lists of accessible applications and network addresses to remote devices, and establishes secure channels through gateway computers to authenticate and transfer data, reducing the burden on the host computer and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a VPN is established to allow remote connectivity, then remote access capability is improved, but device complexity and network security vulnerability increase
Solution Approach 1:
The patent introduces a gateway computer as an intermediary component that mediates between remote devices and application servers. The gateway handles authentication, establishes secure channels, and manages connections, thereby eliminating the need for complex VPN infrastructure while maintaining remote access capability. The gateway acts as a specialized mediator that performs functions previously requiring full VPN implementation.
2Reliability
If a web server with encryption is used for remote login, then security is improved, but certificate management burden increases
Solution Approach 1:
The patent extracts the cryptographic certificate management burden from the client devices and concentrates it in the gateway computer. Remote devices only need to present their identity to the gateway, which handles all certificate validation, secure channel establishment, and cryptographic operations. This extraction eliminates the need for each client to manage complex certificate configurations while maintaining strong security.
3Speed
If direct connection is allowed between remote devices and application servers, then access speed is improved, but network security vulnerability increases
Solution Approach 1:
The gateway computer serves as a protective intermediary between remote devices and application servers. It establishes secure channels that isolate the internal network from direct exposure to external devices. The gateway validates authentication, filters traffic, and prevents direct access to servers, thereby blocking malware and attacks while maintaining efficient data transmission through the secured gateway connection.
4Device complexity
If the host computer directly handles authentication and connection management, then system simplicity is improved, but security isolation decreases
Solution Approach 1:
The patent segments the authentication and connection management functions from the application server (host computer) and places them in a separate gateway computer. This segmentation creates security isolation where the gateway handles all external interactions, authentication, and channel management, while the application server focuses solely on providing application services. The separation ensures that even if the gateway is compromised, the internal server remains protected.
Data Source
AI summary
A user having remote device wants to access an application executing on an application server computer that is behind a firewall. During set-up, another firewall and a gateway computer are configured in front of the original firewall. During registration, users' remote devices are configured with security data. The security data includes user authentication cryptographic credentials, for establishing secure channels, and may include user application cryptographic credentials as needed by individual applications executing on the application server. During operation, the user provides a password to an application program executing on his/her remote device to use the security information on the remote device to establish a secure channel to the application, and then conducts a data session with the application. If the application needs to verify the identity of the user, the user's remote device performs a cryptographic operation using the user application cryptographic credentials, and sends the result to the application.