Firewall Filtering via Web Server Security Policy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current firewall systems are inadequate in effectively filtering out malware and unauthorized content, as virus and malware scanners often fail to detect new threats, and wholesale blocking of data types can break functionality in certain applications.
Innovation Solution
A firewall system that receives a security policy from a server to filter content requests based on authorized hosts and resource types, preventing unauthorized data access and filtering out malware by intercepting and processing content requests from client devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If wholesale blocking of certain data types is implemented, then security against malware is improved, but functionality of software applications is broken
Solution Approach 1:
The firewall filters data at the packet level rather than blocking entire file types, segmenting the filtering process to examine and allow specific authorized data packets while blocking only malicious ones. This resolves the contradiction by enabling selective blocking that maintains application functionality while providing security.
Solution Approach 2:
The system implements domain-specific security policies that apply different filtering rules to different domains and applications. Each domain can have its own authorized data types and hosts, allowing legitimate applications to function while blocking malware-specific data types from unauthorized sources.
2Measurement precision
If virus scanners and malware scanners are updated continuously, then detection capability is improved, but response time to new threats is delayed
Solution Approach 1:
Security policies are pre-configured with authorized hosts and data types for each domain before threats occur. This preliminary configuration allows the firewall to immediately block unauthorized data transmissions without waiting for scanner updates, providing instant protection against new threats while maintaining detection capability through the policy framework.
3Reliability
If firewall filtering is made more sophisticated, then security effectiveness is improved, but system complexity increases
Solution Approach 1:
The system introduces a security policy server as an intermediary that manages and distributes filtering rules to firewalls. This mediator handles the complexity of policy management, updates, and coordination centrally, allowing individual firewalls to implement sophisticated filtering without each one becoming independently complex.
Data Source
AI summary
A user of a client device that is protected by a firewall may navigate to a website using a particular browser process (e.g., a window/tab of a browser) of the client device, sending a content request toward a web content server in the process. The firewall may intercept the content request, and may also receive information from the client device identifying which browser process initiated the content request. Before passing the content request to the appropriate web content server, the firewall may request and download a security policy from a security policy server. The security policy may notify the firewall which hosts are authorized/unauthorized for use with a particular domain, and which file types from each of these hosts are authorized/unauthorized for use with the particular domain. The firewall may then filter content related to the identified browser process based on the security policy.