IP Tunnel Mediation Through Outbound-Only Firewall Links

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Establishing an IP connection between two endpoints behind distinct firewalls without inbound rules or open ports is impossible in conventional systems, leading to security vulnerabilities such as malware spread and hacker attacks through inbound ports.

Innovation Solution

A method using a request collector (RC) to facilitate secure, one-time-use tunnels between endpoints through outbound ports, employing AEAD encryption and dual authentication to ensure only authorized communication between two endpoints, preventing unauthorized access and infection spread.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If conventional VPNs are used to enable communication between endpoints behind firewalls, then connectivity is achieved, but security is compromised due to arbitrary device access and malware spread risks

Engineering Contradiction:

ImproveconnectivityVSAvoidsecurity risk

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent segments the network communication into individual point-to-point tunnels between specific endpoint pairs, rather than creating a shared network environment. Each tunnel is independently established and encrypted, preventing lateral movement of malware and limiting security breaches to single endpoint pairs.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a tunnel establishment server as an intermediary that facilitates secure connection setup between endpoints without requiring inbound ports on firewalls. The server coordinates the three-way handshake and tunnel creation process, enabling connectivity through outbound ports only while maintaining security.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If inbound ports are opened on firewalls to enable VPN communication, then network connectivity is achieved, but vulnerability to hacking increases

Engineering Contradiction:

Improvenetwork connectivityVSAvoidhacking vulnerability

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent inverts the traditional firewall port approach by using only outbound ports instead of inbound ports. Endpoints initiate outbound connections to establish tunnels, and the firewall allows these outbound connections while blocking any inbound connections, effectively reversing the direction of permitted traffic flow to eliminate hacking vulnerabilities associated with open inbound ports.

Inventive Principle:

Principle #13The other way round (Inversion)

3Adaptability or versatility

If VPN networks allow arbitrary devices to communicate, then network flexibility is improved, but malware spread prevention capability deteriorates

Engineering Contradiction:

Improvenetwork flexibilityVSAvoidmalware spread

Core Design Contradiction:

Adaptability or versatilityVSObject-generated harmful factors

Solution Approach 1:

The patent segments the network into isolated point-to-point communication channels, where each tunnel connects only two specific endpoints. This segmentation prevents malware from spreading laterally across the network, as infected devices cannot communicate with other endpoints outside their designated tunnel, thus maintaining network flexibility while preventing malware propagation.

Inventive Principle:

Principle #1Segmentation

4Object-affected harmful factors

If point-to-point connections are established between specific endpoints, then security is improved by limiting malware spread, but connection establishment complexity increases due to firewall constraints

Engineering Contradiction:

Improvemalware containmentVSAvoidconnection establishment

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The patent introduces a tunnel establishment server as an intermediary that simplifies the connection establishment process between endpoints behind firewalls. The server coordinates the three-way handshake, manages tunnel creation and teardown, and handles the complexity of firewall interactions, thereby reducing the operational complexity for endpoints while maintaining secure point-to-point connections.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12615144B2Method for tunneling an internet protocol connection between two endpoints

Publication Date: 2026.04.28 XIID CORP

AI summary

The present invention describes a method for secure communication between two endpoints comprising a first endpoint connected with a request collector using a first poll-pull communication link, wherein the first endpoint authenticates with the request collector. A second endpoint connects with the request collector using a second poll-pull communication link and authenticates with the request collector. Once both endpoints are authenticated, the first endpoint prepares a first encrypted communication by encrypting a communication, encapsulates the first encrypted communication in a first IP packet and sends the first IP packet to the request collector using the first poll-pull communication link. The request collector receives the first IP packet and extracts and decrypts the first encrypted communication to obtain the communication and prepares a second encrypted communication by encrypting the communication and encapsulates the second encrypted communication in a second IP packet. The request collector makes the IP packet available to the second poll-pull communication link. The second endpoint extracts the second IP packet from the request collector using the second poll-pull communication link and receives the IP packet from the second poll-pull communication link, extracts the second encrypted communication from the IP packet and decrypts the second encrypted communication to obtain the communication.