Firewall Credential Store Using Bloom Filters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing approaches fail to effectively enforce credentials management policies across external sites, leading to security risks due to reused or compromised user credentials, which can be compromised through phishing or other attacks, posing a threat to enterprise networks.
Innovation Solution
Implementing a firewall-based system that monitors and enforces credentials policies by storing user credentials in a secure cache, using techniques like bloom filters for efficient storage and matching, and performing actions such as blocking or alerting users when compromised credentials are detected, to prevent unauthorized access and ensure compliance with enterprise policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If user credentials are stored in a cache for enforcement, then credential matching efficiency is improved, but security risks increase due to potential compromise of stored credentials
Solution Approach 1:
The patent transforms credentials into a different representation format (bloom filter data structure) that changes the parameters of storage and retrieval. This transformation allows efficient membership testing while preventing direct access to original credential values, thus resolving the contradiction between efficiency and security
Solution Approach 2:
The bloom filter acts as an intermediary between the credential storage system and the enforcement mechanism. It mediates the matching process by providing probabilistic membership testing without exposing actual credentials, enabling efficient enforcement while maintaining security
2Productivity
If bloom filters are used for credential storage, then storage efficiency and retrieval speed are improved, but false positive matches may occur reducing measurement precision
Solution Approach 1:
The system accepts a small probability of false positives (partial action) in exchange for significant gains in retrieval speed. The bloom filter provides probabilistic rather than deterministic matching, which is sufficient for the security enforcement context where false positives can be verified through additional checks
Solution Approach 2:
The patent adjusts the parameters of the bloom filter (number of hash functions, filter size) to optimize the balance between false positive rate and retrieval efficiency. By changing these parameters, the system achieves acceptable precision while maintaining high productivity
Data Source
AI summary
Techniques for an efficient and secure store for credentials enforcement using a firewall are disclosed. In some embodiments, a system, process, and/or computer program product for an efficient and secure store for credentials enforcement using a firewall includes receiving a space-efficient and secure data structure, such as bloom filter, from an agent executed on an authentication server, in which the bloom filter is generated by the agent based on a transformation of a plurality of user credentials extracted from the authentication server and/or intercepted at the authentication server; storing the bloom filter on the network device (e.g., in a cache on the network device); and monitoring network traffic at the network device to perform credentials enforcement using the bloom filter.