Reverse Tunnel Proxy for Multi-Port Edge-Cloud Communication

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing edge server deployment systems face challenges in establishing secure and efficient communication with public cloud servers due to network address translation (NAT) and security concerns, limiting direct access and requiring multiple SSH tunnel connections for multi-port communication.

Innovation Solution

Implementing a reverse tunnel connection and proxy system that allows a cloud server to communicate with an edge server through a single SSH tunnel, using a proxy to modify messages with destination port numbers, enabling multiple ports to utilize a single tunnel connection.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If multiple SSH tunnel connections are established for multi-port communication, then communication capability is improved, but device complexity and resource usage increase

Engineering Contradiction:

Improvemulti-port communication capabilityVSAvoidnumber of tunnel connections

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent implements a proxy server that enables a single SSH tunnel connection to handle multiple port communications. The proxy server intercepts and forwards traffic across different ports through one tunnel, making the tunnel multi-functional and eliminating the need for separate tunnels for each port.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The proxy server acts as an intermediary component between the SSH client and the remote server. It receives connections on one port, modifies the traffic, and forwards it through the single SSH tunnel to the destination, mediating the communication between multiple ports and the single tunnel connection.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If direct connection from cloud server to edge server is established, then communication efficiency is improved, but security and network address translation requirements worsen

Engineering Contradiction:

Improvecommunication efficiencyVSAvoidsecurity and NAT compliance

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

Instead of establishing a direct connection from the cloud server to the edge server, the patent inverts the connection direction by having the edge server initiate the SSH tunnel connection to the cloud server. This reversal allows the edge server to maintain control over the connection while enabling bidirectional communication.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The SSH tunnel and proxy server combination acts as an intermediary mechanism that enables communication while maintaining security boundaries. The tunnel encrypts the connection and the proxy manages port forwarding, allowing efficient communication without direct exposure between networks.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12537885B2Edge reversal tunnel proxy for isolated network

Publication Date: 2026.01.27 LENOVO ENTERPRISE SOLUTIONS (SINGAPORE) PTE LTD

AI summary

A method for creating an edge server connected to a cloud server with a tunnel connection includes creating a tunnel connection between a port of an edge server and a port on a cloud server. The cloud server is unable to establish a communication link with the edge server independent of the tunnel connection. The method includes initiating a proxy on the edge server. The cloud server initiates a proxy on the cloud server after creation of the tunnel connection. Each proxy is configured to receive a message from a port and to transmit, over the tunnel connection, a modified message with a port number and the message. The port number is for a destination and each proxy is configured to receive a modified message over the tunnel connection and to transmit the message of the modified message to the port identified by the port number in the modified message.