Technical notes on the Local IO Bridge in Salto Space

What is the Local IO Bridge?

The Local IO Bridge is a lightweight Windows service developed by Salto that solves a fundamental connectivity problem: the Space server, running on a remote machine, has no direct way to reach USB devices physically connected to a client machine. The Local IO Bridge runs locally on the client machine and acts as a relay, bridging the Space server with USB devices, such as USB NCoders and PPDs.

See System requirements for an introduction to the Local IO Bridge and its role in the Space architecture.

The Local IO Bridge exposes a local REST API to the Space web application running in the browser, which orchestrates the communication. The browser instructs the Local IO Bridge to open a relay connection between the Space server and the USB device, through which the Space server can operate the device directly.

Local IO Bridge communication

When is it required?

The Local IO Bridge is only needed on machines where a USB device is physically connected.

Installation

Network and firewall considerations

The Local IO Bridge binds only to localhost (127.0.0.1). Its local REST API ports are not accessible from other machines on the network, so no inbound firewall rules are required at the network level.

Local ports (browser-Local IO Bridge)

In default mode the Local IO Bridge randomly selects one HTTP port and one HTTPS port at each startup from the following allowed ranges:

If a localhost firewall is in place, it must allow the Local IO Bridge process to listen on ports within these ranges.

In advanced mode, fixed port numbers can be configured. See section Advanced mode configuration for further details.

Outbound connection (Local IO Bridge-Space server)

The Local IO Bridge establishes an outbound WebSocket connection to the Space server on TCP port 8102 (default, configurable). When Space is configured with HTTPS, this connection is secured using WSS with the Space server's trusted CA-signed certificate.

Advanced mode configuration

By default the Local IO Bridge works out of the box with no configuration required: it selects random ports from the allowed ranges and uses its own built-in self-signed certificate for the local HTTPS endpoint. In managed environments, an administrator may wish to:

• Fix the HTTPS port to a known value, avoiding port scanning by the browser.
• Use a trusted CA-signed certificate for the local HTTPS endpoint instead of the built-in self-signed one.

Both are configured by creating a file called service.ini in the Local IO Bridge installation folder. The file is read once at startup and the service must be restarted after any change. Only a user with administrator rights can create or modify this file.

Port and certificate configuration are independent—it is possible to configure only the port, only the certificate, or both.

Port configuration

Certificate configuration

Certificate requirements when using manual mode (HttpsCertManual=1):

• Must be signed by a Certificate Authority trusted by the client machine.
• Must not be expired.
• Must include IP Address=127.0.0.1 in the Subject Alternative Name (SAN) field, since the Local IO Bridge binds only to localhost.

• Example:

[Https]
HttpsPort=50110
HttpsCertManual=1
HttpsCertStoreName=My
HttpsCertIdentificationMethod=0
HttpsCertIdentificationMatchValue=my-server.comtoso.com
HttpsCertSelectionStrategy=0

This configuration fixes the HTTPS port to 50110, uses a certificate from the Windows Certificate Store and identifies it by Subject CN matching my-server.comtoso.com from the My store, selecting the one with the most recent NotBefore date if multiple matches exist.

Data handling and privacy

A key property of the Local IO Bridge is that it never has access to the data it relays. All communication between the Space server and the USB device—including any card data and credentials—is encrypted end-to-end using DTLS 1.2 before it enters the relay. The Local IO Bridge only ever forwards encrypted bytes. It has no keys to decrypt the content and cannot read, inspect, or tamper with it in any way.

The Local IO Bridge is a blind relay by design.

Data handling and privacy

The only data that passes between the browser and the Local IO Bridge—through the local REST API—is non-sensitive control information: port enumeration and relay management commands. No card data or credentials are ever present on this interface.

Security summary