Reverse Proxy Redirection via Token Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network filtering mechanisms struggle to securely and generically authorize requests across interconnected networks, especially when firewalls and non-standard communication ports are involved, leading to potential overloading of gateway resources and inability to distinguish between multiple client terminals.
Innovation Solution
A packet filtering process that verifies authentication tokens and dynamically creates temporary filtering rules to authorize routing, ensuring only authorized requests are routed, while limiting resource usage and preventing fraudulent access by checking token validity, usage, and source authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If dynamic port allocation is used for incoming redirection, then client terminal distinction is enabled, but firewall filtering blocks non-standard ports
Solution Approach 1:
The patent changes the parameter of communication port from dynamic non-standard ports to the standard Reverse Proxy port. By verifying authentication tokens and creating temporary filtering rules based on source entities rather than port numbers, the system maintains client distinction capability while avoiding firewall blocking of non-standard ports.
2Reliability
If Reverse Proxy agent verifies all incoming requests, then security is improved, but gateway resources become overloaded
Solution Approach 1:
The patent applies preliminary action by creating temporary filtering rules that authorize routing decisions before requests reach the Reverse Proxy agent. The filtering device pre-verifies authentication tokens and establishes routing permissions, so the Reverse Proxy agent only needs to process already-authenticated requests, reducing its resource burden while maintaining security.
3Reliability
If authentication token verification is implemented, then fraudulent access is prevented, but processing complexity increases
Solution Approach 1:
The patent introduces an intermediary authentication token mechanism between the source entity and the routing decision process. The filtering device verifies tokens and creates temporary filtering rules as an intermediary step, simplifying the overall architecture by separating authentication verification from the main Reverse Proxy processing chain.
Data Source
AI summary
A system is provided for filtering packets. The system includes: a filter for determining, by applying a set of at least one filtering rule, whether a packet is permitted to be routed towards a receiving entity. The system includes a verification element for verifying validity of an authentication token included in a request received by the filtering system and adds, to the set, after receiving an initial request, a so-called top-level filtering rule, permitting the routing, towards the verification element, of at least one packet received via a predetermined communication port of the device, in which the source address is identical to the source address of the initial request, regardless of the source communication port of the subsequent request. A routing element routes a subsequent request including a valid authentication token towards a receiving entity of the subsequent request.