Reverse Proxy Chains for Application and Transport Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional reverse proxy servers are limited to monitoring HTTP layer requests, allowing unauthorized clients to connect to Web servers, and lack client-specific metadata for transport layer management, leading to unauthorized access and processing overhead.
Innovation Solution
Implementing a chain of reverse proxy servers that convey contextual information across layers, enabling transport layer-based user-specific connection management and application layer-based operation authorization, allowing selective deployment and reducing processing overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional reverse proxy servers monitor only HTTP layer requests, then they can prevent unauthorized read/write operations, but they allow unauthorized clients to connect to the Web server
Solution Approach 1:
The patent extends security monitoring from the application layer (HTTP) to the transport layer (TCP connections) by embedding application layer metadata into transport layer headers. This multi-layered approach allows the system to operate effectively at both HTTP and TCP levels, blocking unauthorized clients at the transport layer while maintaining HTTP-level security rules.
Solution Approach 2:
The patent divides security enforcement into separate functional components: transport layer security (handling connection-level authorization using metadata like client IP and user identity) and application layer security (handling HTTP-level authorization). This segmentation allows each layer to specialize in specific security tasks, improving overall security effectiveness.
2Reliability
If a single reverse proxy server handles all security functions, then it can enforce security rules, but it creates processing overhead and cannot selectively deploy specific security functions
Solution Approach 1:
The patent segments security functions across multiple reverse proxy servers: some servers specialize in transport layer security (enforcing connection-level rules using embedded metadata), while others specialize in application layer security (enforcing HTTP-level rules). This functional segmentation distributes processing load and allows selective deployment of specific security capabilities where needed.
Solution Approach 2:
The patent introduces metadata embedding as an intermediary mechanism that bridges the application layer and transport layer. Application layer reverse proxies embed metadata (such as client identity, IP address, and authorization information) into transport layer headers, which then serve as input for transport layer reverse proxies. This intermediary mechanism enables coordinated security enforcement across multiple servers without requiring a single centralized proxy to handle all processing.
3Ease of operation
If transport layer reverse proxy manages connections without client-specific metadata, then it can handle transport layer traffic, but it cannot perform user-specific connection management
Solution Approach 1:
The patent applies preliminary action by having application layer reverse proxies embed client-specific metadata (such as user identity, IP address, and authorization tokens) into transport layer headers before forwarding requests to transport layer reverse proxies. This pre-packaging of information enables the transport layer proxy to perform user-specific connection management without having to parse application layer protocols or maintain complex client state.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The implementation of application layer-based and transport-layer based security rules via a reverse proxy server chain is described. Each reverse proxy server in the chain is configured to perform a particular function with respect to client messages intended for a destination server and/or convey contextual information pertaining to the messages to a subsequent reverse proxy server in the chain. For instance, a first reverse proxy server in the chain is configured to include client-specific metadata in the transport layer of the message. A second reverse proxy server in the chain enforces transport layer-based policy rules based on the metadata. This enables the second reverse proxy server to manage transport layer connections on a client-by-client basis, thereby enabling the second reverse proxy server to block unauthorized clients, while maintaining the transport layer connections for authorized clients. A third reverse proxy server in the chain enforces application layer-based policy rules.