HTTPS Content Filtering via Virtual IP Intermediary

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

HTTPS transmission protocol encrypts data, making it difficult for gateway devices to filter HTTPS content effectively, as existing technologies lack the capability to decrypt and inspect encrypted communications.

Innovation Solution

An HTTPS content filtering device is implemented, comprising a filtering system with modules for communication, detection, determination, querying, and filtering, which adds virtual IP addresses to domain name resolution results, detects HTTPS support, and forwards requests to HTTPS servers with real IP addresses, enabling filtering of HTTPS content between clients and servers.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If HTTPS encryption is used to protect data transmission, then data security is improved, but gateway devices lose the ability to filter content

Engineering Contradiction:

Improvedata securityVSAvoidcontent filtering capability

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent introduces a gateway device as an intermediary that terminates HTTPS connections from clients, decrypts the encrypted content, filters the decrypted data, and then forwards filtered content to the origin server. This mediator approach allows the gateway to inspect and filter HTTPS content while maintaining the security benefits of encryption for the client-gateway link.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent segments the HTTPS connection into two separate connections: one between the client and gateway (encrypted), and another between the gateway and origin server (unencrypted or separately encrypted). This segmentation allows the gateway to access and filter content in the unencrypted portion while maintaining security where needed.

Inventive Principle:

Principle #1Segmentation

2Device complexity

If real IP addresses are used for HTTPS servers, then direct communication is simplified, but filtering of encrypted transmissions becomes impossible

Engineering Contradiction:

Improvecommunication simplicityVSAvoidencrypted content inspection

Core Design Contradiction:

Device complexityVSDifficulty of detecting and measuring

Solution Approach 1:

The gateway device acts as an intermediary that receives HTTPS requests from clients using virtual IP addresses, terminates the encrypted connections, and forwards requests to origin servers using real IP addresses. This allows the gateway to inspect and filter content while maintaining simplified communication through virtual IP address mapping.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS9648021B2HTTPS content filtering method and device

Publication Date: 2017.05.09 CLOUD NETWORK TECH SINGAPORE PTE LTD

AI summary

A method for an HTTPS content filtering device includes forwarding a domain name resolution request from a client to a DNS server. One or more virtual IP addresses are generated, which correspond to one or more real IP addresses of a domain name resolution result received from the DNS server. The one or more virtual IP addresses are added to the domain name resolution result and sent to the client. When an HTTPS access request from the client is received, a real IP address corresponding to the virtual target IP address is determined, and the HTTPS access request is sent to an HTTPS server with the obtained real IP address. An HTTPS access result is received and filtered, and the virtual IP address is defined as the resource IP address for sending the filtered HTTPS access result to the client. An HTTPS content filtering device is also provided.