Server-Initiated Secure Sessions Through Outbound Firewall Connections
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing browser-based SSH connections are vulnerable due to credential exposure and require opening in-bound firewall ports, compromising security in server access.
Innovation Solution
A server agent initiates a secure session with an intermediary server, redirecting browser traffic through an out-bound connection, thus maintaining security without opening in-bound firewall ports.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If browser-based SSH connections are used to allow remote server access, then ease of operation is improved, but security is worsened due to credential exposure and intermediate machine inspection
Solution Approach 1:
The patent introduces a server agent as an intermediary component installed on the destination server. This agent facilitates secure communication by acting as a mediator between the endpoint device and the server, enabling authentication and session management without exposing credentials to intermediate machines or requiring open inbound firewall ports.
2Ease of operation
If in-bound firewall ports are opened to allow SSH connections, then ease of operation is improved, but security is worsened due to increased vulnerability to malicious access
Solution Approach 1:
The patent inverts the traditional connection initiation approach. Instead of the endpoint device initiating an inbound connection to the server (which requires open firewall ports), the server agent initiates an outbound connection to the endpoint device. This reversal eliminates the need for open inbound firewall ports while maintaining connectivity.
3Object-affected harmful factors
If server agent initiates outbound connection to endpoint device, then security is improved by maintaining firewall integrity, but device complexity is worsened due to additional intermediary components
Solution Approach 1:
The server agent provides self-service functionality by autonomously initiating outbound connections to endpoint devices without requiring manual configuration of firewall rules or complex intermediary infrastructure. The agent handles authentication, session management, and connection establishment independently, reducing the need for additional intermediary components.
Data Source
AI summary
Methods, systems, and devices for server-initiated secure sessions are described. A browser application may connect to a portal, where the portal may transmit a command to a server agent to initiate a secure session with an endpoint device. The server agent may be housed in a destination server, and may establish a secure connection with an intermediary server using a secure communication protocol. The secure connection may be made by directing the destination server to open an out-bound connection through a firewall of the destination server. A browser session may be redirected to the intermediary server from the browser application, and the intermediary server may route the browser session traffic to the secure connection.