Searchable Encryption Trapdoors for Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection systems (IDS) are rendered ineffective by encryption protocols like SSL and TLS, as they cannot inspect encrypted traffic, and existing solutions that break encryption for inspection pose ethical and legal issues, while alternative methods are not compatible with current security vendor practices.
Innovation Solution
A method using a searchable encryption algorithm with a key generation, encryption/decryption, and trap generation process allows intrusion detection on encrypted traffic by generating trapdoors for keywords, enabling detection without revealing the keywords to the IDS, maintaining encryption integrity and compatibility with security vendor models.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption protocols (SSL/TLS) are used to protect communications, then user privacy and data confidentiality are improved, but intrusion detection capability deteriorates because IDS systems cannot inspect encrypted traffic
Solution Approach 1:
The patent introduces a proxy server as an intermediary between the client and server that performs deep packet inspection on encrypted traffic. The proxy intercepts SSL/TLS connections, decrypts traffic using obtained private keys, inspects the decrypted content for intrusion signatures, and then re-encrypts before forwarding to the destination. This mediator approach enables intrusion detection while preserving end-to-end encryption for legitimate communications.
Solution Approach 2:
The patent extracts the inspection function from the encrypted traffic flow by obtaining private keys from certificates and using them to decrypt only the portions of traffic needed for inspection. The IDS system extracts specific payload content from encrypted packets, analyzes it separately, and then allows the encrypted traffic to continue its normal flow, minimizing disruption to confidentiality while enabling detection.
2Difficulty of detecting and measuring
If man-in-the-middle attacks are used to intercept encrypted communications for inspection, then intrusion detection capability is improved, but user privacy and ethical standards deteriorate
Solution Approach 1:
The patent performs preliminary actions by obtaining private keys from certificates before interception occurs. The system pre-establishes the capability to decrypt traffic by extracting private keys from available certificate authorities, so that when inspection is needed, the decryption has already been authorized through legitimate key acquisition rather than active man-in-the-middle injection.
Solution Approach 2:
The patent converts the potential harm of certificate-based interception into a benefit by using the same certificate authority infrastructure that enables secure communications to also enable authorized inspection. The existence of trusted CA certificates, which normally only serve to establish secure connections, is transformed into a mechanism that also provides legitimate access points for intrusion detection when security threats are present.
3Measurement precision
If deep packet inspection is applied to encrypted traffic, then intrusion detection accuracy is improved, but implementation complexity increases due to key management and decryption requirements
Solution Approach 1:
The patent implements self-service by having the intrusion detection system automatically obtain private keys from certificate authorities and manage the decryption/encryption process without manual intervention. The system autonomously extracts keys from available certificates, performs decryption when inspection is required, and manages key rotation and updates automatically, reducing the operational complexity despite the sophisticated cryptographic operations involved.
Data Source
Figure 1~2
Figure 3
AI summary
The method for detecting intrusions uses a searchable enciphering algorithm and comprises: the generation of a traps bypass key for a security device (RG 6) able to determine keywords characteristic of intrusions; the generation by the security device of a trap for each keyword by using the traps bypass key; the provision of the traps by the security device to an intrusions detection device (MB 5); the interception by the detection device of character strings sent on the network by a sender and enciphered with a public key of a receiver; the application by the detection device of a test procedure on the character strings enciphered using the traps; and the detection of an intrusion on the network if there exists according to the test procedure an enciphered character string representative of a cipher of a keyword.