Webserver Listening Responder Split for Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Websites with public addresses are vulnerable to unauthorized access due to the inability of traditional firewalls to fully isolate networks from incoming traffic, as they must keep certain ports open for functionality, allowing potential hackers to circumvent security measures.
Innovation Solution
Separating the listening and responder functions into two distinct devices, where the responder function is located on a private network with a dynamic IP address and port number, initiating a single encrypted connection to the listening function on a public network, thereby preventing unauthorized access by limiting communication to a single, controlled channel.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a website web server keeps ports open for receiving requests, then the website can receive user inquiries, but unauthorized users can access the server and compromise security
Solution Approach 1:
The patent segments the web server into two separate devices: a listening function device that receives requests on the public network, and a responder function device that accesses private data sources on the private network. This segmentation isolates the data sources from direct public network exposure, allowing the website to remain accessible while preventing unauthorized access to sensitive information.
Solution Approach 2:
The patent introduces an intermediary responder function device that acts as a mediator between the listening function and private data sources. This intermediary initiates controlled connections to data sources and forwards responses to user requests, thereby preventing direct access to private networks while maintaining website functionality.
2Object-affected harmful factors
If traditional firewalls block incoming ports, then unauthorized access is prevented, but legitimate website traffic cannot reach the server
Solution Approach 1:
The patent inverts the traditional firewall approach by having the responder function device initiate outbound connections to data sources rather than allowing inbound connections to the server. This inversion allows the firewall to block incoming traffic to data sources while permitting the website to function through the initiated outbound connections.
3Object-affected harmful factors
If the web server is placed on a private network for security, then data sources are protected, but the website cannot be addressed by users on the public network
Solution Approach 1:
The patent segments the web server functionality across two devices: the listening function remains on the public network with a public IP address for addressability, while the responder function and data sources are placed on the private network for security. This segmentation allows the website to be publicly accessible while keeping sensitive data protected.
Solution Approach 2:
The listening function device serves as an intermediary that receives public requests and forwards them to the responder function on the private network. This intermediary enables public addressability while maintaining private network security boundaries.
Data Source
AI summary
A system and method for preventing unauthorized access to a website's sensitive information in which a website web server is located on a public network with a public IP address and known port number, but only performs a listening function. The responding function is located on a separate device on a private network with a private and dynamic IP address and having a randomly assigned port number. The responder has no listening sockets (open ports expecting to receive from client application) and therefore does not listen to the public network, and therefore is not accessible to unauthorized access, much in the way that a private user's PC is not accessible to unauthorized access. The web server having the listening function does not initiate connection with the device having the responding function because its private IP address is unreachable from the public network and unknown, even to the web server, and by virtue of the fact that there are no listening sockets to accept any requests. Instead, the communication link between the device having the responder function and the web server having the listening function is initiated by the device having the responder function.