TCP TURN Server TAG Identification Behind Restrictive Firewalls
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
TCP connections between a client and a peer are hindered by network address translators (NAT) and restrictive firewalls, as existing solutions like TURN and STUN do not effectively allow incoming traffic and are limited by firewall restrictions on specific ports, particularly in restricted-access network environments.
Innovation Solution
A method and system utilizing a TCP TURN server that listens on allowed ports, allocates a client service identity independent of communication ports, and uses a TAG to enable communication through restrictive firewalls, allowing bidirectional TCP connections by relaying traffic through a TURN server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a TCP TURN Server assigns unique ports to Clients for identification, then the Client can be uniquely identified and communication can be established, but the firewall may block these ports and prevent connection in restricted-access network environments
Solution Approach 1:
The patent changes the identification parameter from port number to a TAG (Token Authentication Identifier). Instead of using unique ports to identify clients, the system uses configurable TAGs that can be transmitted through allowed ports (80/443) to identify clients behind NATs and firewalls, making the system adaptable to restricted-access network environments
Solution Approach 2:
The patent introduces a TAG as an intermediary identifier that mediates between the client and TURN server. The TAG acts as a token that can be passed through firewall-restricted ports to establish client identification without requiring direct port allocation, thus bypassing firewall restrictions while maintaining reliable connection establishment
2Object-affected harmful factors
If a firewall restricts TCP connections to specific ports (80 and 443) for security reasons, then network security is improved, but TCP TURN Server cannot assign unique ports to Clients and communication is blocked
Solution Approach 1:
The patent makes the TAG a universal identifier that can be transmitted through multiple channels including HTTP/HTTPS protocols on ports 80 and 443. The same TAG mechanism serves both web traffic and TURN client identification purposes, allowing communication capability to function within firewall-restricted port environments while maintaining network security
Solution Approach 2:
The patent uses HTTP/HTTPS protocol copying to transmit TAG information. By embedding the TAG within standard web traffic protocols that are already allowed through the firewall, the system achieves communication capability without requiring additional port openings, thus preserving firewall security restrictions
3Loss of information
If TURN Server uses traditional port-based client identification, then client uniqueness is ensured, but it cannot communicate client identity to Peers or learn Peer external addresses in restricted-access environments
Solution Approach 1:
The patent changes the information transmission parameter from port-based identification to TAG-based identification. The TAG can be embedded in HTTP/HTTPS headers or body, allowing client identity information to be communicated to peers through allowed ports while maintaining adaptability to restricted-access network environments
Solution Approach 2:
The patent adds a new dimension to identity communication by using application-layer data (HTTP/HTTPS traffic) instead of transport-layer ports. This dimensional shift allows client identity and peer address information to be exchanged through the firewall-restricted ports that carry web traffic, solving the information loss problem in restricted-access networks
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method at a computing client located behind a NAT and restrictive-access firewall, including establishing a control connection with a TCP TURN server utilizing a port capable of traversing the restrictive-access firewall; requesting an allocation of an client service identity from the TCP TURN server; and receiving, from the TCP TURN server, a response containing the client service identity, the client service identity being independent of any port used to communicate with the TCP TURN server. Further a method at a TCP TURN server, including listening on a first port for communications from a computing client, the computing client being behind a restrictive access firewall and the first port capable of traversing the restrictive-access firewall; establishing a control connection with the client on the first port; receiving a request for an allocation of an client service identity from the computing client; and sending a response containing the client service identity.