Socket Duplication for Direct Client-Server Connections
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deploying network applications that use non-well-known ports is complicated due to firewall restrictions, and allowing inbound connections on unknown ports poses security risks, especially in cloud environments where traditional security equipment acts as a relay, causing overload and single-point failure issues.
Innovation Solution
A connection server duplicates a socket for communication and passes it to an application server, enabling direct connections between clients and application servers via a shared multiplexed port, reducing the need for relay servers and minimizing security risks by routing traffic directly to backend applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security equipment blocks TCP traffic on all ports except well-known ports, then network security is improved, but deploying applications using non-well-known ports becomes complicated or impossible
Solution Approach 1:
The patent introduces a socket duplication mechanism as an intermediary between the connection server and application server. The connection server receives connections on well-known ports, duplicates sockets, and passes them to application servers. This mediator approach allows secure well-known port access while enabling application servers to use non-well-known ports without exposing them directly to the network.
Solution Approach 2:
The patent segments the network communication into two distinct parts: the external connection interface handled by the connection server on well-known ports, and the internal application communication handled by the application server on non-well-known ports. This segmentation allows each component to operate in its optimal security and functionality zone.
2Adaptability or versatility
If administrators configure network security equipment to permit connections through multiple unknown ports, then application deployment flexibility is improved, but critical servers are exposed to greater security risks
Solution Approach 1:
The connection server acts as an intermediary that receives all external connections on secure well-known ports and selectively forwards them to application servers. This eliminates the need to open multiple unknown ports while maintaining application deployment flexibility, as the connection server manages the port mapping and forwarding internally.
Solution Approach 2:
The connection server provides universal access to multiple application servers through a single well-known port interface. It can handle connections for different applications, protocols, and servers through socket duplication and forwarding, maintaining flexibility without requiring multiple exposed ports.
3Reliability
If traditional security equipment acts as a relay for inbound connections, then security control is improved, but network performance deteriorates due to overload and single-point failure
Solution Approach 1:
The patent extracts the socket connection handling from the traditional security equipment relay function. By implementing socket duplication in the connection server, the system removes the performance bottleneck of relay-based security control while maintaining security through the connection server's socket management and forwarding capabilities.
Solution Approach 2:
The connection server creates duplicate socket connections to forward traffic to application servers. This copying mechanism allows the system to maintain security control through the connection server while enabling direct, high-performance connections between clients and application servers without the overhead of traditional relay processing.
Data Source
AI summary
A method includes receiving a connection request at a connection server port via a network from a client, the connection request directed to an application server, duplicating a socket for the communication and passing the socket to the application server, and replying to the network client connection request to establish a direct connection between the client and the application server via the passed socket, and this method support SSL protocol via passed socket.