Mid-Link Traffic Mediation for Secure Remote Web Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Maintaining security and control over remote access to networks is challenging, especially when employees access web sites from outside a local area network, as user-owned devices like cell phones and tablets make mediating web interactions difficult, and existing filtration technologies can be easily bypassed.
Innovation Solution
A controlled content system using a mid-link server that mediates network packet traffic through a third-party application, employing policies and algorithms to determine when to redirect traffic, and includes a mediation switch and inspection component to enforce policy-based routing and content mediation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If employees access web sites from outside the local area network, then remote access flexibility is improved, but security and control deteriorate
Solution Approach 1:
The patent introduces a gateway server as an intermediary between the remote device and external web sites. The gateway server mediates all network traffic, inspecting and controlling packets according to organizational policies. This allows employees to access web sites remotely while maintaining security through centralized policy enforcement at the gateway, resolving the contradiction between remote access flexibility and security control.
2Adaptability or versatility
If user owned devices such as cell phones and tablets are used, then device accessibility is improved, but ease of mediating web interactions deteriorates
Solution Approach 1:
The gateway server acts as a mediator between user-owned devices and web sites. It intercepts traffic from diverse devices (cell phones, tablets, PCs) and applies uniform mediation policies regardless of device type. This approach maintains ease of operation by centralizing mediation logic at the gateway, eliminating the need to adapt mediation mechanisms to each specific device platform.
Solution Approach 2:
The gateway server provides universal mediation capabilities that work across all device types. By implementing a device-agnostic architecture, the system can mediate web interactions from any user-owned device through a single unified platform, making the mediation process equally easy to operate regardless of the accessing device.
3Reliability
If existing filtration technologies are used, then content control is improved, but ease of bypassing deteriorates
Solution Approach 1:
The gateway server positions itself as a mandatory intermediary in the network path, forcing all traffic to flow through it. This architectural approach prevents bypassing because the gateway controls the network routing at the infrastructure level, not just at the application level. Users cannot easily circumvent the filtration by changing applications or devices, as the gateway mediates at the network packet level.
Solution Approach 2:
The patent moves content control from the application layer to the network layer, adding a new dimension of control. By implementing filtration and mediation at the network packet level rather than within specific applications or browsers, the system creates a more robust control mechanism that is difficult to bypass, as it operates independently of user-facing software.
4Reliability
If traffic is redirected to filtered or mediated versions of web sites, then corporate control is improved, but user experience deteriorates
Solution Approach 1:
The gateway server applies differentiated mediation to different types of traffic and users. It can allow unrestricted access for certain users or traffic types while applying strict mediation to others. This localized quality control allows the system to maintain good user experience for appropriate traffic while enforcing corporate control where needed, resolving the contradiction between control and user experience.
Solution Approach 2:
The gateway implements selective mediation rather than universal blocking. It applies mediation only to specific traffic types or users that require control, while allowing other traffic to pass through with minimal intervention. This partial action approach maintains corporate control over sensitive content while preserving user experience for legitimate business-related web access.
Data Source
AI summary
A controlled content system for providing a controlled and contained environment that is remotely accessible is disclosed. A third-party application on the end user device is modified to allow certain sites and services to be mediated in a mid-link server. The app uses policies to know when to access the mid-link server for the controlled and contained environment. Policies can specify the type of processing performed on the mid-link server. Some embodiments support the app selectively using the mid-link server for mediated sites and services. A mediation switch of a mediated program of the third-party application determines whether the network packet traffic is mediated through a mid-link server using the policy cache. The mediation switch includes algorithms that determines the mediated network packet traffic based on one or more parameters.