Network Appliance Proxy Session Identifier Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network appliances struggle to associate encrypted communications from a client device with decrypted communications from a network tool, due to the use of different IP addresses, which prevents correct routing of encrypted communications back to the client device.
Innovation Solution
A network appliance intercepts data streams between a client device and a server, transmits them to a network tool for analysis, and uses a session identifier to associate the tool's responses with the original data streams, ensuring correct routing and encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If the network appliance decrypts and transmits communications to a network tool for analysis, then the network tool can analyze encrypted data, but the network appliance cannot associate the tool's responses with the original communications due to different IP addresses
Solution Approach 1:
The patent introduces a proxy device as an intermediary between the network appliance and the network tool. The proxy device receives encrypted communications from the network appliance, decrypts them, forwards them to the network tool for analysis, and then forwards the tool's responses back to the network appliance. This intermediary structure allows the network appliance to maintain communication association accuracy while the network tool can analyze encrypted data, resolving the contradiction between information loss and device complexity.
2Reliability
If the network appliance uses a different IP address for the network tool than the original client device, then the network tool can perform analysis, but the network appliance cannot generate correct encrypted communications to transmit to the server
Solution Approach 1:
The proxy device serves as a mediator that handles the IP address discrepancy. It receives communications from the network appliance using the appliance's IP address, translates them to use the network tool's IP address for analysis, and then translates the tool's responses back to the original client device's IP address. This intermediary translation layer ensures communication routing reliability while maintaining ease of operation by abstracting away the IP address complexity.
Solution Approach 2:
The patent creates a copy of the communication flow through the proxy device. Instead of directly routing communications between the network appliance and the network tool using different IP addresses, the proxy device creates a copied communication path that preserves the original IP address mappings. This copying approach allows the network appliance to generate correct encrypted communications while the network tool performs analysis using its own IP address.
3Loss of information
If the network appliance intercepts and decrypts SSL-encrypted communications, then it can analyze the data, but it cannot correctly route the decrypted responses back to the original client device
Solution Approach 1:
The proxy device acts as an intermediary that manages the data stream association between the network appliance, network tool, and original client device. It maintains mapping information that associates the decrypted data streams from the network appliance with the original encrypted communications from the client device. This allows the proxy to correctly route responses back to the original client while the network appliance can analyze the decrypted data, resolving the contradiction between data stream association accuracy and device complexity.
Data Source
Figure 1~2
Figure 3A
Figure 3B
AI summary
A network appliance stores a session identifier that uniquely identifies a network communication session between a first device and the network appliance. A first communication is received from the first device over the network communication session. The network appliance also receives from a proxy tool, a second communication that includes a header specifying the session identifier and that includes data generated by the proxy in response to the first communication. The network appliance associates the first communication with the second communication using the session identifier. An encrypted representation of the data generated by the proxy is transmitted to a second device based on the association between the first communication and the second communication.