Network Traffic Hub Extracts Encryption Metadata to Block Malicious Connections

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Smart appliances are vulnerable to security breaches due to limited computing resources and inability to install anti-virus software, making it difficult to detect malicious behavior, especially when communicating via encrypted connections.

Innovation Solution

A network traffic hub passively inspects encrypted communications between smart appliances and remote servers, extracting encryption metadata to detect malicious behavior using a machine-learned threat detection model, which can block malicious traffic without modifying the communication packets and adapt to new threats.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If deep packet inspection is used to analyze traffic content for malicious behavior, then detection capability is improved, but system resource consumption and communication latency increase

Engineering Contradiction:

Improvedetection capabilityVSAvoidsystem resource consumption

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The patent extracts only the necessary encryption metadata (cipher suite, protocol version, certificate information) from the encrypted traffic instead of performing full deep packet inspection. This extraction approach enables malicious behavior detection while minimizing system resource consumption by avoiding analysis of the entire packet content.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The inspection process is segmented into two parts: (1) extracting lightweight metadata from encrypted packets without decryption, and (2) analyzing only this extracted metadata for malicious patterns. This segmentation avoids the resource-intensive full packet inspection while maintaining detection capability.

Inventive Principle:

Principle #1Segmentation

2Measurement precision

If deep packet inspection is used to analyze traffic content for malicious behavior, then detection capability is improved, but communication latency increases

Engineering Contradiction:

Improvedetection capabilityVSAvoidcommunication latency

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

Inventive Principle:

Principle #1Segmentation

3Reliability

If encryption is used to protect smart appliance communications, then security is improved, but vulnerability to malicious code increases due to inability to inspect encrypted traffic

Engineering Contradiction:

ImprovesecurityVSAvoidvulnerability to malicious code

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces an intermediary inspection mechanism that observes encryption metadata without decrypting the actual communication content. This intermediary approach maintains the security benefits of encryption while enabling detection of malicious patterns in the metadata, thus reducing vulnerability to malicious code.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent applies different inspection qualities to different parts of the communication: full encryption is maintained for the actual data payload, while selective metadata fields (cipher suite, protocol version, certificate info) are extracted and inspected for malicious patterns. This local differentiation maintains security while enabling detection.

Inventive Principle:

Principle #3Local quality

4Reliability

If anti-virus software is installed on smart appliances, then protection capability is improved, but device complexity and resource requirements increase

Engineering Contradiction:

Improveprotection capabilityVSAvoiddevice complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent moves the security inspection function from the smart appliance itself to an external network device or gateway. This intermediary approach provides anti-virus protection capability without increasing the complexity or resource requirements of the smart appliance, as the inspection occurs in the network infrastructure rather than on the appliance.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11176459B2Extracting encryption metadata and terminating malicious connections using machine learning

Publication Date: 2021.11.16 CUJO LLC

AI summary

A network traffic hub extracts encryption metadata from messages establishing an encrypted connection between a smart appliance and a remote server and determines whether malicious behavior is present in the messages. For example, the network traffic hub can extract an encryption cipher suite, identified encryption algorithms, or a public certificate. The network traffic hub detects malicious behavior or security threats based on the encryption metadata. These security threats may include a man-in-the-middle attacker or a Padding Oracle On Downgraded Legacy Encryption attack. Upon detecting malicious behavior or security threats, the network traffic hub blocks the encrypted traffic or notifies a user.