Proxy Server Push Notification Security Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security technologies face challenges in enforcing security policies on encrypted communications between user devices and outside devices, as they cannot inspect direct encrypted communications without breaking encryption, leading to limitations in monitoring and blocking unauthorized traffic.
Innovation Solution
Implementing a network gateway that blocks direct encrypted communications and provides indirect proxied communications through a proxy, which has unencrypted access to enforce security policies, using push notifications to inform users and provide proxy URLs for secure communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If direct encrypted communications are allowed between user devices and outside devices, then communication privacy and security are improved, but the ability to enforce security policies and monitor traffic is lost
Solution Approach 1:
The patent introduces a proxy server as an intermediary component between user devices and outside devices. The proxy server receives encrypted communications from user devices, decrypts them using obtained decryption keys, inspects the content for security policy compliance, and forwards compliant communications to outside devices. This intermediary architecture enables both encrypted communication security and security policy enforcement to coexist.
2Difficulty of detecting and measuring
If a proxy server is introduced to enforce security policies on encrypted communications, then security policy enforcement capability is improved, but system complexity and additional security risks are introduced
Solution Approach 1:
The proxy server is designed to perform multiple functions: it acts as a communication relay, a decryption device, a security policy enforcement point, and a traffic monitoring system. By consolidating these functions into a single multi-functional component, the patent reduces overall system complexity compared to having separate specialized components for each function.
3Difficulty of detecting and measuring
If decryption keys are obtained from user devices to enable proxy decryption, then security policy enforcement on encrypted traffic is improved, but user device privacy and potential security risks are worsened
Solution Approach 1:
The patent implements preliminary action by obtaining decryption keys from user devices before the proxy server needs to inspect encrypted communications. The keys are extracted and stored in advance, enabling the proxy to decrypt and inspect traffic as needed without requiring real-time key acquisition, thus reducing security risks during active communication.
4Reliability
If all communications are blocked until push subscription data is received, then security control is improved, but user experience and network accessibility are worsened
Solution Approach 1:
The patent implements periodic action by initially blocking communications and then periodically checking for push subscription data from user devices. Once subscription data is received, the blocking is lifted and normal communications resume. This periodic checking approach maintains security control while eventually restoring network accessibility.
Data Source
AI summary
An advancement over previous techniques uses push notifications to provide users with proxied communications to outside devices reachable using a security appliance or network gateway. Encrypted direct communication between a user device with the outside device is blocked and the user device is provided with a proxy URL at which indirect proxied communications can be provided. A proxy at the proxy URL can read the communications between the user device and the outside device. The proxy can thereby apply security policies to the indirect proxied communications. The security appliance can provide the proxy URL to the user device via a push server.