Stateful Distributed Web Application Firewall for Consistent Security Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large-scale distributed networks, maintaining security while handling high volumes of traffic is challenging due to the distributed nature, as attackers can penetrate the network through one server but be blocked by another, leading to inconsistent security enforcement across multiple virtual machines.
Innovation Solution
Implementing a stateful distributed firewall system where service engines detect traffic violations, update and broadcast a shared state across multiple instances, aggregating this state to enforce web application policies consistently across all service engines, ensuring that security rules are applied uniformly and effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traffic is routed through multiple virtual machines and servers to handle high volumes, then network capacity and traffic handling capability are improved, but security consistency deteriorates because attackers can penetrate through one server while being blocked by another
Solution Approach 1:
The patent merges security state information across multiple virtual machines by implementing a shared state mechanism. When one VM detects a traffic violation, the violation information is propagated to other VMs through broadcast messages, enabling coordinated security enforcement across the distributed network infrastructure.
Solution Approach 2:
The system implements feedback loops where security violations detected by any service engine are communicated back to the central coordination mechanism, which then distributes this information to all other service engines. This feedback ensures that security policies are consistently enforced across all VMs based on violations detected anywhere in the system.
2Speed
If security rules are enforced independently at each service engine, then local security response speed is improved, but overall network security deteriorates due to inconsistent enforcement across distributed servers
Solution Approach 1:
The system performs preliminary actions by maintaining shared state information about traffic violations across all service engines before new traffic decisions are made. This allows each service engine to make informed security decisions based on previously detected violations from other engines, enabling fast local responses with globally consistent security posture.
Solution Approach 2:
The patent introduces a central coordination mechanism that acts as an intermediary between distributed service engines. This mediator collects violation information from any engine and distributes it to all others, enabling consistent security enforcement without requiring direct peer-to-peer communication between service engines.
3Reliability
If a centralized security mechanism is implemented to ensure consistent enforcement, then security reliability is improved, but system complexity and processing overhead increase
Solution Approach 1:
The system segments security functionality by allowing each virtual machine to independently detect and process traffic violations locally. Rather than requiring centralized analysis of all traffic, each VM maintains its own detection capabilities while sharing violation state information, dividing the security enforcement task across multiple independent units.
Solution Approach 2:
The patent uses copying by broadcasting shared state information containing violation details to all service engines. Each engine receives and stores copies of violation information from other engines, enabling consistent security decisions without requiring complex inter-engine communication protocols or centralized coordination overhead for each decision.
Data Source
AI summary
A method and system are disclosed. A first service engine among a plurality of service engines detects a traffic violation of a web application policy for an instantiation of a virtual service on the first service engine. The service engines maintain corresponding instances of a shared state of policy violations for the web application policy. In response to detecting the traffic violation, a first instance of the shared state on the first service engine is updated. The first service engine broadcasts the updated first instance of the shared state. Remaining service engines, which have instantiations of the virtual service, update their instances of the shared state in response to receiving the updated first instance. The instances of the shared state are aggregated to obtain an aggregated shared state. It is detected whether the aggregated shared state triggers an application policy rule for the web application policy.