Application-Aware Network Firewalling via Socket Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network firewalling methods, such as port blocking and deep packet inspection, are unreliable and resource-intensive, failing to accurately differentiate between malicious and non-malicious traffic, especially with encrypted data and requiring frequent database updates.
Innovation Solution
A method intercepts network socket events at the transport layer and communicates with a security server to enforce network policies based on application identification, reducing the need for deep packet inspection by blocking or allowing traffic based on application-specific rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If port blocking is used for network firewalling, then the implementation is simple and easy to apply, but the firewalling reliability is poor and cannot accurately differentiate malicious traffic
Solution Approach 1:
The patent introduces an intermediary component (the firewall system with application awareness) that sits between the network traffic and the blocked ports. This intermediary uses application identification mechanisms to recognize legitimate applications and allow their traffic while blocking malicious traffic on the same ports, thus maintaining ease of port-based blocking while improving reliability through application-level awareness.
2Measurement precision
If deep packet inspection is used to identify malicious traffic, then the accuracy of detecting malicious content is significantly improved, but the processing resources required increase and network latency increases
Solution Approach 1:
The patent applies partial deep packet inspection by examining only specific portions of packets or using selective inspection based on application identification. Instead of inspecting every packet in detail, the system first identifies the application and then applies inspection only when necessary, reducing overall processing resources while maintaining detection accuracy for malicious traffic.
Solution Approach 2:
The system performs preliminary application identification before conducting deep packet inspection. By first determining which application generated the traffic, the system can make preliminary decisions about whether inspection is needed, thus reducing the total amount of deep packet inspection performed while maintaining security accuracy.
3Measurement precision
If deep packet inspection is used to detect malicious traffic, then the accuracy of identifying protocol and malicious content is improved, but a huge database of traffic signatures is required and frequent updates are needed
Solution Approach 1:
The patent segments the detection approach by separating application identification from protocol/malicious content detection. The system first identifies the application layer, then uses this information to guide subsequent inspection. This segmentation allows the use of smaller, more manageable signature databases for each layer rather than requiring one huge comprehensive database, reducing complexity while maintaining detection accuracy.
4Measurement precision
If SSL proxy is used to decrypt encrypted packets for DPI, then the ability to inspect encrypted traffic is improved, but the network throughput decreases
Solution Approach 1:
The patent applies partial decryption or selective decryption only for traffic from untrusted applications or when suspicious patterns are detected. Instead of decrypting all encrypted traffic through an SSL proxy, the system inspects application identification data and only applies decryption/inspection when necessary, thus maintaining the ability to inspect encrypted malicious traffic while minimizing the impact on overall network throughput.
Data Source
AI summary
A method for enforcing a network policy is described herein. In the method, a network socket event request from an application executing in a first context is intercepted by an agent prior to the request reaching a transport layer in the first context. A context refers to virtualization software, a physical computer, or a combination of virtualization software and physical computer. In response to the interception of the request, the agent requests a decision on whether to allow or deny the network socket event request to be communicated to a security server executing in a second context that is distinct from the first context. The request for a decision includes an identification of the application. The agent then receives from the security server either an allowance or a denial of the network socket event request, the allowance or denial being based at least in part on the identification of the application and a security policy. The agent blocks the network socket event from reaching the transport layer when the denial is received from the security server. In one embodiment, the method is implemented using a machine readable medium embodying software instructions executable by a computer.