SSL Filter Engine for Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems face challenges in seamlessly enforcing security policies during SSL sessions, particularly in ensuring client machines comply with security requirements before accessing corporate Web sites, as current methods require additional protocols, may not work through NAT boxes, or assume client support for ActiveX components.
Innovation Solution
A security system that intercepts SSL session attempts, determines compliance with predefined security rules, and blocks non-compliant attempts, using a module to monitor certificate retrieval requests and enforce security policies within the existing SSL protocol framework.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If additional protocols are used to enforce security policies during SSL sessions, then security compliance can be improved, but device complexity and compatibility issues worsen
Solution Approach 1:
The patent merges security policy enforcement with the existing SSL protocol by integrating a filter engine into the SSL/TLS stack. The filter engine intercepts certificate requests and evaluates security policies without requiring separate additional protocols, thereby maintaining security compliance while avoiding extra protocol complexity.
Solution Approach 2:
The filter engine serves multiple functions: it intercepts SSL/TLS certificate requests, evaluates security policies, determines compliance status, and controls certificate delivery. This multi-functionality eliminates the need for separate security enforcement protocols, reducing overall system complexity while maintaining comprehensive security compliance.
2Ease of operation
If ActiveX components are assumed for client support, then ease of operation is improved, but adaptability worsens due to compatibility assumptions
Solution Approach 1:
The filter engine operates autonomously within the SSL/TLS stack, performing security policy evaluation and certificate control without requiring ActiveX components or special client capabilities. The system serves itself by leveraging built-in SSL/TLS functionality, eliminating dependency assumptions while maintaining ease of operation.
3Reliability
If security policies are enforced during SSL sessions, then security compliance is improved, but productivity may worsen due to additional checks
Solution Approach 1:
The filter engine performs security policy evaluation and compliance determination before certificate delivery is allowed. By conducting these checks in advance during the certificate request phase, the system ensures security compliance while minimizing delays in subsequent SSL session establishment, as the compliance decision is already made.
Data Source
AI summary
A security system providing methodology for cooperative enforcement of security policies during SSL sessions is described. In one embodiment, for example, a method is described for controlling SSL (Secure Sockets Layer) communication, the method comprises steps of: defining rules indicating conditions under which a machine is permitted to participate in an SSL session; trapping an attempt by a particular application running on the machine to participate in an SSL session, by intercepting the particular application's attempt to provide authentication; determining whether the machine complies with the rules; allowing the attempt to succeed when the machine complies with the rules; and otherwise blocking the attempt when the machine does not comply with the rules.