Firewall Connection State Machine and Buffer for Data Leakage Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional firewalls are inadequate in preventing data leakage during connection establishment, as they allow initial data to cross the firewall before determining if the connection is permitted, which is undesirable in today's complex internet traffic environment.
Innovation Solution
A system that uses a connection state machine and buffer to inspect the initial data stream, allowing the connection to be established before policy determination, and employs named sockets to separate service identity from port numbers, enabling proactive and predictive risk assessment and reducing data leakage by applying pre-agent checks and potentially handing off connections to proxies for further inspection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If the firewall allows the connection to be established before policy determination, then the connection establishment speed is improved, but data leakage occurs before the firewall can inspect and block unauthorized traffic
Solution Approach 1:
The firewall performs preliminary policy checks and content inspection during the connection establishment phase, before allowing data to pass through. The system inspects the initial portion of the data stream and determines policy compliance in advance, preventing data leakage while maintaining connection speed.
Solution Approach 2:
The patent introduces an intermediary inspection mechanism that sits between the connection establishment process and data transmission. This intermediary layer inspects content without allowing unauthorized data to leak, resolving the contradiction between speed and security.
2Reliability
If the firewall inspects content to prevent data leakage, then security is improved, but data still crosses the firewall to the destination before the connection can be terminated
Solution Approach 1:
The firewall performs content inspection and policy determination in advance, during the connection establishment phase, before any substantial data transfer occurs. This preliminary action ensures that if the connection is later terminated due to policy violations, no significant data has already reached the destination.
Solution Approach 2:
The system rushes through the inspection and policy determination process during connection establishment, completing security checks before data transmission begins, thereby minimizing the window for data leakage.
3Measurement precision
If the firewall performs fine-grained inspection of web applications and users, then the precision of security policy enforcement is improved, but the complexity of the firewall system increases
Solution Approach 1:
The firewall system is segmented into specialized modules that handle different aspects of inspection: connection state machine for connection management, buffer for data buffering, pre-agent check for initial policy verification, and proxy for deep content inspection. This segmentation allows fine-grained inspection while managing system complexity through modular design.
Solution Approach 2:
The patent introduces named sockets and proxy mechanisms as intermediaries that facilitate fine-grained inspection without requiring the core firewall system to become overly complex. These intermediaries handle the detailed inspection tasks while maintaining a cleaner architecture.
Data Source
AI summary
System and methods for connection processing with limited data leakage. The system records state associated with a connection request in a connection state engine, records state associated with a connection acknowledgement in the connection state engine, stores data sent after the connection acknowledgement in a buffer and determines, without a proxy, whether to allow or deny a connection as a function of the data stored in the buffer.