juH / pat
/ rarwI'mey juSbogh 'angghach
meb Wi-Fi, VLANmey, rarwI'mey wavlu'pu'bogh je juSbogh HaSta 'angghach. rarwI'mey mach, VLANmey, meb Wi-Fi, LTE, veng latlh retlhDaq qach: wa' Qu'meH Daq, VPN pagh, UC ja'chuq pagh, tlhegh pagh. laHvam, Polaris wa'DIch moj.
Polaris sessions on a rotating wireframe globe
An orthographic wireframe Earth, drawn as a coastline and a fifteen-degree graticule, which can be dragged to rotate. Marked on it are sharing devices, meeting-room displays and Polaris Cloud signaling regions. Sessions play in a loop: both ends of a share open an outbound connection to a signaling region, the region introduces them, and the content itself then travels along a single direct arc between the two endpoints while the signaling links go idle. In the last session of the loop the two ends sit behind a network that will not allow a direct path, the direct arc breaks at a marked obstruction, and the encrypted content instead takes one extra hop through a relay before reaching the display.
EU WEST DENVER LONDON
naDev Hoch qep, rarwI'mey juS
London Daq LTE lo'bogh meb, Denver Daq ra'wI' pa' ghoS 'ang. Hur ghoS cha' megh'an; nIteb ghoS mIllogh wab je.
GUEST DEVICE guest Wi-Fi / LTE POLARIS CLOUD signaling broker POLARIS POD display · AV VLAN 1 · DIAL OUT · TLS 443 1 · DIAL OUT · TLS 443 both connections start inside the network: no inbound rules, no open ports 2 · SCREEN KEY · K7RM2X KEY RESOLVES TO THIS ROOM 3 · SDP · ICE EXCHANGED 3 · SDP · ICE EXCHANGED each side learns a direct path to the other 4 · DIRECT MEDIA · ENCRYPTED · DTLS-SRTP EPHEMERAL UDP · PEER-TO-PEER · SOLICITED FLOW PASSES THE STATEFUL FW CLOUD IDLE · OUT OF THE MEDIA PATH 5 · UNSOLICITED PACKET ✕ DROPPED · NO RULE MATCHES STATEFUL FW · OUTBOUND ONLY STATEFUL FW · OUTBOUND ONLY CNX-01 · CROSS-NETWORK DATA PATH · TIME RUNS DOWNWARD · CLOUD = SIGNALING ONLY SHEET 1/1 · REV C 1 · NO ROUTE Guest Wi-Fi and the display’s VLAN have no route between them. DISPLAY · AV VLAN GUEST DEVICE ✕ 2 · THE HANDSHAKE Both sides dial out to Polaris Cloud: TLS 443, signaling only. POLARIS CLOUD SDP · ICE 3 · DIRECT MEDIA The cloud introduces them, then steps away. Media flows device-to-device, encrypted. CLOUD · OUT OF THE MEDIA PATH ENCRYPTED · P2P 1. HaSta nIteb SIchmeH nID LTE lo'bogh meb. He pagh tu'lu', 'ej pagh chenmoHlu'.2. vaj De' leghwI'Daj mej 'angghach: Hur ghoS TLS QIn ngeHghach, TCP 443, webrtc.mersive.com ghoS.3. cha' megh'an ghommoH 'eng; WebRTC rarghach nIteb So'lu'pu'bogh lumab. Mersive juS pagh; pagh rarlu'.4. rarghach nIteb vegh, janvo' HaSta ghoS Doch. cha' retlhDaq, Hur ghoS neH QIn ngeHghach: 'elmeH Surchem chut pagh.
tlhoy' wavlu'pu'bogh: not tu'lu'bogh He'mey; poSmey: lengghach mablu'pu'bogh neH
QapHa'DI' mIw, naQ
He nIteb chenmoHlaHbe'lu'DI', wa' Sup tamghaylu'pu'bogh tlhap mIllogh wab je. Dung qo' mIllogh, mIwvamDaq qep wa' loS vo' rIn. Supvetlh 'oH, QIn wa' QIn cha': tamghayvaD nuq tlhoblu', nuq ngeHlaH, nuq leghlaH je.
