Client-Side Security Agent for Encrypted Web Traffic Policy Enforcement

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing security policies struggle to apply security measures to encrypted web traffic without compromising end-user privacy, often requiring decryption that negatively impacts network performance and privacy.

Innovation Solution

A client-side security agent is implemented on user devices to apply security policies to encrypted web traffic without decrypting the data, using an interface that allows for the enforcement of security policies on encrypted connections, thereby maintaining privacy and minimizing performance impact.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If decryption is performed to apply security policies, then security policy enforcement is improved, but end-user privacy is compromised and network performance deteriorates

Engineering Contradiction:

Improvesecurity policy enforcementVSAvoidend-user privacy

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The patent extracts only the necessary connection information (domain name, port, protocol) from the encrypted traffic metadata, without decrypting the actual content. This allows security policies to be applied to connection establishment while preserving end-user privacy during data transmission.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces a security policy enforcement mechanism that acts as an intermediary, using encrypted traffic metadata (SNI, ALPN, certificate information) to apply security policies without requiring full decryption. This mediator approach enables policy enforcement while maintaining encryption benefits.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If decryption is performed to apply security policies, then security policy enforcement is improved, but network performance deteriorates

Engineering Contradiction:

Improvesecurity policy enforcementVSAvoidnetwork performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent applies partial decryption or metadata extraction only where necessary for security policy enforcement (connection establishment phase), rather than full decryption of all traffic. This minimizes the performance overhead while achieving security objectives.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS11368487B2Applying security policies to web traffic while maintaining privacy

Publication Date: 2022.06.21 CISCO TECHNOLOGY INC

AI summary

A computer system applies security policies to web traffic while maintaining privacy. A network security agent is authenticated by a client application to dynamically obtain one or more security policies, wherein the client application and the network security agent are configured to execute on a device and the network security agent is capable of communicating with a source of security policies. Connection information is obtained that includes a request to initiate an encrypted connection with a destination entity. The client application determines whether the encrypted connection between the client application and the destination entity is permitted according to the security policy and based on the connection information. The encrypted connection between the client and the destination entity is established in response to determining that the encrypted connection is permitted. Embodiments may further include a method and computer program product for applying security policies to web traffic.