Remote Protocol Enforcement via User Agent and Gateway
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Portable computing devices and enterprise networks are vulnerable to intrusion and abuse when communicating with external servers, particularly due to unauthorized message protocols like IM, P2P, and file sharing protocols, which can lead to security breaches and data exposure.
Innovation Solution
A system comprising a user agent and a protocol inspection gateway that monitors and controls communications between a remote client and external message servers, blocking unauthorized connections and applying policy enforcement rules to ensure compliance with enterprise network protocols, using a virtual private network (VPN) to secure communications and inspect message protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a protocol enforcement gateway is used to control communication traffic, then security against rogue protocols is improved, but the gateway cannot control traffic when portable devices operate remotely outside the enterprise network
Solution Approach 1:
A user agent is introduced as an intermediary component installed on the portable computing device itself. This user agent acts as a local protocol enforcement mechanism that monitors and controls communication traffic directly at the source, enabling security policies to be enforced even when the device operates remotely outside the enterprise network perimeter.
Solution Approach 2:
The protocol enforcement functionality is segmented into two parts: the user agent on the portable device and the protocol enforcement gateway on the enterprise network. This segmentation allows the user agent to handle local traffic monitoring and control independently, while the gateway provides centralized policy management and inspection for traffic that does pass through the network.
2Reliability
If all communication traffic is monitored and controlled, then security against intrusions is improved, but communication efficiency and user convenience deteriorate
Solution Approach 1:
The monitoring and control mechanisms are applied selectively based on the nature of the communication traffic. The user agent and gateway focus their inspection efforts on traffic that matches known rogue protocol patterns or exhibits suspicious characteristics, rather than uniformly inspecting all traffic. This allows legitimate business communications to flow efficiently while suspicious traffic receives enhanced scrutiny.
3Measurement precision
If protocol inspection is performed on all messages, then detection of rogue protocols is improved, but processing time and system resources increase
Solution Approach 1:
Instead of performing full protocol inspection on every message, the system applies partial inspection strategies. The user agent and gateway first perform quick filtering based on known protocol signatures and patterns, applying full inspection only to messages that match suspicious criteria. This partial action approach maintains high detection accuracy for rogue protocols while significantly reducing the average processing time for legitimate traffic.
Data Source
AI summary
A user agent residing within a remote client and configured to enforce message protocol policy is disclosed. The user agent includes a communications monitoring element that examines a communications connection between the client and an external message server to determine if the message server matches a restricted server attribute. The user agent also includes a communications controller element that works with the communications monitoring element to block communications between the client and the message server when the message server matches a restricted server attribute unless the communications are monitored by a protocol inspection gateway. The gateway intercepts the communications between the client and the message server and inspects a message protocol associated with the intercepted communications to determine if the message protocol matches a protocol definition file, and when a match occurs, apply a policy enforcement rule that overrides aspects of the message protocol associated with the intercepted communications.