Protected Dynamic Dictionary Handling in HTTP/2 and HTTP/3
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing HTTP/2 and HTTP/3 protocols are vulnerable to security breaches due to the storage of sensitive data in unsecured dynamic dictionaries (DD) memory, which can be accessed by attackers, leading to potential data leaks.
Innovation Solution
Implementing DD data decompression in protected memory, ensuring that sensitive data is stored and processed in a secure environment, inaccessible to unauthorized access, and preventing the memory from being dumped or paged out.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If sensitive data is stored in unsecured dynamic dictionary memory for HTTP/2 and HTTP/3 connections, then data processing efficiency is improved, but security of sensitive data deteriorates
Solution Approach 1:
The patent segments the dynamic dictionary memory into two distinct parts: a secure portion where sensitive data is stored with restricted access, and an unsecure portion for non-sensitive data. This segmentation allows the system to maintain high processing efficiency by keeping the dynamic dictionary functional while protecting sensitive information through isolated memory regions with different access permissions.
2Ease of operation
If dynamic dictionary memory is made accessible for data processing, then ease of operation is improved, but vulnerability to attacks increases
Solution Approach 1:
The patent applies local quality by assigning different security characteristics to different regions of the dynamic dictionary memory. The secure portion has restricted access permissions to prevent unauthorized reading or modification, while the unsecure portion remains fully accessible for normal data processing operations. This localized differentiation of memory properties enables the system to maintain operational ease for non-sensitive data while protecting against attacks on sensitive information.
Data Source
AI summary
An approach is disclosed for processing one or more HTTP requests and responses, by a protection solution, where a version of the plurality of HTTP requests and responses is at least version 2. When an HTTP settings request is detected in the one or more HTTP requests, by the protection solution, a protected dynamic dictionary is allocated in a protected memory area and an allocation of an application dynamic dictionary in application space in an HTTP server is prevented. When an HTTP header request is detected in the one or more HTTP requests, fields of the HTTP header are decompressed into the protected dynamic dictionary, the HTTP header request is updated to form an updated header request based on content in the protected dynamic dictionary, and the updated header request is sent to the HTTP server.