Edge Security Processing With Selective Review Suspension
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The migration to edge security solutions in network security results in a tradeoff between costly processing power and increased throughput, leading to sub-standard security in corporate networks.
Innovation Solution
Implementing systems and methods for selectively suspended network security processing, where a subset of network traffic sessions are processed at the edge, reducing the need for intensive security processing at a central system and minimizing WAN bandwidth usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If intensive security processing is implemented at the network edge, then security effectiveness is improved, but processing cost and device complexity increase
Solution Approach 1:
The edge device performs self-assessment of its own security risk level and autonomously suspends security processing when operating in low-risk environments. The system grants itself permission to bypass security protocols based on environmental trust indicators, eliminating the need for continuous centralized verification and reducing processing overhead while maintaining security effectiveness.
Solution Approach 2:
The security processing intensity dynamically adjusts based on the security grant state. When a security grant is received indicating a low-risk environment, the edge device transitions from intensive security processing to suspended or minimal processing. This dynamic adaptation allows the system to optimize processing cost while maintaining security effectiveness by matching processing intensity to actual risk levels.
2Reliability
If all network traffic is sent to centralized security system for processing, then security review thoroughness is improved, but WAN bandwidth consumption increases
Solution Approach 1:
The patent extracts the security review function from the centralized system and implements it locally at the edge device. By suspending security processing at the edge when operating in trusted environments, the system eliminates unnecessary WAN traffic for security reviews while maintaining thorough review capability when needed. This extraction reduces WAN bandwidth consumption without compromising security review thoroughness for traffic that requires it.
Solution Approach 2:
Instead of applying full security processing to all traffic, the system applies partial or suspended security processing to traffic in low-risk environments. The security grant mechanism allows the edge device to perform only essential security functions locally while suspending intensive processing that would otherwise require WAN communication. This partial action approach reduces WAN bandwidth consumption while maintaining adequate security review thoroughness for the specific traffic context.
3Speed
If edge devices perform autonomous security decisions, then response speed is improved, but security policy compliance becomes more difficult to ensure
Solution Approach 1:
The system implements feedback through security grant mechanisms where the centralized security system provides authoritative decisions to the edge device. The edge device receives security grants that contain policy compliance information and uses this feedback to guide its autonomous decisions. This feedback loop ensures that autonomous edge decisions remain aligned with centralized security policies while maintaining fast local response speeds.
Solution Approach 2:
The centralized security system performs preliminary security assessment and issues security grants before traffic reaches the edge device. These pre-established security grants contain predetermined policy compliance rules that the edge device simply follows during autonomous operation. This preliminary action eliminates the need for complex real-time policy evaluation at the edge while ensuring compliance, as the edge device merely executes pre-approved security decisions.
Data Source
AI summary
Various embodiments provide embodiments provide systems and methods for performing edge processing using selectively suspended network security processing.