Persistent Network Tunneling via Proxy Server Instances
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network-connected devices face challenges in establishing and maintaining persistent, secure connections, especially when clients need to access devices behind firewalls or in private networks.
Innovation Solution
The method involves establishing a persistent connection between a device and a server, using multiple server instances to manage client authorization and network requests, and routing these requests through a proxy database or load balancer to maintain secure and authorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Duration of action of moving object
If a persistent connection is established between a device and a server to enable continuous access, then the ability to continuously receive data and control the device is improved, but the complexity of managing multiple server instances and authentication mechanisms increases
Solution Approach 1:
The system divides the server into multiple instances (first server instance, second serverinstance, third serverinstance) that can independently handle different operations. The first serverinstance establishes persistent connections to devices, the second handles authentication, and the third manages request routing. This segmentation allows each component to specialize, reducing overall system complexity while maintaining persistence.
Solution Approach 2:
A proxy server acts as an intermediary between clients and devices. The proxy receives requests from clients, authenticates them through the second serverinstance, establishes persistent connections to devices through the first serverinstance, and routes requests appropriately. This intermediary simplifies the architecture by centralizing connection management and authentication logic.
2Reliability
If authentication through signed tokens is implemented to secure access, then security and authorization control are improved, but the processing time and complexity of authentication checks increase
Solution Approach 1:
Clients receive signed tokens in advance during the authentication process. These pre-signed tokens contain all necessary authorization information and can be validated without real-time authentication checks. The second serverinstance stores these tokens and can quickly verify them when clients make requests, reducing authentication time while maintaining security.
Solution Approach 2:
Instead of performing complex authentication checks for every request, the system creates a simplified representation of the authenticated state through signed tokens. These tokens serve as copies of the authentication result that can be quickly verified without reperforming the full authentication process, thus reducing time loss while maintaining reliability.
3Adaptability or versatility
If multiple server instances are used to handle different client requests, then the ability to manage multiple clients and devices simultaneously is improved, but the complexity of routing and coordinating between instances increases
Solution Approach 1:
The proxy server serves as a central intermediary that coordinates between multiple server instances. It receives client requests, determines which serverinstance should handle the request based on the device and client configuration, and routes requests appropriately. This intermediary simplifies routing complexity by centralizing the decision-making logic.
Solution Approach 2:
The proxy server performs multiple functions: it handles client authentication, establishes persistent connections to devices, routes requests to appropriate server instances, and manages the coordination between different server instances. This multi-functionality reduces the need for complex inter-instance communication protocols and simplifies the overall routing architecture.
Data Source
AI summary
This invention allows an end user (“client”) to access one of any number of devices via a server (or cluster of server instances). Each device may be in a different physical location and different location on the Internet or other network. Each device might also be behind a router or firewall that makes direct access to the device impossible. Clients may optionally be authenticated to ensure they are authorized to access a particular device, and devices may also be authenticated to verify their identity to prevent spoofing. Access to a device is achieved by tunneling network requests over a persistent connection that the device establishes when it first comes online.