SSL Traffic Inspection for External Password Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing firewalls struggle to enforce password constraint policies for external site authentication, as these sites are not under enterprise control, leading to security risks due to weak credentials and potential vulnerabilities.
Innovation Solution
A firewall system intercepts and decrypts SSL sessions to enforce password complexity checks and prevent duplicate credential use across internal and external sites, using a trusted man-in-the-middle technique to inspect and re-encrypt traffic, and maintains a user credentials cache for policy enforcement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewalls filter traffic based on basic rules and policies, then network security is maintained, but password constraint policies cannot be enforced for external site authentication
Solution Approach 1:
The patent introduces an intermediary mechanism (SSL session interception and decryption capability) between the firewall and external sites, enabling the firewall to inspect and enforce password policies on external site authentication without direct control over those sites. The firewall acts as a trusted man-in-the-middle that can decrypt SSL sessions, check passwords against enterprise policies, and re-encrypt traffic.
2Ease of operation
If firewalls permit authorized communications to pass through, then network accessibility is maintained, but security risks arise from weak credentials and duplicate credential use
Solution Approach 1:
The patent implements preliminary action by checking password constraints before allowing authentication to external sites. The firewall intercepts SSL sessions during the authentication process, verifies passwords against enterprise policies (complexity requirements, duplicate credential detection), and blocks unauthorized access before it can occur, rather than reacting to security incidents after they happen.
3Reliability
If firewalls inspect encrypted SSL traffic, then password policies can be enforced, but system complexity increases due to decryption and re-encryption requirements
Solution Approach 1:
The firewall implements SSL session interception by acting as a trusted intermediary in the SSL handshake process. It generates certificate authorities, signs certificates for external sites, and establishes encrypted sessions with both clients and external sites, allowing it to decrypt and inspect traffic without breaking end-to-end encryption. This intermediary approach enables policy enforcement while maintaining encrypted communication channels.
Data Source
AI summary
Techniques for detecting scanning and attacking uniform resource locators in network traffic are disclosed. A system, process, and/or computer program product for detecting scanning and attacking uniform resource locators in network traffic includes monitoring egress traffic from an enterprise network, determining whether a uniform resource locator (URL) request is associated with scanning and attacking egress traffic based on one or more features, and performing an action in response to a determination that the URL request is associated with the scanning and attacking egress traffic from the enterprise network.