Perimeter-Based Packet Filtering for Split Tunneling Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multiple forwarding information base (MFIB) systems, existing technologies face challenges in effectively filtering network packets to prevent split tunneling and ensure secure communication between different perimeters within a virtual private network (VPN), particularly when the binding interface and IPsec interface are in different perimeters.
Innovation Solution
The implementation of a method that determines the perimeter assignment for communication sessions using a forwarding information base (FIB) to filter packets, ensuring that packets are routed through a VPN tunnel and preventing direct access to the binding interface by applying filtering rules based on the perimeter assignments of the binding and IPsec interfaces, thereby preventing split tunneling.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If packet filtering is implemented to prevent split tunneling, then security is improved, but device complexity increases
Solution Approach 1:
The patent divides the forwarding information base into multiple separate FIBs, with each FIB associated with a specific perimeter. This segmentation allows independent filtering rules to be applied to each perimeter, preventing split tunneling while maintaining manageable complexity through modular organization of routing data.
Solution Approach 2:
The patent introduces a perimeter determination mechanism that acts as an intermediary between packet routing and filtering operations. This intermediary determines which perimeter a packet belongs to based on the binding interface, enabling targeted filtering without requiring complex global analysis of all routing decisions.
2Adaptability or versatility
If multiple forwarding information bases are used to manage different perimeters, then adaptability is improved, but device complexity increases
Solution Approach 1:
The patent segments the routing system into multiple FIBs, each dedicated to a specific perimeter (e.g., enterprise perimeter, personal perimeter). This segmentation provides adaptability by allowing independent configuration and management of each perimeter's routing rules, while the modular structure prevents overwhelming complexity through clear separation of concerns.
Solution Approach 2:
The patent creates a universal perimeter determination mechanism that works across all FIBs and perimeters. This multi-functional approach allows the same filtering and routing logic to be applied consistently across different perimeters, improving adaptability without proportionally increasing complexity through reuse of core components.
3Productivity
If direct routing to binding interface is allowed, then productivity is improved, but security deteriorates
Solution Approach 1:
The patent introduces perimeter determination as an intermediary step between packet reception and routing to the binding interface. This intermediary evaluates the packet's perimeter context and applies appropriate filtering rules, ensuring security requirements are met while still allowing direct routing paths for authorized traffic, thus balancing productivity and security.
Solution Approach 2:
The patent applies different routing and filtering qualities to different perimeters locally. For example, enterprise perimeter traffic may require strict filtering through the VPN tunnel, while personal perimeter traffic may be allowed more direct paths. This local differentiation maintains security where needed while preserving productivity where appropriate.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In some implementations, a method for routing communication includes determining a binding interface for a communication session based on a forwarding information base (FIB) and a destination for the communication session. The communication session is from an application running on user equipment (UE), and the binding interface is included in a virtual private network (VPN) tunnel established through an Internet Protocol (IP) security (IPsec) interface. Whether to filter the communication session is determined based on which perimeter of the UE includes the binding interface and which perimeter of the UE includes the IPsec interface.