Reverse HTTP Access for Secure Firewall Bypass
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for remote access to applications across firewalls are hindered by security and implementation issues, particularly as they require opening TCP/IP ports or allowing bidirectional HTTP tunneling, which most customers and companies are reluctant to do.
Innovation Solution
A method and infrastructure that reverses the direction of HTTP requests to access a remote application without opening the firewall, allowing system A to initiate communication and control access, with encryption and defined operations to enhance security, enabling system B to access system A's applications as if they were local.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If VPN connection is created to access remote application behind firewall, then remote access capability is improved, but firewall security is worsened because TCP/IP communication ports must be opened
Solution Approach 1:
The patent inverts the traditional client-server communication model by having the remote system (system B) initiate HTTP requests to access applications on the local system (system A) through the firewall. This reverse direction allows access without opening ports on the local firewall, as the local system actively controls and blocks requests based on predefined rules.
Solution Approach 2:
The patent introduces HTTP protocol as an intermediary mechanism to facilitate communication between systems behind firewalls. By using HTTP requests as a mediator, the system enables application access without requiring direct TCP/IP port openings, as the HTTP protocol itself carries the application data through the firewall in a controlled manner.
2Ease of operation
If HTTP tunneling is used to access applications through firewall, then remote access capability is improved, but firewall security is worsened because new entries are opened into intranet
Solution Approach 1:
The patent reverses the traditional HTTP tunneling approach where the client initiates connections. Instead, the remote system sends HTTP requests to the local system, which blocks these requests based on predefined rules. This inversion eliminates the need to open new entries into the intranet, as the local system controls access by blocking or allowing specific HTTP requests.
Solution Approach 2:
The local system performs self-service security control by autonomously blocking HTTP requests from the remote system based on predefined rules stored locally. This self-service mechanism eliminates the need for complex firewall configuration changes or opening new entries, as the local system independently manages its own security based on pre-established policies.
3Adaptability or versatility
If bidirectional HTTP tunneling is implemented, then access capability is improved, but device complexity is worsened due to additional gateway requirements
Solution Approach 1:
The patent simplifies the access architecture by inverting the communication direction to HTTP requests from the remote system to the local system. This single-direction approach eliminates the need for complex bidirectional tunneling gateways, as the local system can block requests based on predefined rules without requiring additional gateway infrastructure for bidirectional communication.
Data Source
AI summary
A method, computer program product, and infrastructure for accessing a remote application running on a system A by a system B, each being connected to an open network and located behind a firewall, are provided. The method, computer program product, and infrastructure provide for system A sending a first HTTP request to system B via the open network, blocking the first HTTP request from system A till an application request is available at system B, system B sending an HTTP response to system A via the open network, the HTTP response comprising the application request, system A processing the application request from system B to generate an application response, system A sending a second HTTP request to system B via the open network, the second HTTP request comprising the application response, and blocking the second HTTP request from system A till another application request is available at system B.