Unidirectional Command Protocol via Gateway for Firewall Bypass

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Cloud computing environments face challenges in securely and reliably exchanging bidirectional command protocols across different computing environments due to security features like enterprise firewalls blocking incoming request messages.

Innovation Solution

Establishing a unidirectional communication connection for pushing command request messages from the cloud-services computing environment to the client computing environment, while maintaining a bidirectional communication connection for response messages, using gateways to manage secure and reliable message distribution.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If enterprise firewalls block incoming request messages to enhance security, then security is improved, but command request delivery from cloud-services computing environment to client computing environment deteriorates

Engineering Contradiction:

ImprovesecurityVSAvoidcommand request delivery

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

Instead of allowing incoming request messages from cloud-services to client (which firewalls block), the patent inverts the approach by having the client gateway initiate an outgoing connection to the cloud gateway. This outgoing connection is permitted by firewalls, and then the cloud gateway can push command requests through this established connection, effectively bypassing the firewall restriction while maintaining security.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The patent introduces gateway components as intermediaries between the cloud-services computing environment and the client computing environment. The client gateway and cloud gateway establish a bidirectional communication connection that mediates the exchange of command requests and responses, allowing secure communication through the firewall without direct peer-to-peer interaction.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If bidirectional communication is implemented for command exchange, then communication flexibility is improved, but connection security and reliability deteriorate due to firewall restrictions

Engineering Contradiction:

Improvecommunication flexibilityVSAvoidconnection security

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent segments the communication protocol into two separate unidirectional connections: one for command requests (cloud to client) and one for responses (client to cloud). Each connection has a specific direction and purpose, allowing independent management of security and reliability for each communication flow while maintaining overall bidirectional functionality.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent inverts the traditional client-server communication model by having the client gateway initiate the connection to the cloud gateway. This reversal allows the connection to be established from a trusted internal component (client gateway) to the external service, bypassing firewall restrictions while maintaining security through the use of authentication tokens and encrypted channels.

Inventive Principle:

Principle #13The other way round (Inversion)

3Productivity

If unidirectional communication connection is used for command requests, then firewall compatibility is improved, but response message delivery deteriorates

Engineering Contradiction:

Improvefirewall compatibilityVSAvoidresponse message delivery

Core Design Contradiction:

ProductivityVSAdaptability or versatility

Solution Approach 1:

The patent divides the communication channel into two separate unidirectional connections: one dedicated to command requests (cloud gateway to client gateway) and another dedicated to responses (client gateway to cloud gateway). This segmentation allows each connection to be optimized for its specific direction while maintaining overall bidirectional communication capability through firewall-compatible means.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The gateway components serve as intermediaries that receive, process, and forward messages between the cloud-services computing environment and the client computing environment. The client gateway receives command requests through the firewall-compatible unidirectional connection and forwards responses back through the same connection or an established bidirectional channel, ensuring reliable two-way communication.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11750721B2Bidirectional command protocol via a unidirectional communication connection for reliable distribution of tasks

Publication Date: 2023.09.05 VMWARE INC

AI summary

The present disclosure relates to techniques for handling of bidirectional command protocols via a unidirectional communication connection established between a client computing environment and a cloud-services computing environment. In one embodiment, a command request message is pushed from a service component of the cloud-services computing environment to a client gateway of the client computing environment via the unidirectional communication connection. A token indicating routing information to the service component is embedded in the pushed command request message. A command response message is received at the cloud gateway from the client gateway via a bidirectional communication connection established between the client computing environment and the cloud-services computing environment. The command response message includes the token and data associated with executing the command request message at the client computing environment. Based on the token, the command response message is routed to the service component.