Host-Based Network Socket Security Controls
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network security technologies are packet-focused, which can lead to delayed detection and mitigation of threats, as they inspect packets after they are created or received, whereas threats can be more effectively managed by controlling network socket creation at the socket level before packet formation.
Innovation Solution
Implementing a system that operates at the socket level to control network socket creation and usage by collecting telemetry data from host devices and using it to enforce policies for socket creation, allowing or blocking socket creation based on predefined policies, and updating these policies dynamically based on analyzed data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If conventional packet-level security inspection is used, then network traffic can be monitored and filtered, but threat detection is delayed until after packets are created or received
Solution Approach 1:
The patent implements preliminary action by intercepting and inspecting network sockets at the moment of creation, before any packets are formed. The security system hooks into the operating system's socket creation API, allowing it to examine and block potentially malicious connections before they can transmit any data. This proactive approach eliminates the time delay inherent in traditional packet inspection methods.
2Reliability
If socket-level control is implemented, then early threat prevention is achieved, but the security system becomes more complex
Solution Approach 1:
The patent employs an intermediary approach by introducing a security layer that sits between the application layer and the operating system's network stack. This intermediary security module intercepts socket creation requests, applies security policies, and either allows or blocks the socket formation. This mediator architecture provides comprehensive control without requiring fundamental changes to the underlying operating system or applications.
3Measurement precision
If comprehensive telemetry collection is performed, then security policy accuracy is improved, but data processing requirements increase
Solution Approach 1:
The patent applies the extraction principle by isolating telemetry data collection and analysis functions into a separate, dedicated security module. This extracted component focuses specifically on gathering network socket information, analyzing patterns, and generating security policies, while leaving the main operating system and application processes unchanged. This separation allows for precise security measurements without burdening the entire system with excessive processing requirements.
Data Source
AI summary
An electronic device includes a network communications interface, a processor, and a memory configured to store instructions that, when executed by the processor, cause the processor to instantiate a set of processes; receive, over a network and via the network communications interface, a policy for network socket creation; receive, from the set of processes, a set of requests to create a first set of network sockets used to communicate over the network via the network communications interface; collect telemetry pertaining to a second set of network sockets used to communicate over the network via the network communications interface; allow or block creation of network sockets in the first set of network sockets, in accordance with the collected telemetry and the policy for network socket creation; and transmit at least part of the collected telemetry to a controller, over the network and via the network communications interface.