Firewall Intermediary Decrypts Encrypted Tunneling Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewalls struggle to detect and block unauthorized activities that utilize encrypted tunneling protocols, such as SSH, which allow users to evade network usage policies by encrypting traffic, making it difficult for deep packet inspection to differentiate between legitimate remote access and unauthorized activities.
Innovation Solution
Implementing techniques to monitor and intercept encrypted network communications, using trusted man-in-the-middle decryption methods to decrypt and inspect tunneling traffic, allowing for the detection and potential blocking of unauthorized tunneling requests based on firewall policies, and optionally alerting or quarantining users or servers that violate these policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If deep packet inspection is used to detect unauthorized activities, then firewall security is improved, but encrypted tunneling traffic cannot be detected because the encryption obscures the traffic content
Solution Approach 1:
The patent introduces an intermediary decryption component that acts as a mediator between the encrypted traffic and the deep packet inspection engine. This intermediary decrypts the tunneling traffic using stored credentials before inspection, allowing the firewall to see through the encryption while maintaining security policies. The intermediary serves as a trusted third party that enables inspection without compromising the encrypted communication's integrity.
2Ease of operation
If encrypted tunneling protocols are allowed for legitimate remote access, then network usability is improved, but unauthorized activities can evade detection and policy enforcement
Solution Approach 1:
The patent changes the state parameter of the encrypted traffic from opaque to transparent by selectively decrypting it. The system maintains encryption for legitimate traffic while transforming specific tunneling protocols into inspectable formats when credentials are available. This parameter change allows the same traffic to serve dual purposes: maintaining security through encryption while enabling inspection when authorized.
Solution Approach 2:
The system implements a feedback mechanism where the firewall monitors tunneling traffic, attempts decryption using stored credentials, and based on the decryption success and inspection results, enforces appropriate policies. The feedback loop continues by updating credential stores and adjusting inspection rules, creating a dynamic system that adapts to legitimate versus unauthorized usage patterns.
Data Source
AI summary
Techniques for detecting encrypted tunneling traffic are disclosed. In some embodiments, detecting encrypted tunneling traffic includes monitoring encrypted network communications between a client and a remote server, in which the encrypted network communications are encrypted using a first protocol (e.g., Secure Shell (SSH) protocol or another protocol for encrypted network communications); and determining if the client sends a request to create a tunnel using the first protocol with the remote server. In some embodiments, detecting encrypted tunneling traffic further includes performing an action in response to determining that the client sent a request to create a tunnel using the first protocol with the remote server.