Virtual TCP Connection Proxies Across Firewalls and Gateways
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security mechanisms, such as firewalls and gateways, restrict access to protected applications, making it difficult for client devices to establish stateful, long-lived TCP connections, while vulnerabilities like denial of service and connection hijacking pose risks.
Innovation Solution
Implement a system using server and client proxies that emulate stateful TCP connections via a stateless, short-lived protocol, utilizing session identifiers and sequence numbers to maintain connection state across disparate networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewalls and gateways are used to protect networks from attack, then network security is improved, but access for client devices to protected applications is restricted
Solution Approach 1:
The patent introduces a proxy server as an intermediary component positioned between client devices and protected applications. The proxy server receives connection requests from clients, establishes connections to applications on the protected network, and forwards data accordingly. This mediator enables clients to access protected applications without directly penetrating the firewall or gateway, thus maintaining network security while improving accessibility.
2Reliability
If stateful TCP connections are used for reliable data delivery, then connection reliability is improved, but vulnerability to denial of service and connection hijacking attacks increases
Solution Approach 1:
The patent creates a virtual copy of the TCP connection state within the proxy server. Instead of maintaining actual stateful connections that are vulnerable to attacks, the proxy server tracks connection states in its own memory and presents a simplified interface to clients. This virtual copy approach maintains the appearance of stateful connections for reliability while isolating the actual network infrastructure from direct attack vectors.
Solution Approach 2:
The patent segments the connection management function by separating client-facing connection tracking from actual data transmission. The proxy server maintains virtual connection states independently from the physical network connections, creating distinct layers of connection management. This segmentation allows the system to present stateful connection characteristics to clients while using stateless protocols for actual data transmission, reducing vulnerability to attacks.
3Reliability
If network protective mechanisms are deployed to isolate internal LAN from external WAN, then internal network security is improved, but client devices find it difficult to establish connections
Solution Approach 1:
The proxy server acts as a mediator that simplifies the connection establishment process for clients accessing protected applications. Instead of requiring clients to directly penetrate complex network protective mechanisms, the proxy server handles the connection logic centrally, managing the complexity of interacting with firewalls and gateways while presenting simple connection interfaces to clients.
Data Source
Figure 1A
Figure 1B
Figure 2A
AI summary
A system for facilitating a plurality of virtual transmission control protocol connections between a target application and a source application is provided. The system includes a server proxy, a client proxy, and a network protection interposed between the server proxy and the client proxy. The server proxy is configured to receive an open request from the client proxy via a stateless protocol, including a target identifier, the open request originating from the source application, open a connection between the server proxy and the target application based on the target identifier, provide a response to the client proxy indicating a status of the open request, the response including at least one of a session identifier and a sequence identifier, receive, a data request from the client proxy, including the session identifier and an incremented sequence identifier, and provide the data request to the target application.