Reversed UDP Proxy Routing for Secure HTTP Access to GPU Servers

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for client-server communication in GPU servers require the servers to be publicly addressable, which compromises security, and modifying the communications protocol to allow this is impractical and risky.

Innovation Solution

Implementing a proxy server with a publicly addressable IP address and using a reversed UDP stream to facilitate communication between clients and secure GPU servers without requiring changes to client or server applications, by establishing connections from the GPU servers to the client via a proxy server.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If GPU servers are made publicly addressable to enable client communication, then communication functionality is improved, but security is worsened

Engineering Contradiction:

Improvecommunication functionalityVSAvoidsecurity risk

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a proxy server as an intermediary component between clients and GPU servers. The proxy server receives client requests and forwards them to the GPU server, which remains non-publicly-addressable. This mediator enables communication functionality while preserving security by preventing direct client access to the GPU server.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If communication protocol is modified to allow server-initiated connections, then security is improved, but device complexity is worsened

Engineering Contradiction:

ImprovesecurityVSAvoidprotocol complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The patent inverts the traditional client-initiated connection model by implementing server-initiated connections through the proxy server. The GPU server connects to the proxy server, which then establishes communication with the client. This inversion maintains security while avoiding the need to modify client applications or protobuf specifications.

Inventive Principle:

Principle #13The other way round (Inversion)

3Object-affected harmful factors

If server-initiated connection approach is used, then security is improved, but ease of operation is worsened

Engineering Contradiction:

ImprovesecurityVSAvoidapplication compatibility

Core Design Contradiction:

Object-affected harmful factorsVSEase of operation

Solution Approach 1:

The proxy server acts as an intermediary that transparently handles the server-initiated connection approach. Client applications continue to operate as if they are connecting directly to the GPU server, while the proxy server manages the actual server-initiated connection in the background, maintaining application compatibility.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The proxy server creates a copy or representation of the GPU server interface that clients interact with. This copy allows clients to use standard protocols and interfaces without modification, while the actual GPU server remains secure and non-publicly-addressable.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS12609991B2Routing generic http traffic over a reversed UDP stream

Publication Date: 2026.04.21 NVIDIA CORP

AI summary

In various examples, a technique for routing generic HTTP traffic over a reversed UDP stream includes receiving, from a client device via a first connection, a client request to perform a function with a server that is not addressable by the client device; determining that a second connection with the server has been established; receiving first data from and transmitting second data to the client device via the first connection; and transmitting the first data to and receiving the second data from the server via the second connection.