Security Device Padding Threshold Inspection Logic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security devices may allow malicious data to bypass inspection by using padding to exceed the maximum inspected data threshold, enabling unauthorized access to networks.
Innovation Solution
A security device determines the amount of padding in a traffic flow and performs offloading only if the padding satisfies a threshold, otherwise inspecting the entire flow to prevent malicious data from being missed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If offloading is performed for traffic flows with padding exceeding the threshold, then inspection speed is improved, but security reliability deteriorates as malicious data may be overlooked
Solution Approach 1:
The patent changes the parameter being monitored from total traffic flow size to specifically the padding portion size. By comparing padding size against a threshold, the system dynamically adjusts inspection behavior: flows with excessive padding are fully inspected while others use offloading. This parameter-based differentiation resolves the contradiction by enabling speed optimization only when padding (not actual data) occupies the threshold space.
2Reliability
If the entire traffic flow is inspected, then security reliability is improved, but inspection speed deteriorates due to processing overhead
Solution Approach 1:
The patent applies partial inspection (offloading) to traffic flows that do not exhibit suspicious characteristics (excessive padding). For these flows, inspecting only a portion (using offloading techniques) is sufficient to maintain security while improving speed. Full inspection is reserved for flows with excessive padding, which are suspected of containing malicious data. This partial action approach resolves the contradiction by applying the more intensive inspection only when necessary.
3Productivity
If offloading is used to speed up inspection, then productivity is improved, but measurement precision deteriorates as malicious patterns may be missed
Solution Approach 1:
The patent performs a preliminary action by measuring the padding size before deciding on the inspection method. This preliminary measurement of padding (not the entire flow) allows the system to quickly categorize traffic flows and apply appropriate inspection strategies. Flows with excessive padding are identified early and routed to full inspection, while others proceed with faster offloading. This preliminary action resolves the contradiction by enabling productivity improvement through pre-screening without sacrificing detection precision for suspicious flows.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
In some implementations, a security device may receive a traffic flow. The security device may determine an amount of a padding included in the traffic flow. The security device may determine whether the amount of the padding included in the traffic flow satisfies a padding threshold. The security device may perform, based on the amount of the padding satisfying the padding threshold, offloading for the traffic flow. The security device may inspect, based on the amount of the padding failing to satisfy the padding threshold, an entire portion of the traffic flow.