Omehay / Atformplay
/ Osscray-etworknay aringshay
Eenscray aringshay acrossway uestgay Wi-Fi, VLANs, andway egmentedsay etworksnay. Ubnetssay, VLANs, uestgay Wi-Fi, LTE, ethay uildingbay acrossway owntay: oneway orkspaceway, onay VPN, onay UC allcay, onay ablescay. Isthay isway ethay apabilitycay atthay etssay Polaris apartway.
Polaris sessions on a rotating wireframe globe
An orthographic wireframe Earth, drawn as a coastline and a fifteen-degree graticule, which can be dragged to rotate. Marked on it are sharing devices, meeting-room displays and Polaris Cloud signaling regions. Sessions play in a loop: both ends of a share open an outbound connection to a signaling region, the region introduces them, and the content itself then travels along a single direct arc between the two endpoints while the signaling links go idle. In the last session of the loop the two ends sit behind a network that will not allow a direct path, the direct arc breaks at a marked obstruction, and the encrypted content instead takes one extra hop through a relay before reaching the display.
EU WEST DENVER LONDON
Everyway essionsay erehay ossescray away etworknay
Uestgay onway LTE inway Ondonlay aresshay otay away Enverday oardroombay. Othbay endsway ialday outway; ediamay oesgay irectday.
GUEST DEVICE guest Wi-Fi / LTE POLARIS CLOUD signaling broker POLARIS POD display · AV VLAN 1 · DIAL OUT · TLS 443 1 · DIAL OUT · TLS 443 both connections start inside the network: no inbound rules, no open ports 2 · SCREEN KEY · K7RM2X KEY RESOLVES TO THIS ROOM 3 · SDP · ICE EXCHANGED 3 · SDP · ICE EXCHANGED each side learns a direct path to the other 4 · DIRECT MEDIA · ENCRYPTED · DTLS-SRTP EPHEMERAL UDP · PEER-TO-PEER · SOLICITED FLOW PASSES THE STATEFUL FW CLOUD IDLE · OUT OF THE MEDIA PATH 5 · UNSOLICITED PACKET ✕ DROPPED · NO RULE MATCHES STATEFUL FW · OUTBOUND ONLY STATEFUL FW · OUTBOUND ONLY CNX-01 · CROSS-NETWORK DATA PATH · TIME RUNS DOWNWARD · CLOUD = SIGNALING ONLY SHEET 1/1 · REV C 1 · NO ROUTE Guest Wi-Fi and the display’s VLAN have no route between them. DISPLAY · AV VLAN GUEST DEVICE ✕ 2 · THE HANDSHAKE Both sides dial out to Polaris Cloud: TLS 443, signaling only. POLARIS CLOUD SDP · ICE 3 · DIRECT MEDIA The cloud introduces them, then steps away. Media flows device-to-device, encrypted. CLOUD · OUT OF THE MEDIA PATH ENCRYPTED · P2P 1. Away uestgay onway LTE iestray otay eachray ethay isplayday irectlyday. Onay outeray existsway, andway onenay illway ebay eatedcray.2. Ethay areshay eaveslay eirthay owserbray insteadway: outboundway TLS ignalingsay onway TCP 443 otay ebrtcway.mersive.com.3. Ethay oudclay introducesway ethay otway endpointsway; eythay egotiatenay away irectday, encryptedway WebRTC onnectioncay. Othingnay outesray oughthray Mersive; othingnay idgesbray.4. Ontentcay owsflay eviceday-otay-isplayday overway atthay irectday onnectioncay. Ignalingsay isway outboundway-onlyway onway othbay idessay: onay inboundway irewallfay ulesray.
atchedhay allsway: outesray atthay evernay existway; openingsway: egotiatednay owsflay onlyway
Ethay allbackfay, inway ullfay
Enwhay onay irectday athpay ancay ebay ormedfay, ethay ediamay akestay oneway elayedray ophay. Ethay obeglay aboveway endsway oneway essionsay inway ourfay isthay ayway. Isthay isway atthay ophay, essagemay ybay essagemay — atwhay ethay elayray isway askedway orfay, atwhay itway isway allowedway otay orwardfay, andway atwhay itway ancay eesay.
