Encrypted Subfield Firewall Rule Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network firewalls face challenges in securely enforcing classified network security rules, as they often require sensitive information to be exposed, which can compromise confidentiality if a single network device is compromised.
Innovation Solution
The implementation of encrypted subfields, where a fully trusted device encrypts rules and keys, allowing partly trusted devices to enforce security without exposing plaintext rules, using secure communication protocols and physically secure interfaces to ensure confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional firewalls use plaintext rules for packet matching, then the firewall can effectively enforce security rules, but the confidentiality of the rules is compromised if a device is compromised
Solution Approach 1:
The patent introduces an encrypted rule database as an intermediary between the firewall engine and the sensitive rule information. The rules are stored in encrypted form in the database, and the firewall engine operates on encrypted rule representations without accessing plaintext rules. This mediator (encrypted storage and processing mechanism) allows the firewall to enforce security rules reliably while preventing exposure of rule confidentiality even if the firewall device is compromised.
Solution Approach 2:
The patent transforms the rules from plaintext form to encrypted form, changing the state of the rule data. The rule database stores encrypted rule sets, and the firewall engine processes encrypted packet data by comparing it against encrypted rule patterns. This parameter change (from plaintext to encrypted representation) enables the firewall to maintain security rule enforcement capability while eliminating the confidentiality risk associated with storing and processing plaintext rules.
2Loss of information
If encrypted rules are used to protect confidentiality, then rule secrecy is maintained, but the complexity of the firewall system increases
Solution Approach 1:
The patent extracts the encryption/decryption functionality from the core firewall rule processing logic and implements it as a separate encrypted rule database layer. The firewall engine itself remains relatively simple, operating on encrypted representations without needing to understand or manage the encryption keys directly. This extraction of the cryptographic management function into a dedicated database layer reduces the complexity burden on the firewall processing engine while still providing the confidentiality benefits of encryption.
3Speed
If plaintext rules are stored and processed, then the firewall can quickly match packets against rules, but sensitive information in rules is exposed
Solution Approach 1:
The patent creates encrypted copies of the rule sets that can be efficiently processed by the firewall engine. Instead of requiring decryption of each rule during packet matching, the system maintains encrypted representations of rules that can be directly compared against encrypted packet data. This copying approach allows the firewall to perform rapid pattern matching operations on the encrypted rule copies without exposing the original plaintext rules, thus maintaining both speed and confidentiality.
Data Source
AI summary
In one embodiment, a method includes receiving from a secure device, an encrypted rule at a first network device, receiving at the first network device, a packet containing at least one encrypted subfield from a second network device, the subfield encrypted based on a key received at the second network device from the secure device, and determining if the encrypted subfield matches the encrypted rule. An apparatus and logic are also disclosed herein.