ICAP Server Request-Response Pair Matching in Cloud Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud-based environments, Intrusion Prevention Systems (IPS) face difficulties in identifying and matching HTTP request/response pairs due to the presence of multiple ICAP servers handling network traffic, leading to diminished security analysis effectiveness.
Innovation Solution
A method and system that collect network traffic by receiving responses and identifying information in headers to access request portions, creating custom headers, and storing or retrieving request files to facilitate matching and security analysis across multiple servers in cloud-based environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple ICAP servers handle network traffic in a distributed cloud-based environment, then network traffic can be processed in parallel and system capacity is increased, but the ability to match HTTP request/response pairs deteriorates because different servers handle different parts of the same transaction
Solution Approach 1:
The patent segments the request handling process by extracting and embedding only the essential matching information (URL, method, headers) into a compact representation that can be carried through the distributed ICAP server infrastructure. This segmentation allows different servers to handle different parts of the traffic while maintaining the ability to reassemble complete request/response pairs for security analysis.
Solution Approach 2:
The patent introduces an intermediary mechanism where a compact representation of the request (including URL, method, and relevant headers) is embedded in the ICAP request data. This intermediary carries the essential matching information between different ICAP servers, enabling them to coordinate and match requests with responses even when distributed across multiple servers.
2Use of energy by moving object
If an ICAP server multiplexes network traffic from multiple clients and web servers over a single network connection, then network resource utilization is improved, but the ability to match HTTP requests with corresponding responses deteriorates due to traffic interleaving
Solution Approach 1:
The patent applies local quality by embedding specific matching information (URL, method, headers) directly into the ICAP request data structure at the point where the request is received. This localized embedding ensures that each multiplexed request carries its own identification information, allowing the ICAP server to correctly match responses to requests even when multiple traffic streams are interleaved over a single connection.
3Reliability
If the entire HTTP request is embedded in the ICAP request data, then complete request information is available for security analysis, but network bandwidth consumption increases
Solution Approach 1:
The patent extracts only the essential matching information (URL, method, and relevant headers) from the complete HTTP request and embeds this compact representation in the ICAP request data. This extraction approach provides sufficient information for security analysis and request/response matching while minimizing the additional bandwidth consumption that would result from embedding the entire request.
Data Source
AI summary
The disclosed computer-implemented method for performing security analyzes on network traffic in cloud-based environments may include (1) collecting network traffic exchanged between a source device and a destination device for a security analysis by (A) receiving, from the destination device, a response to a request sent by the source device, (B) identifying, in a header of the response, information that facilitates access to at least a portion of the request, and (C) obtaining, based at least in part on the information identified in the header of the response, the portion of the request sent by the source device, and then (2) performing the security analysis on the network traffic by analyzing the portion of the request sent by the source device and at least a portion of the response. Various other methods, systems, and computer-readable media are also disclosed.