SHARING DEVICE behind symmetric NAT TURN RELAY public address, no NAT POLARIS POD display · AV VLAN 1 · SYMMETRIC NAT · A DIFFERENT EXTERNAL PORT FOR EVERY DESTINATION outbound, succeeds — mapped to 203.0.113.7:51000 the display answers to 203.0.113.7:51000 ✕ that mapping is valid only for traffic to the region that opened it — so the check is dropped, and no candidate pair succeeds 2 · ALLOCATE · THE DEVICE ASKS THE RELAY FOR AN ADDRESS OF ITS OWN Allocate 401 Unauthorized · realm + nonce Allocate · USERNAME · MESSAGE-INTEGRITY Success · XOR-RELAYED-ADDRESS · LIFETIME 600 s 198.51.100.20:49200 a public address that belongs to the device but lives on the relay. One NAT mapping, one destination — which is the thing symmetric NAT does not break 3 · CREATEPERMISSION · THE RELAY IS TOLD WHO MAY REACH IT CreatePermission · XOR-PEER-ADDRESS · 300 s the relay forwards from that one peer address and drops everything else — it is an allocation, not an open reflector 4 · CHANNELBIND · 36 BYTES OF PER-PACKET OVERHEAD BECOME 4 ChannelBind · channel number · 600 s 5 · RELAYED MEDIA · ENCRYPTED · ONE EXTRA HOP DTLS-SRTP END TO END · THE RELAY FORWARDS CIPHERTEXT IT HOLDS NO KEY FOR SYMMETRIC NAT STATEFUL FW CNX-02 · RELAYED FALLBACK · TIME RUNS DOWNWARD · RFC 8656 MECHANICS · RFC 5737 ADDRESSES SHEET 1/1 · REV A 1 · NO DIRECT PATH A symmetric NAT uses a different external port for every destination. DEVICE DISPLAY ✕ 2 · ALLOCATE The device asks a relay for a public address of its own, and authenticates. TURN RELAY 198.51.100.20:49200 LIFETIME 600 s · ONE PEER PERMITTED 3 · RELAYED MEDIA One extra hop. The relay forwards ciphertext it holds no key for. DTLS-SRTP · END TO END Osay ethay eviceday opsstay yingtray otay ebay eachableray andway asksway away elayray orfay anway addressway ofway itsway ownway. Ethay elayray allengeschay itway irstfay: anway allocationway isway authenticatedway, evernay anonymousway. Away ymmetricsay NAT ivesgay everyway estinationday away ifferentday externalway ortpay, osay ethay addressway ethay isplayday asway andedhay isway otnay ethay addressway acketspay ouldway arriveway omfray.
atchedhay allsway: ethay NAT andway ethay irewallfay, eithernay ofway ichwhay isway openedway
Erewhay isthay avessay ethay ayday
Eethray oomsray atthay eakbray away LAN-ocallay ystemsay. Ethay uestgay esenterpray Away oardbay embermay alksway inway onway LTE. Onay uestgay Wi-Fi ignsay-upway, onay VPN okentay, onay ongleday. Eythay oinjay ethay orkspaceway omfray away owserbray andway esentpray inway underway away inutemay, ithway erozay accessway otay ouryay etworknay.
Ytray itway inway ouryay oardroombay → Ethay egmentedsay enterpriseway Orpcay, uestgay, AV, andway OT etworksnay atthay ustmay evernay outeray otay eachway otherway, ybay olicypay. Polaris eepskay ethay isolationway intactway andway illstay andslay everyway ourcesay onway ethay amesay isplayday.
Ethay enterpriseway orystay → Ethay ultimay-uildingbay ampuscay Engineeringway inway Uildingbay C aresshay otay ethay arway oomray inway Uildingbay A, acrossway VLANs andway iberfay, ithoutway inningspay upway away UC allcay ustjay otay ovemay ixelspay.
Ampuscay alescay → Owhay osscray-etworknay ignalingsay orksway
Erewhay ouryay ontentcay actuallyway oesgay Polaris Cloud introducesway ethay otway endsway ofway away areshay. Itway oesday otnay arrycay emthay.
Enwhay away ourcesay andway away isplayday itsay onway ifferentday etworksnay, ethay ignalingsay ervicesay atway ebrtcway.mersive.com exchangesway onnectioncay etailsday etweenbay ethay aringshay eviceday andway ethay isplayday, andway ethay otway egotiatenay away irectday, encryptedway WebRTC onnectioncay etweenbay emselvesthay. Ouryay ontentcay avelstray omfray ethay eviceday otay ethay isplayday. Itway oesday otnay asspay oughthray Mersive.
Atwhay eachesray ourway oudclay: essionsay ignalingsay, ethay onnectioncay etailsday ethay otway endpointsway eednay otay indfay eachway otherway. Otnay ouryay eenscray.Atwhay aysstay onway ouryay etworknay: enwhay away ourcesay andway away isplayday areway alreadyway onway ethay amesay etworknay, ethay onnectioncay isway egotiatednay ithway ocallay addressesway onlyway andway evernay eaveslay ethay LAN.Atwhay evernay appenshay: onay inboundway irewallfay ulesray, onay idgingbray ofway ouryay etworksnay. Allway oudclay affictray isway outboundway TLS onway TCP 443 omfray othbay idessay. Away uestgay eviceday etsgay erozay accessway otay ouryay etworknay; ethay orkspaceway isway ethay onlyway aredshay urfacesay.Ethay ortshay ersionvay
Ethay ombinationcay ofway osscray-etworknay apabilitycay ithoutway away VPN, ethay orkspaceway, andway eetingmay aritypay ithway away ompositedcay orkspaceway availableway inway away ebway owserbray etssay Polaris apartway. ✓ Onay VPN ✓ Onay UC allcay ✓ Onay inboundway oleshay ✓ Uestgay etsgay erozay etworknay accessway ✓ Everyway Polaris iertay
Eckchay ethay atrixmay → Ethay ecuritysay eadray →
Eesay ethay atformplay ivelay. Ardwarehay ialstray ipshay orfay everyway oductpray, irectday omfray Mersive. Enwhay ethay oomsray ovepray itway, eway introduceway ouryay egionalray artnerpay orfay ethay olloutray.
Artstay away ialtray Atchway onway YouTube ↗ 
