Network Connection Interception with User-Space Response Holding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security solutions experience delays in authorizing outgoing connections due to lengthy responses from external services, deteriorating user experience.
Innovation Solution
A network apparatus intercepts connection requests, extracts target identifiers, and initiates a reputation request to a web resource analyzer while holding the response in user-space memory, releasing it based on the analyzer's response or a timer expiration, thereby minimizing wait time and ensuring efficient resource security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If outgoing connections are authorized by an external service to check reputation, then network security is improved, but the response time increases and user experience deteriorates
Solution Approach 1:
The patent implements a caching mechanism that stores reputation information from external services in advance. When a connection request is made, the system first checks the local cache for pre-fetched reputation data, allowing authorization decisions to be made without waiting for real-time external service responses. This preliminary action of caching reputation data resolves the contradiction by maintaining security checks while eliminating wait time for users.
2Measurement precision
If the system waits for external service responses to authorize connections, then accurate security decisions are made, but connection establishment is delayed
Solution Approach 1:
The system performs preliminary fetching and caching of reputation information before it is actually needed for authorization decisions. This allows the system to maintain high measurement precision for security decisions while achieving fast connection establishment speeds, as the reputation data is already available in the cache when connection requests are processed.
Solution Approach 2:
The patent changes the temporal parameter of reputation data availability by implementing periodic updates and caching mechanisms. Instead of real-time external service calls for each connection request, the system uses pre-fetched and cached reputation parameters, transforming the authorization process from synchronous external dependency to asynchronous local decision-making, thereby improving connection speed while maintaining decision accuracy.
3Reliability
If the system implements comprehensive reputation checking, then security coverage is improved, but resource consumption increases
Solution Approach 1:
The patent implements a layered security architecture where reputation checking is applied selectively based on local conditions. The system maintains a local cache of reputation information and only performs comprehensive external service checks when necessary (e.g., cache misses, expired entries). This local quality approach ensures comprehensive security coverage while reducing resource consumption by avoiding redundant external service calls for commonly accessed resources.
Data Source
Figure 1
Figure 2A
Figure 2B~3
AI summary
A network apparatus receives a connection request from a client computing device toward a target computing device. Next a target identifier that identifies the target computing device is extracted from the connection request. The connection request is sent to the target computing device and a reputation request with the target identifier is sent to a web resource analyser engine. In response to detecting that a response from the target computing device is received before a response from the web resource analyser engine, the response to the connection request from the target computing device is held by performing a rewrite in a target section of a user-space utility program rule and by using operating system kernel module in user-space memory area of the network apparatus. In response to a receipt of the response from the web resource analyser engine, the response to the connection request is released.