Secure Remote Access Tunneling Through Firewall-Allowed TLS Ports
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional remote network access protocols face security vulnerabilities due to firewalls blocking necessary IP addresses and ports, lacking effective credentialing and permissions management, and require secure tunneling solutions.
Innovation Solution
A network tunneling system encapsulates lower level network traffic into higher level data packets, transmitted over a TLS connection, allowing access through configurable ports like 443, with an intermediary node verifying permissions and injecting traffic into the remote network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional remote access protocols (RDP, SSH) are used to access remote networks, then remote network management capability is provided, but firewalls block the necessary IP addresses and ports creating security vulnerabilities
Solution Approach 1:
The patent introduces an intermediary tunneling service that acts as a mediator between the client and remote network. The service establishes a secure tunnel through which encapsulated network traffic is transmitted, bypassing firewall restrictions while maintaining security through credential verification and permission-based access control.
Solution Approach 2:
The patent transforms network traffic by changing its parameters - specifically, it encapsulates lower-level network packets (IP packets) within higher-level application layer protocols (HTTPS/TLS). This parameter transformation allows the traffic to traverse firewalls that would normally block direct remote access protocols.
2Ease of operation
If firewalls are configured or opened to allow remote access traffic, then remote access is enabled, but network security vulnerabilities increase
Solution Approach 1:
The tunneling service acts as a security intermediary that verifies credentials and permissions before allowing access. This eliminates the need to open firewall ports for direct remote access, as all traffic flows through the secure tunnel established by the intermediary service.
Solution Approach 2:
The patent segments the remote access functionality into multiple components: the client application, the tunneling service, and the remote network access point. This segmentation allows security to be enforced at the service layer rather than requiring firewall configuration changes.
3Productivity
If lower level network traffic is transmitted directly to remote networks, then network communication efficiency is maintained, but firewall restrictions prevent access
Solution Approach 1:
The patent changes the parameters of network traffic transmission by encapsulating IP packets within HTTPS/TLS protocol frames. This allows the traffic to use port 443 (standard HTTPS port) which is typically allowed through firewalls, while maintaining the integrity and routing information of the original lower-level network packets.
Solution Approach 2:
The patent implements nesting by placing lower-level network packets (IP packets) inside higher-level application layer data structures (HTTPS/TLS packets). The encapsulated packet structure allows the inner packet to be transmitted through the outer protocol's channel, effectively bypassing firewall restrictions.
Data Source
AI summary
Disclosed are systems and processes for remote network tunneling. A processor within the system is operatively configured to receive a network tunnel request routed from a user computing device to an intermediary target computing device through a network appliance computing device. The processor initiates a tunnel process at the intermediary target computing device. Initiating the tunnel process includes generating a network tunnel operatively connecting the user computing device and the intermediary target computing device according to one or more parameters included in the network tunnel request. The processor receives transmission data including a data packet from the user computing device via the network tunnel. A transmission data subset including network traffic data is encapsulated as a payload of the data packet. The data packet and the transmission data subset correspond to different layers in a network model stack. The network traffic data is injected into a remote network.