Network Traffic Monitoring Using Signed URL Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Lawful interception of network traffic often fails due to unavailability of content destination devices, leading to undetected and unaddressed fraudulent or dangerous activities, and wastage of computing resources.
Innovation Solution
A network device performs flow tapping by sending a traffic flow copy to a signed uniform resource locator (URL) platform instead of a content destination device, using a flow-tap filter to identify and process traffic flows associated with specific characteristics, ensuring availability and reliability of the traffic flow copy for analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If flow tapping is performed to content destination devices, then network traffic can be intercepted for analysis, but the traffic flow copy becomes unavailable when destination devices are unavailable
Solution Approach 1:
The patent introduces a mediation device as an intermediary between the network device and the ultimate analysis system. The mediation device receives the signed URL, manages the traffic flow copy storage, and handles authentication, eliminating the direct dependency on content destination devices while maintaining reliable access to traffic flow copies.
Solution Approach 2:
The system creates a copy of the traffic flow and stores it on the signed URL platform, decoupling the interception function from the analysis function. This allows the traffic flow copy to be independently available regardless of the status of analysis devices.
2Productivity
If traditional flow tapping methods are used, then traffic can be monitored, but computing resources are wasted when destination devices are unavailable
Solution Approach 1:
The system performs preliminary actions by pre-storing the traffic flow copy on the signed URL platform and pre-configuring the mediation device with authentication credentials. This allows analysis to begin immediately when needed without wasting resources on unavailable destination devices.
Solution Approach 2:
The system implements feedback mechanisms where the mediation device monitors the availability and status of analysis systems, dynamically managing traffic flow copy delivery to ensure resources are only consumed when analysis can actually proceed.
3Reliability
If signed URL platform is used for traffic flow storage, then traffic flow copy availability is improved, but system complexity increases
Solution Approach 1:
The signed URL platform is designed to perform multiple functions: storing traffic flow copies, managing authentication, handling device registration, and coordinating with mediation devices. This multi-functionality reduces the need for separate specialized components, managing system complexity while improving reliability.
Data Source
AI summary
A network monitoring device may receive flow-tap information that identifies a traffic flow characteristic and a signed URL associated with a signed URL platform from a mediation device. The network device may map the traffic flow characteristic to the signed URL in an entry of a flow-tap filter that is maintained within a data structure of the network device. The network device may analyze, using the flow-tap filter, network traffic of the network to detect a traffic flow that is associated with the traffic flow characteristic. The network device may generate, based on detecting the traffic flow in the network traffic, a traffic flow copy that is associated with the traffic flow. The network device may provide, based on the signed URL, the traffic flow copy to the signed URL platform, wherein the traffic flow copy is to be accessible to an authorized user device via the signed URL.