Proxy Policy-Based Tunnel Classification for Selective Data Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As the world shifts towards increased internet-based communication and commerce, there is a growing need for secure communication channels, but existing cryptographic protocols can inadvertently block all communications if employed universally, violating certain entities' policies or interests that require selective content handling.
Innovation Solution
The system employs a proxy connect component to establish connections, a negotiation component to set up tunnels with hosts, and a security component to classify these tunnels as either private or public based on privacy policies, providing security credentials or using a NULL cipher accordingly, allowing selective data inspection and modification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic protocols are employed to secure all network communications, then communication security is improved, but entity policies requiring content inspection are violated and communications are blocked
Solution Approach 1:
The patent segments communications into two distinct types: encrypted tunnels for private communications and unencrypted proxy connections for public communications. This segmentation allows the system to apply different security measures to different communication types, enabling both cryptographic security for sensitive data and policy compliance for non-sensitive data through separate communication channels
Solution Approach 2:
The system dynamically selects between encrypted and unencrypted communication modes based on the nature of the data being transmitted. The proxy connect component negotiates with the host to determine whether to establish an encrypted tunnel or an unencrypted proxy connection, allowing the security approach to adapt to the specific communication requirements
2Loss of information
If all communications are encrypted using cryptographic protocols, then data privacy is protected, but entities cannot inspect or modify data passing through their network
Solution Approach 1:
The patent applies different quality characteristics to different portions of communications: encrypted tunnels maintain full privacy for sensitive data, while unencrypted proxy connections allow inspection and modification for non-sensitive data. This local differentiation of encryption status enables both data privacy protection and policy compliance without requiring universal encryption
3Adaptability or versatility
If proxies are given security credentials to inspect encrypted data, then policy requirements are met, but the privacy protection of encrypted communications is compromised
Solution Approach 1:
The patent introduces an intermediary unencrypted proxy connection as a mediator between the client and host for public communications. This intermediary approach allows the proxy to inspect and modify data while maintaining policy compliance, without requiring the proxy to compromise the security credentials of encrypted tunnels used for private communications
Data Source
AI summary
A proxy connect component establishes a connection with a proxy, and provides the proxy with a name of a host with which to establish a connection. A negotiation component negotiates a tunnel directly with the host, and a security component classifies the tunnel as at least one of a private-tunnel or a public-tunnel based at least in part on a set of privacy policies. If the tunnel is classified as a public-tunnel, then the proxy is provided a set of security credentials to inspect and/or modify data passing through the tunnel, or a NULL cipher is employed. If the tunnel is classified as a private-tunnel, then the proxy is not provided the security credentials to inspect and/or modify data passing through the tunnel.