MASQUE Ethernet Tunneling for Secure QUIC Enterprise Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network solutions, such as VPN tunneling and reverse proxy technologies, face limitations in securely connecting remote users to private enterprise applications, particularly with QUIC protocol, and lack mechanisms for tunneling Layer 2 ethernet frames over MASQUE protocols.
Innovation Solution
The QUIC and MASQUE protocols are extended to provide remote users with full application access to private enterprise resources by tunneling Layer 2 ethernet frames via MASQUE tunnels, handling QUIC connection migrations, and enforcing network policies without decrypting or proxying connections, using MASQUE proxy services and QUIC proxy nodes with metadata-aware networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If VPN tunneling is used to provide remote access to private applications, then any application and protocol can be supported, but the attack surface within the network is opened up
Solution Approach 1:
The patent introduces a reverse proxy as an intermediary component that sits between remote users and private applications. The reverse proxy terminates connections from users and establishes separate connections to backend applications, acting as a mediator that controls and filters traffic. This allows the system to support multiple applications and protocols while maintaining security by preventing direct access to internal resources.
2Object-affected harmful factors
If reverse proxy technology is used to reduce attack surface, then better edge controls are achieved, but protocols that are not TCP-based cannot work well
Solution Approach 1:
The patent implements a universal reverse proxy system that can handle multiple protocols including TCP, UDP, and HTTP/2 through a single unified architecture. The proxy uses abstraction layers and protocol-agnostic connection management to work with different protocol types without requiring separate specialized components for each protocol, thereby achieving both security and broad protocol compatibility.
3Ease of operation
If proxy nodes terminate incoming connections and open new connections on backend, then clients can connect to public IP address while backend processing is performed on nodes not connected to public IP addresses, but additional solutions are required to convert from non-TCP protocol to TCP protocol
Solution Approach 1:
The patent extracts protocol-specific conversion logic from the core proxy functionality and implements it as separate, optional components. The main proxy engine handles connection management in a protocol-agnostic manner, while protocol conversion capabilities are provided as pluggable modules that are only activated when needed, reducing overall system complexity while maintaining flexibility.
Data Source
AI summary
Techniques for tunneling Layer 2 ethernet frames over a connection tunnel using the MASQUE protocol are described herein. The MASQUE protocol may be extended to include a new entity, configured to proxy ethernet frames using a MASQUE proxy connection, and an associated CONNECT method, CONNECT-ETH. Using the extended MASQUE protocol, an Ethernet over MASQUE (EoMASQUE) tunnel may then be established between various networks that are remote from one another and connected to the internet. An EoMASQUE tunnel, established between separate remote client premises, and/or between a remote client premise and an enterprise premise, may tunnel ethernet packets between the endpoints. Additionally, a first EoMASQUE tunnel, established between a first client router provisioned in a first remote client premise and an EoMASQUE proxy node, and a second EoMASQUE tunnel, established between a second client premise and the EoMASQUE proxy node, may tunnel ethernet packets between the first and second client premise.