Load Balancer Intrusion Detection via Local Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional load balancers cannot perform intrusion detection on encrypted data packets, which compromises network security and increases computational burden, as they require decryption and re-encryption, exposing the network to security risks and violating service level agreements.
Innovation Solution
A load balancer host is controlled to decrypt data packets, perform intrusion detection, and re-encrypt them within the same host, maintaining encryption throughout the network, thereby integrating load balancing and intrusion detection without exposing decrypted packets to the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional load balancers forward encrypted data packets without decryption, then network security and service level agreement compliance are maintained, but intrusion detection cannot be performed on the traffic content
Solution Approach 1:
The patent introduces an intrusion detection system as an intermediary component that receives copies of encrypted data packets from the load balancer, performs decryption using stored certificates, and conducts intrusion detection on the decrypted content. This intermediary approach allows intrusion detection without requiring the load balancer itself to decrypt traffic, thereby maintaining the security architecture while enabling content inspection.
2Difficulty of detecting and measuring
If load balancers decrypt and re-encrypt data packets to perform intrusion detection, then intrusion detection capability is improved, but computational burden increases and security risks arise from exposing decrypted packets
Solution Approach 1:
The intrusion detection system operates as a separate intermediary component rather than integrating decryption functionality into the load balancer. This separation ensures that decrypted packets are never exposed on the network - they remain confined within the intrusion detection system's secure environment, eliminating the security risk of exposed decrypted traffic while reducing the computational burden on the load balancer.
Solution Approach 2:
The system segments the intrusion detection functionality into a separate component from the load balancer. The load balancer handles only encrypted packet forwarding, while the intrusion detection system independently handles decryption and analysis. This segmentation distributes computational burden and eliminates the security vulnerability of exposing decrypted packets.
3Difficulty of detecting and measuring
If separate computing nodes are used for intrusion detection, then intrusion detection functionality is added, but network bandwidth is consumed and hardware costs increase
Solution Approach 1:
The patent merges the intrusion detection system with the load balancer host, allowing both functions to coexist on the same physical infrastructure. The intrusion detection system receives copies of packets locally and performs decryption and analysis without requiring separate network transmission to distant computing nodes. This merging reduces network bandwidth consumption and consolidates hardware resources while maintaining full intrusion detection capability.
Data Source
AI summary
Systems, methods, and other embodiments associated with performing intrusion detection on load balanced network traffic are described. In one embodiment, a method includes receiving, at a load balancer host, an encrypted data packet from a remote computer. A certificate established between the remote computer and a destination service being accessed by the remote computer is used by the load balancer host to decrypt the encrypted data packet to create an unencrypted data packet. The unencrypted data packet is routed to an intrusion detection system at the load balancer host. The intrusion detection system is controlled to execute intrusion detection upon the unencrypted data packet. A secure connection is established with the destination computing node. The unencrypted data packet is re-encrypted and transmitted over the network using the secure connection to the destination computing node.