Encrypted Traffic Monitoring via Log Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Defending computer networks from malicious or unauthorized users is challenging, especially when dealing with encrypted traffic, as decrypting it poses additional security risks and requires access to encryption keys and certificates, which can be difficult to manage securely.
Innovation Solution
A network security system that intercepts and analyzes encrypted traffic in real-time using log entries generated during the session, allowing it to control the session by applying security measures without decrypting the traffic, such as terminating the session, modifying packets, or requiring additional authentication based on the information in the log entries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If encrypted traffic is decrypted for inspection, then security monitoring capability is improved, but security risks increase and encryption key management becomes complex
Solution Approach 1:
The patent introduces log entries as an intermediary medium that indirectly reveals encrypted traffic information. Instead of decrypting the actual traffic, the system analyzes log entries generated by the application during the encrypted communication session. These logs contain metadata and contextual information that enable security monitoring without requiring decryption of the encrypted payload, thus avoiding key management complexity and security risks associated with decryption.
2Speed
If real-time monitoring of encrypted traffic is implemented, then threat detection speed is improved, but decryption complexity and resource requirements increase
Solution Approach 1:
The patent extracts the essential monitoring function from the encrypted traffic itself and relocates it to the analysis of log entries. By separating the monitoring task from the encrypted payload and implementing it through application-generated logs, the system achieves real-time threat detection without the computational overhead and complexity of decrypting encrypted traffic in real-time.
3Difficulty of detecting and measuring
If encryption keys and certificates are managed for decryption, then traffic inspection capability is improved, but security management complexity increases
Solution Approach 1:
The patent uses log entries as an intermediary that provides traffic inspection capability without requiring direct access to encryption keys or certificates. The application generates logs during encrypted sessions that contain sufficient information for security analysis, eliminating the need for complex key and certificate management infrastructure while maintaining effective traffic monitoring.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
A system (20) includes a network interface (32, 36) and a processor (34, 38); wherein the processor (34, 38) is configured to: receive, via the network interface, a request (46) originating from a request-origin application and directed to a request-destination application (24b) that runs on a request-destination device (24), subsequently to receiving the request, communicate the request to the request-destination application, subsequently to communicating the request to the request-destination application: identify, from among multiple log entries recorded by the request-destination application, at least one log entry as having been recorded responsively to the request, and receive a response (50), from the request-destination application, to the request, while holding the response, identify information contained in the at least one log entry, and perform a function in response to the information. Other embodiments are also described.