TCP Tunneling Over UDP for Secure Server Cluster Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies require multiple layer-4 communication channels for secure communication between servers across the public Internet, which is inefficient and insecure, especially when traversing NAT routers without special configuration.
Innovation Solution
Establishing a direct layer-4 TCP route between a client application and a server application using an origin tunnel gateway and a destination tunnel gateway, with client application data being transmitted in a TCP format, repackaged into UDP format for secure transmission over a single UDP channel, and then restored to TCP format for delivery to the server application, utilizing DTLS for security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional clustering software is deployed over the public Internet, then secure communication between servers is achieved, but multiple layer-4 communication channels are required which increases device complexity and configuration difficulty
Solution Approach 1:
The patent merges multiple layer-4 communication channels (TCP and UDP) into a single unified channel. The system establishes one TCP connection and one UDP connection between cluster nodes, with the TCP connection carrying application data and the UDP connection carrying control plane traffic, thereby reducing the number of required communication channels while maintaining security and functionality
Solution Approach 2:
The patent introduces an intermediary encryption layer that operates over the unified TCP/UDP channel. Data is encrypted using AES-256-GCM and authenticated using HMAC-SHA256 before transmission, allowing secure communication through a single channel without requiring multiple dedicated secure channels for different data types
2Reliability
If multiple layer-4 communication channels are used for secure Internet communication, then security is maintained, but transmission efficiency decreases due to the overhead of managing multiple channels
Solution Approach 1:
The patent combines multiple communication functions into a single channel infrastructure. By using one TCP connection for data plane traffic and one UDP connection for control plane traffic, the system eliminates the overhead of managing multiple separate channels while maintaining comprehensive security through unified encryption and authentication mechanisms
Solution Approach 2:
The patent changes the security implementation parameters from multiple unencrypted channels to a single encrypted channel model. Encryption parameters include AES-256-GCM for confidentiality and HMAC-SHA256 for authentication, with a 16-byte authentication tag, transforming the security approach to be more efficient while maintaining or improving security posture
3Reliability
If TCP connections are used for application data transmission, then reliable delivery is ensured, but the protocol overhead increases compared to UDP
Solution Approach 1:
The patent applies different protocol characteristics to different traffic types locally. TCP connections are used specifically for the data plane where reliable delivery is critical, while UDP connections are used for the control plane where lower overhead is acceptable. This localized application of protocol qualities optimizes the balance between reliability and overhead for each traffic type
Data Source
Figure 1a~1b
Figure 1c
Figure 2a~2b
AI summary
Statically configured secure tunnels forward application-level Transmission Control Protocol ("TCP") application data between servers using a User Datagram Protocol ("UDP") channel. Applications operating on a server cluster can communicate with other applications on another server in the cluster over the public Internet using secure TCP connection forwarding through a single UDP datagram-oriented communication channel.