Relay Server WebSocket Tunnel for Secure Remote Web Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication systems face limitations in allowing remote access to web services from external networks due to security mechanisms like sandbox policies and Proxy-PAC technology restrictions, which prevent cookie inclusion in proxy server requests.
Innovation Solution
A communication system that employs a relay server to facilitate secure remote access by establishing a tunnel between external networks and local networks using WebSocket connections, enabling web browsers on information terminals to access web services as if they were part of the local network, while adhering to security protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Proxy-PAC technology is used to switch destination to proxy server, then remote access control is enabled, but cookie inclusion in proxy server requests is prevented due to security restrictions
Solution Approach 1:
The patent introduces a relay server as an intermediary between the information terminal and the web server. The relay server receives requests from the web browser, adds necessary cookies, and forwards them to the web server. This mediator approach allows cookie inclusion functionality to be added without modifying the web browser or the web server, resolving the contradiction between maintaining security restrictions and enabling cookie inclusion.
2Reliability
If sandbox policy is enforced to prevent unauthorized access, then security is improved, but remote access to web services from external networks is blocked
Solution Approach 1:
The relay server acts as a trusted intermediary that operates within the sandbox policy while enabling remote access. It establishes WebSocket connections from external networks, validates them through the management server, and relays requests to the web server. This allows remote access functionality while maintaining the sandbox security boundaries, as the relay server is the authorized component bridging the isolation gap.
Solution Approach 2:
The system segments functionality across multiple components: the web browser handles user interface, the relay server handles request relay and cookie management, and the management server handles authentication. This segmentation allows each component to operate within its security constraints while collectively achieving secure remote access.
3Speed
If direct connection is made from information terminal to web server, then access speed is improved, but security restrictions prevent connection from external networks
Solution Approach 1:
The relay server serves as a mediator that maintains connection speed by establishing persistent WebSocket connections. Once the relay connection is established, requests are forwarded efficiently without the overhead of repeated authentication. The management server validates and permits the relay connection, ensuring security while allowing fast subsequent access through the relay server.
Data Source
AI summary
A communication system includes: a management server that receives, from an information terminal connectable to a first network, a connection request for connecting to a web service provided by a web server connectable to a second network; first communication control circuitry that controls communication of a communication apparatus connectable to the second network, and second communication control circuitry that controls communication of the information terminal. The first communication control circuitry connects to a relay server that relays communication between the second network and the first network. The second communication control circuitry connects the information terminal to the relay server. A request for the web service provided by the web server and a response to the request are transmitted and received between a web browser of the information terminal and the web server via the relay server and the first communication control circuitry.