Firewall Credentials Enforcement via SSL Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing approaches fail to effectively enforce credentials management policies across external sites, leading to security risks due to reuse of enterprise user credentials, which can be compromised, especially in phishing attacks and large-scale password leaks.
Innovation Solution
Implementing a firewall system that monitors and enforces credentials policies by storing user credentials, decrypting SSL sessions to detect credential submissions, and performing actions such as alerting, blocking, or requiring password resets when compromised or reused credentials are detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a firewall filters network traffic based on basic rules and policies, then network security is maintained with simple operation, but credentials management policies cannot be effectively enforced across external sites
Solution Approach 1:
The firewall is enhanced with multiple functions including SSL decryption capability, credential extraction from decrypted traffic, and integration with credential repositories. This allows the single firewall device to perform both traditional network filtering and specialized credentials management enforcement, resolving the contradiction by making the firewall universal rather than requiring separate specialized systems
Solution Approach 2:
The patent introduces intermediary components including a credential repository that stores compromised credentials and a decryption key repository that manages SSL decryption keys. These intermediaries enable the firewall to enforce credentials policies without requiring the firewall itself to maintain complex credential databases, thus enhancing adaptability while managing complexity through specialized intermediary components
2Measurement precision
If SSL sessions are decrypted to detect credential submissions, then detection precision of compromised credentials is improved, but use of energy and processing resources increases
Solution Approach 1:
The system performs preliminary actions by pre-decrypting SSL sessions and extracting credentials before traffic reaches the firewall for policy evaluation. Decryption keys are pre-loaded into the decryption key repository, and credentials are extracted and compared against the credential repository in advance, reducing the processing burden during active traffic filtering while maintaining high detection accuracy
Solution Approach 2:
The SSL decryption and credential detection process is segmented into separate functional modules: SSL decryption module, credential extraction module, and credential comparison module. This segmentation allows each module to specialize in specific tasks, improving detection precision while enabling parallel processing that reduces overall resource consumption compared to a monolithic approach
3Reliability
If enterprise credentials are stored at the network device for monitoring, then security enforcement is improved, but the risk of credential storage compromise increases
Solution Approach 1:
The patent extracts compromised credentials from enterprise systems and stores them in a dedicated credential repository at the network device. By taking out only the necessary credential data (hashes or encrypted forms) rather than storing full credentials, the system achieves reliable policy enforcement while minimizing the security risk associated with credential storage. The extracted credentials are used solely for comparison purposes against monitored traffic
Solution Approach 2:
The credential repository is implemented as an isolated, protected environment within the network device that stores credential data in an inert state (hashed or encrypted). This inert storage method prevents the credentials from being usable even if accessed, creating a secure environment that maintains enforcement reliability while mitigating the harmful effects of potential storage compromise
Data Source
AI summary
Techniques for credentials enforcement using a firewall are disclosed. In some embodiments, a system, process, and/or computer program product for enforcement using a firewall includes storing a plurality of user credentials at a network device; monitoring network traffic at the network device to determine if there is a match with one or more of the plurality of user credentials; and performing an action if the match is determined.