SHARING DEVICE behind symmetric NAT TURN RELAY public address, no NAT POLARIS POD display · AV VLAN 1 · SYMMETRIC NAT · A DIFFERENT EXTERNAL PORT FOR EVERY DESTINATION outbound, succeeds — mapped to 203.0.113.7:51000 the display answers to 203.0.113.7:51000 ✕ that mapping is valid only for traffic to the region that opened it — so the check is dropped, and no candidate pair succeeds 2 · ALLOCATE · THE DEVICE ASKS THE RELAY FOR AN ADDRESS OF ITS OWN Allocate 401 Unauthorized · realm + nonce Allocate · USERNAME · MESSAGE-INTEGRITY Success · XOR-RELAYED-ADDRESS · LIFETIME 600 s 198.51.100.20:49200 a public address that belongs to the device but lives on the relay. One NAT mapping, one destination — which is the thing symmetric NAT does not break 3 · CREATEPERMISSION · THE RELAY IS TOLD WHO MAY REACH IT CreatePermission · XOR-PEER-ADDRESS · 300 s the relay forwards from that one peer address and drops everything else — it is an allocation, not an open reflector 4 · CHANNELBIND · 36 BYTES OF PER-PACKET OVERHEAD BECOME 4 ChannelBind · channel number · 600 s 5 · RELAYED MEDIA · ENCRYPTED · ONE EXTRA HOP DTLS-SRTP END TO END · THE RELAY FORWARDS CIPHERTEXT IT HOLDS NO KEY FOR SYMMETRIC NAT STATEFUL FW CNX-02 · RELAYED FALLBACK · TIME RUNS DOWNWARD · RFC 8656 MECHANICS · RFC 5737 ADDRESSES SHEET 1/1 · REV A 1 · NO DIRECT PATH A symmetric NAT uses a different external port for every destination. DEVICE DISPLAY ✕ 2 · ALLOCATE The device asks a relay for a public address of its own, and authenticates. TURN RELAY 198.51.100.20:49200 LIFETIME 600 s · ONE PEER PERMITTED 3 · RELAYED MEDIA One extra hop. The relay forwards ciphertext it holds no key for. DTLS-SRTP · END TO END vaj SIchlaHmeH nID mev jan, 'ej tamghay tlhob, Daq ghajmeH. wa'DIch waH tamghay: Daq nobghach ngu'lu'; pong Hutlhbe' not. Hoch ngoQvaD Hur lojmIt pIm nob NAT rapbe'bogh; vaj HaStavaD nobbogh Daq, De' 'aplo'mey paw Daq ghobe' 'oH.
tlhoy' wavlu'pu'bogh: NAT Surchem je; pagh poSmoHlu'
naDev Qapla' nob
LAN Daq neH Qapbogh pat QIHbogh wej pa'mey. much meb LTE lo'taHvIS 'el ra'wI' ghom ghot. meb Wi-Fi ghItlh pagh, VPN ngaQHa'moHwI' pagh, rarwI' mach pagh. De' leghwI'vo' Qu'meH Daq muv, 'ej wa' tup puSDaq much; rarwI'meylIj naw' pagh ghaj.
ra'wI' pa'lIjDaq yIwaH → malja' tIn, rarwI'mey wavlu'pu'bogh malja', meb, AV, OT je rarwI'mey; chutmo', not rarchuqnIS. wavghach pol Polaris, 'ach HaSta rapDaq Hoch Hal lan.
malja' tIn lut → law' qachmey ghojmeH Daq qach C Daq jonta' ghom, qach A Daq may' pa' ghoS 'ang; VLANmey 'ej wov tlhegh juS. mIllogh vIHmoHmeH neH UC ja'chuq taghnISbe'.
ghojmeH Daq tIn → chay' rarwI'mey juSbogh QIn ngeHghach Qap
nuqDaq teH ghoS DochlIj 'angghach cha' megh'an ghommoH Polaris Cloud. chaH qengbe'.
rarwI'mey pIm Daq ba'chugh Hal HaSta je, 'angbogh jan HaSta je joj rarmeH De' tam webrtc.mersive.com QIn ngeHmeH jabwI', 'ej WebRTC rarghach nIteb So'lu'pu'bogh lumab cha'. janvo' HaSta ghoS leng DochlIj. Mersive juSbe'.
'engmaj SIchbogh: qep QIn ngeHghach; ghomchuqmeH cha' megh'an poQbogh rarmeH De'. HaStalIj ghobe'.rarwI'meylIjDaq ratlhbogh: rarwI'mey rapDaq ba'chugh Hal HaSta je, Daq Sum Daqmey neH lo'lu'meH rarghach mablu', 'ej LAN not mej.not qaSbogh: 'elmeH Surchem chut pagh, rarwI'meylIj rarmoHghach pagh. Hoch 'eng lengghach, Hur ghoS TLS, TCP 443, cha' retlhvo'. rarwI'meylIj naw' pagh ghaj meb jan; Qu'meH Daq neH 'oH Daq tay''e'.ngaj
VPN Hutlhbogh rarwI'mey juSbogh laH, Qu'meH Daq, De' leghwI'Daq Qu'meH Daq tay'moHlu'pu'bogh lo'bogh qep rapghach je: chaH ghomDaq, Polaris wa'DIch moj. ✓ VPN pagh ✓ UC ja'chuq pagh ✓ 'elmeH QaDHa' pagh ✓ rarwI'mey naw' pagh ghaj meb ✓ Hoch Polaris patlh
rap'a' tetlh yIlegh → Hung laD →
pat DaH yIlegh. Hoch DochvaD jan waHmey ngeH Mersive nIteb. pa'meylIj tobDI', SeplIj boqwI' DaghommeH maQaH; Hoch pa' tuQmoH ghaH.
waH yItagh YouTube Daq yIbej ↗ 
