Proxy Element Bandwidth Limiting for Encrypted Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional TLS proxy-based monitoring systems face challenges in handling temporary surges in traffic volume, leading to packet dropping due to processing capacity limitations, which is undesirable for implementing network security policies.
Innovation Solution
Implementing bandwidth limitations on specific application traffic at a proxy element by identifying encrypted packets, applying a bandwidth limitation operation, and decrypting them only when the accumulated payload bytes comply with predefined parameters, using a monitoring engine and bandwidth limiter to manage throughput without dropping packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the proxy element processes all incoming packet flows through decryption and re-encryption operations, then network security monitoring is maintained, but the processing capacity is exceeded during traffic surges causing packet dropping
Solution Approach 1:
The patent applies different processing treatments to different packet flows based on their characteristics. Specifically, it identifies packets belonging to specific application traffic types (like video streaming) and applies bandwidth limitation operations only to those packets, while other packets receive standard decryption processing. This selective differential processing allows the system to maintain security monitoring for all traffic while preventing bandwidth-intensive applications from overwhelming the decryption capacity.
Solution Approach 2:
The patent implements dynamic bandwidth limitation parameters that can be adjusted based on current system conditions. The bandwidth limiter dynamically modifies packet transmission rates for specific application types based on available processing capacity, current traffic conditions, and security requirements. This dynamic adjustment allows the system to adapt to traffic surges by temporarily reducing bandwidth for non-critical applications while maintaining security monitoring.
2Reliability
If the proxy element increases decryption processing capacity to handle traffic surges, then packet dropping is prevented, but device complexity and processing overhead increase
Solution Approach 1:
The patent performs preliminary classification of incoming packets to identify those belonging to specific application traffic types before they enter the decryption pipeline. By pre-identifying bandwidth-intensive application packets and tagging them appropriately, the system prepares them for selective bandwidth limitation without requiring additional processing capacity during the decryption phase. This preliminary sorting action prevents the need for more complex real-time processing during traffic surges.
Solution Approach 2:
The patent introduces a bandwidth limiter as an intermediary component between the decryption engine and the packet forwarding mechanism. This intermediary element selectively applies bandwidth limitation operations to specific application packets without requiring the decryption engine itself to become more complex. The bandwidth limiter acts as a buffer that manages traffic flow based on available processing capacity, protecting the core decryption function from being overwhelmed while maintaining packet delivery reliability.
3Stability of the object's composition
If the proxy element drops packets during traffic surges to maintain processing capacity, then system stability is preserved, but network security monitoring effectiveness is reduced
Solution Approach 1:
The patent changes the operational parameters of packet processing by introducing bandwidth limitation as an additional control variable. Instead of simply dropping packets when capacity is exceeded, the system modifies the transmission rate parameter for specific application packets, gradually limiting their bandwidth consumption. This parameter change allows the system to maintain stability by preventing capacity overload while preserving security monitoring effectiveness through continued processing of all packets at reduced rates.
Data Source
AI summary
Methods, systems, and computer readable media for implementing bandwidth limitations on specific application traffic at a proxy element are disclosed. One exemplary method includes receiving, at a proxy element, a packet flow from at least one source client, identifying encrypted packets associated with a specific application traffic type from among the packet flow, and directing the identified encrypted packets to a bandwidth limiter in the proxy element. The method further includes applying a bandwidth limitation operation to the identified encrypted packets and decrypting the identified encrypted packets if an accumulated amount of payload bytes of the identified encrypted packets complies with the parameters of the bandwidth limitation operation.