Policy Control Device for Encrypted IoT Traffic Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current communication systems in the 5G/IoT era face challenges in identifying IoT devices when HTTP headers are encrypted, preventing effective network policy control and management in units of devices.
Innovation Solution
A communication system comprising a policy control device and a relay device that utilize tables to associate device types with policy rules and user information, allowing the identification of device types and application of corresponding policy rules even when HTTP headers are encrypted, enabling network policy control and management in device units.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL/TLS protocol is used to encrypt HTTP communication for security, then communication security is improved, but device type identification capability deteriorates
Solution Approach 1:
The patent introduces a relay device as an intermediary between the IoT device and the server. This relay device intercepts encrypted HTTP requests, extracts device type information from the encrypted data without decrypting it, and forwards the request to the server. The PCRF (Policy and Charging Rules Function) then uses this extracted device type information to determine appropriate policy rules. This intermediary approach allows device identification to occur in the encrypted channel, resolving the contradiction between security and identifiability.
2Adaptability or versatility
If device type identification is performed in encrypted HTTP headers, then policy control capability is improved, but system complexity increases
Solution Approach 1:
The relay device serves as a mediator that performs device type extraction from encrypted HTTP requests without requiring full decryption. It extracts identifying features from the encrypted data structure and passes this information to the PCRF. This approach enables sophisticated policy control based on device type while avoiding the complexity of implementing full SSL/TLS termination and decryption at the network level.
Solution Approach 2:
The patent replaces the traditional mechanical approach of decrypting SSL/TLS headers for device identification with an alternative method that extracts device type information from encrypted data patterns. Instead of breaking cryptographic encryption, the system uses feature extraction techniques that work with encrypted data structures, substituting a complex cryptographic operation with a simpler pattern recognition approach.
Data Source
AI summary
A policy and charging rules function (PCRF) stores a policy rule management table in which a policy rule corresponding to a combination of contract information and a device type is registered and a hierarchical management table in which user information including contract information of a user and information on the device are managed in association with each other, acquires the device type serving as an application target of the policy rule, and a device ID assigned to the device, determines the policy rule according to the acquired device type and the contract information of the user, and instructs a deep packet inspection (DPI) to apply the determined policy rule to the device corresponding to the acquired device ID. The DPI acquires the device ID, and applies the policy rule to communication from the device corresponding to a device ID assigned to the device, and performs control.