Relay Server Pro

Relay Server Pro is available starting with AIR version 5.4 and represents the next generation of secure relay communications for Binalyze AIR.

Overview

Relay Server Pro is a fundamental architectural evolution in secure relay operations for Binalyze AIR. It replaces the legacy SOCKS5-based relay server with a fully authenticated HTTPS proxy that implements JWT-based two-step verification for Responders connecting through constrained or segmented networks.

Unlike the previous relay server, Relay Server Pro is deployed independently of the Responder, reducing the overall attack surface and aligning with modern zero-trust and least-privilege design principles. Configuration and registration are managed centrally through the AIR Console, ensuring that only validated relays are permitted to handle Responder communications.

Each connection between a Responder and Relay Server Pro is authenticated, logged, and validated, providing end-to-end integrity and accountability for all command and evidence transfers. For DFIR teams, Relay Server Pro ensures traceable, secure intermediary communications across segmented environments and enhances AIR deployments in organizations that enforce strict network isolation or operate within zero-trust architectures.

Problem Solved

The legacy relay server was originally designed for use in local networks and did not include an authentication mechanism to securely verify or authorize connecting Responders. This design, while effective in controlled environments, created several limitations:

• No built-in authentication to verify connecting Responders

• Tight coupling with Responder created dependencies on the Responder's release cycle for updates

• Limited flexibility for enterprise network configurations

• Reduced security in zero-trust or heavily segmented environments

Relay Server Pro addresses these limitations by introducing secure, credential-based authentication and architectural independence.

Key Features & Improvements

Security & Authentication

• Built-in authentication tied directly to the Responder's Console registration credentials

• JWT-based two-step verification ensures only trusted Responders can connect

• Authenticated connections with full logging and validation for every communication

• Reduced attack surface through deployment separation from endpoint agents

Protocol & Connectivity

• HTTPS Proxy Connect support out of the box for reliable communication through enterprise firewalls

• Custom port configuration to meet enterprise security requirements

• Proxy all TCP connections for comprehensive relay capabilities

• URL-based addressing format for more precise configuration

Operational Excellence

• Independence from Responder - no longer dependent on Responder installation, updates, or release cycle

• Standalone operation allows faster updates and greater scalability

• Modernized JSON logging accessible only from local administration, eliminating remote exposure risks

• Caching support for large downloads to improve performance

Future-Ready Architecture

Relay Server Pro has been engineered with extensibility in mind, enabling Binalyze to incorporate additional customer requirements and enhancements without significant architectural rework.

Value Proposition

Relay Server Pro delivers:

• Secure authentication using credentials already registered to the Console

• Protocol modernization via HTTPS Proxy Connect for enterprise environments

• Operational flexibility with custom ports and independent updates

• Enhanced accountability with comprehensive JSON audit logging

• Zero-trust readiness for organizations with strict network segmentation

Transition & Deprecation

The legacy relay server will be deprecated in a future release. Both versions will run in parallel during the transition period.

Migration Timeline

During AIR 5.4 and subsequent versions:

• Both Relay Server Pro and the legacy relay server are supported in parallel

• Users are encouraged to begin migrating configurations to Relay Server Pro

• The deprecation timeline for the old relay server will be communicated in a future release

Migration Recommendations

Organizations should plan to transition to Relay Server Pro to take advantage of:

• Enhanced security features and authentication

• Independent update cycles

• Modern logging and accountability

• Better support for zero-trust architectures

Use Cases

Relay Server Pro is ideal for:

• Segmented networks requiring authenticated relay communications

• Zero-trust environments enforcing strict network isolation policies

• Enterprise deployments with complex firewall and proxy configurations

• DFIR operations requiring traceable and auditable network intermediary communications

• Organizations needing independent relay update cycles

Summary

Relay Server Pro strengthens the security posture of AIR deployments by authenticating every Responder connection, modernizing relay communication, and decoupling relay operations from Responder releases — setting a new standard for secure, scalable relay communication in DFIR environments.