Reverse Session-Origination Tunnel for Secure Remote Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Small and medium-sized businesses (SMBs) face difficulties in remote access to their on-premises networks due to the complexity and cost of setting up Virtual Private Networks (VPNs), which often result in address conflicts and limited remote access capabilities, leading many to forego VPNs and thus restrict their productivity opportunities.
Innovation Solution
Implementing a reverse session-origination (RSO) tunnel using an off-premises Internet relay server that extends through the firewall, allowing remote users to access the network via a server agent that unwraps and forwards user requests, and can generate dummy requests to minimize latency, along with the use of a Management-as-a-Service (MaaS) server for proactive network management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VPN is implemented for remote access, then secure channel through firewall is provided, but address conflicts occur and setup becomes costly and cumbersome
Solution Approach 1:
Instead of having the remote device initiate connections through the firewall (which causes address conflicts and complexity), the on-premises network initiates outbound connections to relay servers. This reverses the traditional session origination direction, allowing the firewall to permit outbound traffic while blocking inbound traffic, thereby eliminating the need for complex VPN configurations and address management.
Solution Approach 2:
Relay servers act as intermediaries between remote devices and the on-premises network. The relay server receives connections from remote devices and forwards them through the RSO tunnel to the on-premises network, eliminating direct connection attempts through the firewall and simplifying the architecture by removing the need for VPN gateways and complex address management.
2Adaptability or versatility
If VPN is implemented for remote access, then remote device becomes part of on-premises network, but address conflicts prevent contacting all devices
Solution Approach 1:
The RSO tunnel inverts the connection direction by having the on-premises network initiate outbound connections to relay servers, which then forward requests to remote devices. This eliminates address conflicts because the on-premises network does not need to assign VPN addresses to remote devices, and all devices can be accessed without IP addressing issues.
3Object-affected harmful factors
If traditional remote access methods are used, then firewall security is maintained, but remote user experience is degraded due to latency
Solution Approach 1:
The on-premises network proactively initiates outbound connections to relay servers before remote users need to access it. These pre-established connections are kept alive and ready, so when a remote user needs access, the connection is already in place, eliminating connection establishment latency while maintaining firewall security through outbound-only traffic.
Solution Approach 2:
The RSO tunnel maintains continuous outbound connections from the on-premises network to relay servers, keeping the communication channel open and ready for immediate use. This continuous connection state eliminates the need for repeated connection handshakes and reduces latency for remote access operations.
Data Source
AI summary
A remote user sends a user request to a relay server that, in turn, forwards the user request (modified or unmodified) through a reverse session-origination (RSO) tunnel to an on-premises network client. In other words, while the user requests flow from outside the client network to the client network, the requests of the delivery protocol for the tunnel flow in the reverse direction, i.e., from the client network toward the relay server and/or the remote user. A server agent, executing client side, generates delivery-protocol requests so that the server can wrap user requests in delivery-protocol responses. In addition, the server agent unwraps user requests and forwards them to their intended destination in the client network. To minimize any time the server would have to wait for a delivery-protocol request, the server agent can generate dummy requests whenever no delivery-protocol request is pending at the server.