Stateless Firewall Dynamic Rule Implementation via Server Mediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing firewalls face complexity and resource challenges when required to monitor user activity, detect patterns, and dynamically implement rules, especially when distributed across multiple edge nodes.
Innovation Solution
A system where a separate firewall remains stateless and does not monitor user activity or dynamically implement rules, while a destination server or another computing device monitors traffic, detects patterns, and sends commands to the firewall to implement rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the firewall monitors user activity and dynamically implements rules, then the security and adaptability are improved, but the device complexity and resource requirements increase significantly
Solution Approach 1:
The patent introduces a server as an intermediary component that handles the complex tasks of monitoring user activity, detecting patterns, and dynamically generating firewall rules. The firewall itself remains relatively simple, executing rules provided by the server. This mediator architecture allows the system to achieve high security and adaptability while keeping the firewall device complexity manageable.
2Adaptability or versatility
If the firewall tracks user activity and maintains state information, then the ability to detect patterns and implement dynamic rules is improved, but the stateless property and processing efficiency are lost
Solution Approach 1:
The patent extracts the state maintenance and pattern detection functionality from the firewall and places it on a separate server. The firewall is reduced to executing predefined rules, maintaining its stateless property and processing efficiency. The server handles the complex tasks of tracking user activity across multiple requests and detecting patterns that warrant dynamic rule implementation.
3Device complexity
If the destination server implements the firewall function, then the system complexity is reduced, but the computational resources and security benefits are compromised
Solution Approach 1:
The patent segments the firewall functionality into two parts: the rule execution component remains on the firewall device, while the rule generation and monitoring components are placed on a separate server. This segmentation allows the destination server to avoid the overhead of implementing firewall functions, preserving its computational resources for backend business logic while still enabling dynamic rule implementation through the intermediary server.
Data Source
AI summary
There may be situations in which it is desirable to dynamically implement a rule on the firewall in response to detecting a particular pattern of user activity. However, the software code required for tracking user activity, identifying patterns of user activity, and deciding what action to take may be relatively complex. Deploying such software code on a firewall increases the complexity of the firewall. For example, the firewall can no longer be “stateless”. In some embodiments, the destination server works in combination with the firewall. The destination server monitors traffic to determine particular patterns of user activity. In response to a particular pattern of user activity being detected, an appropriate rule is established and the firewall is sent a command to implement the rule.