Distributed Application Security via Dynamic Metadata Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security solutions, such as intrusion protection systems (IPS) and web application firewalls (WAF), face challenges in cloud deployments due to resource-intensive requirements and the need for full traffic visibility, leading to blind spots and impracticalities in monitoring internal traffic within enterprise networks.
Innovation Solution
A distributed runtime application security system is introduced, comprising a contextual controller and agents deployed on network devices, which generates extraction vectors to extract metadata, correlates it to construct transactional service graphs, and controls agents based on these graphs, eliminating the need for full packet visibility and unifying detection and enforcement functions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If full traffic visibility is implemented for comprehensive security monitoring, then detection precision is improved, but resource consumption increases significantly
Solution Approach 1:
The patent extracts only the necessary metadata from full network traffic using extraction vectors, rather than processing complete packets. Agents extract specific fields (headers, payloads, metadata) based on predefined extraction vectors, significantly reducing resource consumption while maintaining detection precision for security threats.
Solution Approach 2:
The system implements partial action by selectively monitoring only relevant traffic attributes defined in extraction vectors. Instead of processing 100% of traffic data, the system processes only the specific metadata fields necessary for security detection, reducing computational overhead while maintaining effective threat detection.
2Reliability
If IPS functionality is deployed at network edge for inbound/outbound traffic monitoring, then security coverage is improved, but internal service-to-service traffic monitoring creates blind spots
Solution Approach 1:
The patent creates a universal security agent architecture that can be deployed in multiple locations (network edge, cloud, host, container) and handles multiple traffic types (inbound, outbound, internal service-to-service). The same agent framework adapts to different deployment contexts, eliminating blind spots by providing consistent monitoring capabilities across all network segments.
Solution Approach 2:
The system transitions from single-point edge monitoring to multi-dimensional monitoring by deploying agents at various levels (network, host, container, cloud). This dimensional expansion allows simultaneous monitoring of external traffic at the edge and internal service-to-service traffic at distributed locations, eliminating monitoring blind spots.
3Measurement precision
If WAF is deployed close to applications for targeted protection, then detection precision is improved, but scaling to every application type increases device complexity
Solution Approach 1:
The patent segments the WAF functionality into independent agents that can be selectively deployed based on application types and security requirements. Rather than a monolithic WAF deployed everywhere, the system divides functionality into distributed agents that process security rules locally, reducing deployment complexity while maintaining precision for targeted applications.
Solution Approach 2:
The system implements dynamic deployment where agents are selectively instantiated based on application types, traffic patterns, and security policies. The extraction vectors and rule sets are dynamically adjusted per application context, allowing precise protection where needed while avoiding unnecessary complexity in low-risk areas.
4Device complexity
If monolithic security services are used for unified detection and enforcement, then system simplicity is improved, but resource requirements increase excessively
Solution Approach 1:
The patent segments the monolithic security service into distributed agents that perform local extraction, detection, and enforcement. Each agent handles a subset of security functions independently, reducing the resource burden on any single system while maintaining unified security policy enforcement through centralized rule management.
Solution Approach 2:
The system introduces extraction vectors as intermediaries between the security policy engine and traffic processing agents. The vectors define what metadata to extract and how to process it, allowing centralized policy management with distributed execution, thereby simplifying the system architecture while reducing resource requirements through localized processing.
Data Source
AI summary
Presented herein are methodologies for implementing application security. A method includes generating an extraction vector based on a plurality of application security rules to be enforced, transmitting the extraction vector to a first agent operating on a first network device and to a second agent operating on a second network device; receiving, separately, from the first agent and from the second agent, first metadata generated by the first agent and second metadata generated by the second agent by the agents applying the extraction vector to network traffic passing, respectively, through the first network device and the second network device. The first metadata includes a transaction ID assigned by the first agent, and the second metadata includes the same transaction ID. The method further includes correlating the first metadata with the second metadata based on the transaction ID to construct a transactional service graph for the network traffic.