Three-Stage Network Security Policy Enforcement via Reconciliation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing network security technologies lack comprehensive validation mechanisms, allowing unauthorized communications due to limited visibility into application identities and network information, making them vulnerable to spoofing and policy violations.

Innovation Solution

A three-stage validation process involving local security agents on source and destination systems and a reconciliation engine to validate connections against local and master policies, ensuring secure communication without altering the applications or network traffic.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Loss of information

If host-based firewalls monitor connections at egress or ingress points, then directional access control is achieved, but visibility into application identities and network information is limited

Engineering Contradiction:

Improvevisibility into application identitiesVSAvoidsecurity validation mechanism

Core Design Contradiction:

Loss of informationVSDevice complexity

Solution Approach 1:

The validation system is segmented into three distinct stages: local validation at source host, local validation at destination host, and reconciliation validation. Each stage operates independently with specific responsibilities, allowing comprehensive application identity verification without requiring a single complex centralized system.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The reconciliation engine acts as an intermediary component that receives validation results from both source and destination local security agents, compares them against master policies, and makes the final authorization decision. This mediator enables comprehensive validation while distributing complexity across multiple components.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If existing security technologies operate in relative isolation with limited information, then device simplicity is maintained, but policy violations and spoofing attacks are not detected

Engineering Contradiction:

Improvedetection of policy violationsVSAvoidsecurity validation mechanism

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system merges validation capabilities from both source and destination hosts into a unified three-stage process. Local security agents at both ends collect application identity information and network context, which are then combined and validated together by the reconciliation engine, enabling detection of spoofing and policy violations that single-point systems cannot detect.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The reconciliation engine receives feedback from both local security agents regarding connection attempts and validation results. This feedback mechanism allows the system to continuously verify application identities against master policies and adjust authorization decisions based on real-time validation information from both ends of the communication.

Inventive Principle:

Principle #23Feedback

3Reliability

If comprehensive validation against master policies is implemented, then security against spoofing is improved, but validation time and processing overhead increase

Engineering Contradiction:

Improvesecurity validation accuracyVSAvoidconnection validation time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

Local security agents perform preliminary validation of application identities and network information against locally cached master policies before the reconciliation stage. This preliminary action filters out obviously unauthorized connections early, reducing the burden on the reconciliation engine and minimizing overall validation time while maintaining comprehensive security checks.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS10154067B2Network application security policy enforcement

Publication Date: 2018.12.11 ZSCALER INC

AI summary

A system validates the establishment and/or continuation of a connection between two applications over a network using a three-stage process: (1) a local security agent on the same source system as the source application validates the connection against a set of policies stored locally on the source system; (2) a local security agent on the same destination system as the destination application validates the connection against a set of policies stored locally on the destination system; and (3) a reconciliation engine, after receiving connection and application state information from both the source and destination local security agents, validates the connection against a master set of policies. The connection is allowed or blocked depending on the outcome of the three-stage validation. This system protects against policy violations that are not detected by traditional systems without requiring alterations to the source and destination applications or the network traffic between them.