Object-Level Network Traffic Inspection for HTTP/2 Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security devices face challenges in inspecting HTTP/2 network traffic at the connection level, leading to the re-introduction of the head-of-line blocking problem and potential disallowance of allowed objects due to disallowed items within a connection, which reduces communication efficiency compared to HTTP/1.1.
Innovation Solution
A security device maintains identical communication states for both endpoint devices and modifies stream identifiers of individual objects before retransmission to maintain ordering, using a mapping to ensure responses are correctly routed, allowing for parallel inspection and selective blocking of disallowed objects without affecting others in the connection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If connection-level inspection is performed in HTTP/2 traffic, then security inspection coverage is improved, but head-of-line blocking problem re-introduces reducing communication efficiency
Solution Approach 1:
The patent segments the inspection process from the connection level to the object level. Instead of inspecting the entire connection sequentially, it inspects individual objects (URLs, files, etc.) independently. This allows parallel inspection of multiple objects within a single connection, eliminating head-of-line blocking while maintaining security coverage. The security device processes each object separately, allowing faster objects to be delivered without waiting for slower objects.
Solution Approach 2:
The patent introduces a new dimension of inspection granularity by moving from connection-level inspection to object-level inspection. This dimensional change allows the system to maintain multiple inspection states simultaneously for different objects within the same connection, enabling parallel processing and eliminating the sequential bottleneck that caused head-of-line blocking.
2Reliability
If connection-level inspection is performed, then security policy enforcement is improved, but disallowed objects block all remaining objects in the connection
Solution Approach 1:
The patent divides the connection into independent object-level inspection units. Each object is inspected separately with its own security evaluation, allowing selective blocking of only the disallowed objects while permitting allowed objects to pass through. This segmentation prevents a single disallowed object from blocking the entire connection, improving overall object delivery rate while maintaining security policy enforcement.
3Productivity
If multiple connections are opened to avoid head-of-line blocking in HTTP/1.1, then parallel operations are enabled, but server load increases and TCP speed is reduced
Solution Approach 1:
Instead of creating multiple connections (horizontal scaling) to achieve parallel operations, the patent changes the inspection dimension from connection-level to object-level within a single connection. This vertical scaling approach enables parallel inspection and delivery of multiple objects within one connection, achieving the benefits of parallel operations without increasing server load or reducing TCP efficiency.
Data Source
AI summary
A method, system, and computer-usable medium are disclosed for, responsive to establishment of a connection between a first endpoint device and a second endpoint device: maintaining, by a security device interfaced between the first endpoint device and the second endpoint device for inspecting traffic transmitted over the connection, a first communication state to be identical to a communication state of the first endpoint device; and maintaining, by the security device, a second communication state to be identical to a communication state of the second endpoint device; and responsive to transmission of traffic from the first endpoint and intended for the second endpoint: inspecting individual objects of the traffic; modifying stream identifiers of the individual objects prior to retransmission of the traffic to the second endpoint to maintain ordering of stream identifiers as seen by the second endpoint; and maintaining a mapping of the modified stream identifiers such that the mapping is used by the security device such that responses transmitted by the second endpoint in response to the objects transmitted by first endpoint device are modified to their original stream identifiers of the objects transmitted by first endpoint device.