Secure NAT Traversal via Ephemeral Key Relay

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Establishing a secure connection between electronic devices located on private networks is challenging due to network address translation (NAT) limitations, particularly in mobile environments, where existing methods like message relaying and hole-punching are unreliable and restrict application scope, and Universal Plug-and-Play (UnPnP) is not supported across all systems.

Innovation Solution

A computer-implemented method using standard TLS for end-to-end encryption, generating a dynamic, time-limited device identification for establishing a secure tunnel between devices, with a publicly accessible server acting as a transparent message relay, allowing secure connections between devices behind NATs, including those with web browsers and mobile apps.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If message relaying is used to establish connections across NAT, then connection reliability is improved, but device complexity and protocol requirements increase

Engineering Contradiction:

Improveconnection reliabilityVSAvoidprotocol complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent uses a publicly accessible server as an intermediary to relay connections between devices behind NAT. The server receives connections from both devices and forwards data between them, eliminating the need for complex peer-to-peer NAT traversal protocols while maintaining connection reliability.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent enables standard protocols like HTTP and WebSocket to work universally across NAT environments by routing all traffic through the public server. This eliminates the need for device-specific or application-specific protocol implementations, allowing any standard web application to connect reliably.

Inventive Principle:

Principle #6Universality (Multi-functionality)

2Speed

If hole-punching is used for NAT traversal, then connection establishment speed is improved, but reliability deteriorates due to NAT implementation weaknesses

Engineering Contradiction:

Improveconnection establishment speedVSAvoidconnection reliability

Core Design Contradiction:

SpeedVSReliability

Solution Approach 1:

Instead of attempting direct hole-punching through NAT, the patent introduces a public server as a mediator that both devices connect to. This eliminates reliance on NAT implementation details while maintaining fast connection establishment through direct TCP connections to the server.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Ease of operation

If UnPnP is used for device discovery, then ease of operation is improved, but adaptability deteriorates due to limited system support

Engineering Contradiction:

Improvedevice discovery easeVSAvoidsystem compatibility

Core Design Contradiction:

Ease of operationVSAdaptability or versatility

Solution Approach 1:

The patent creates a universal connection method that works across all systems with web browser support. By using standard web protocols and a public server, it achieves both ease of operation (automatic connection setup) and broad adaptability (works on mobile, desktop, different OSes) without relying on UnPnP.

Inventive Principle:

Principle #6Universality (Multi-functionality)

4Reliability

If persistent outbound connections with polling are used, then connection reliability is improved, but loss of time increases due to polling overhead

Engineering Contradiction:

Improveconnection reliabilityVSAvoidpolling overhead

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent establishes continuous bidirectional data channels through the public server using persistent TCP connections. Both devices can send data at any time without polling, eliminating the time waste of periodic status checks while maintaining continuous connection reliability.

Inventive Principle:

Principle #20Continuity of useful action

5Reliability

If a public server relay is used for message forwarding, then connection reliability across NAT is improved, but loss of information increases due to required knowledge of server endpoint and keys

Engineering Contradiction:

Improveconnection reliabilityVSAvoidserver endpoint knowledge requirement

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The patent uses standard web protocols (HTTP, WebSocket) that universally support HTTPS encryption. This eliminates the need for custom protocols or shared secret keys, as standard TLS/SSL encryption provides secure communication without requiring devices to know or share additional information beyond the server's public endpoint.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS11711355B2Establishing an ad-hoc secure connection between two electronic computing devices using a self-expiring locally transmitted information packet

Publication Date: 2023.07.25 BEAME IO LTD

AI summary

Disclosed is a computer-implemented method for establishing a secure connection between two electronic computing devices which are located in a network environment, the two electronic computing devices being a first computing device offering the connection and a second computing device designated to accept the connection, the method comprising executing, by at least one processor of at least one computer, a connection-establishing application for exchanging an information packet between the first computing device and the second computing device comprising a secret usable for establishing the connection, and evaluating a response from the second computing device for establishing the secure connection.