Proxy-Based Browser Access to Private Web Services
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network protection systems struggle to provide secure, browser-based access from public networks to private web services while maintaining robust authentication and authorization mechanisms.
Innovation Solution
A method and system that utilize a proxy to establish browser-based access to private web services by creating a dedicated network session, authenticating users, and establishing a networking tunnel to a remote gateway, allowing secure access from public networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a firewall is implemented to protect private networks from unwanted access, then network security is improved, but access complexity increases
Solution Approach 1:
The patent introduces a gateway as an intermediary component between the public network and private network. The gateway includes both a VPN server and a firewall, acting as a mediator that handles authentication and access control. This allows users to access private network resources through a controlled interface without exposing the internal network structure, thereby maintaining security while simplifying access procedures.
Solution Approach 2:
The gateway is designed to perform multiple functions: it acts as both a VPN server for authentication and tunnel establishment, and as a firewall for packet filtering and access control. By combining these functions in a single universal access point, the system improves security while reducing the complexity that would arise from multiple separate access mechanisms.
2Measurement precision
If VPN tunneling is combined with firewall to authorize access on client and network level, then access control precision is improved, but system complexity increases
Solution Approach 1:
The patent merges the VPN server and firewall into a single integrated gateway system. The VPN server handles client-level authentication and tunnel establishment, while the firewall simultaneously performs network-level packet filtering. This combination allows precise multi-level access control without requiring separate systems, as both control mechanisms operate within the same gateway infrastructure.
Solution Approach 2:
The system performs preliminary authentication through the VPN server before traffic reaches the firewall. User credentials are verified and tunnels are established in advance, creating a pre-authenticated state. This preliminary action allows the firewall to focus on network-level filtering without re-authenticating each packet, thereby achieving precise access control while managing system complexity efficiently.
3Reliability
If stateful packet inspection is performed to track connection states, then security control is improved, but processing overhead increases
Solution Approach 1:
The VPN server performs preliminary authentication and tunnel establishment before traffic enters the firewall's stateful inspection process. Connection states are pre-established and tracked from the outset, allowing the firewall to focus its processing on validating against the state table rather than creating new connection states from scratch. This reduces per-packet processing overhead while maintaining comprehensive security control.
Data Source
AI summary
A method is disclosed including establishing a browser session in response to receiving a request from a browser application in a public network. The browser session is assigned to a dedicated network service running in a dedicated network name space. Requests received from the browser application are proxied to a dedicated network service. A local web session in the dedicated network service authenticates a user of the browser application for access to at least one private webservice. A security client in the dedicated network service establishes a networking tunnel between the proxy and a remote gateway to the private network, thereby obtaining network access to the private webservice from the dedicated network name space. Within the dedicated network name space, proxied requests addressing the private webservice are forwarded over the networking tunnel to the private network.