Relay Server Communication System Bypassing Firewall Blocks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current communication systems between private networks via relay servers face high process loads due to the need for deciphering and re-enciphering data, and are often blocked by highly functional firewalls that inspect layer 5 or higher transfer data, especially when establishing SSL sessions.
Innovation Solution
The system establishes cipher sessions between client terminals and a relay server, using a shared key for enciphering data and inserting cipher session headers into data communication messages, allowing the relay server to transmit data without deciphering or re-enciphering, thus reducing the process load and bypassing firewall blocks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the relay server deciphers and re-enciphers data to ensure communication security, then communication security is improved, but the process load of the relay server increases
Solution Approach 1:
The patent extracts the enciphering function from the relay server and assigns it to the terminal devices. Each terminal enciphers data using a shared key before transmission, and the relay server simply forwards the already-enciphered data without performing deciphering or re-enciphering operations. This extraction of the cryptographic function resolves the contradiction by maintaining security while eliminating the processing burden on the relay server.
Solution Approach 2:
The terminal devices perform self-service by independently enciphering their own data using shared keys before transmission. The relay server does not need to intervene in the enciphering process, allowing it to function solely as a data forwarder. This self-service approach at the terminal level resolves the technical contradiction by distributing the cryptographic workload away from the relay server.
2Reliability
If the relay server establishes SSL sessions with client terminals, then communication security is improved, but highly functional firewalls block the connection
Solution Approach 1:
The patent extracts the SSL session establishment process from the relay server and performs it directly between terminal devices. By removing the relay server from the cryptographic handshake process, the system avoids firewall blocks that specifically target SSL sessions initiated through the relay server, while still maintaining encrypted communication channels.
Solution Approach 2:
The patent introduces shared keys as an intermediary mechanism that enables secure communication without requiring traditional SSL session establishment through the relay server. The shared keys allow terminals to encrypt and decrypt data independently, bypassing firewall restrictions on SSL sessions while maintaining security through alternative cryptographic means.
3Productivity
If the relay server forwards data without encipherment, then process load is reduced, but communication security deteriorates
Solution Approach 1:
The patent applies preliminary action by having terminal devices encipher data before transmission to the relay server. The enciphering operation is performed in advance at the source, allowing the relay server to forward data without additional cryptographic processing while security is maintained through the pre-applied encryption.
Solution Approach 2:
Terminal devices perform self-service by independently enciphering their own data using shared keys before sending it to the relay server. This self-encipherment approach allows the relay server to function as a simple forwarder with minimal processing load, while security is maintained through the terminals' own cryptographic operations.
Data Source
AI summary
In a client terminal of a communication system, a cipher session establishing section establishes a cipher session use connection between the client terminal as a source client terminal and a relay server by transmitting/receiving a cipher session establishment message between the source client terminal and the relay server, and notifies header information contained in a cipher session header to the relay server. A shared key managing section holds a client shared key with a destination client terminal, A data enciphering section performs encipherment of a data and/or MAC (Message Authentication Code) calculation of the data by using the client shared key and to output the performing result as a client cipher data. A message producing section produces a data communication message including a cipher data field in which the client cipher data is inserted and a non-cipher data field in which the cipher session header containing the header information is inserted. A transmitting section transmits the data communication messages destined to the destination client terminal to the relay server by using the cipher session use connection.