Web Application Security Mediator Architecture
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing web application firewalls (WAFs) face challenges in detecting SQL injection attacks due to limited time for computation, leading to either blocking legitimate requests or missing malicious ones, and often require complex network reconfiguration, which can cause performance issues and single points of failure.
Innovation Solution
A lightweight module is integrated into the web server to quickly analyze incoming requests and decide on blocking, with a collector server aggregating data to make decisions out-of-band, eliminating single points of failure and reducing resource constraints, and sending sensitive data offsite for redaction and analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If a traditional router or firewall approach is used for WAF, then attack detection capability is improved, but network architecture complexity increases and single point of failure risk worsens
Solution Approach 1:
The patent introduces a mediator component that sits between the web server and the WAF system. This mediator receives requests from the web server, forwards them to the WAF for analysis, and then relays the responses back. This intermediary approach allows the WAF to function without requiring complex network reconfiguration, as it integrates seamlessly into the existing request-response flow between the web server and clients.
2Difficulty of detecting and measuring
If a traditional router or firewall approach is used for WAF, then attack detection capability is improved, but system reliability worsens due to single point of failure
Solution Approach 1:
The patent segments the WAF system into multiple independent components: the WAF analysis service, the mediator, and the web server. This segmentation allows the system to distribute the attack detection functionality across multiple instances or nodes. If one WAF instance fails, others can continue to operate, eliminating the single point of failure problem while maintaining attack detection capability.
3Difficulty of detecting and measuring
If WAF is implemented in inline mode, then real-time attack detection is improved, but request processing time worsens
Solution Approach 1:
The patent implements preliminary action by having the mediator prepare and forward requests to the WAF analysis service before the actual web request processing completes. The WAF can begin analyzing request patterns, user behavior, and potential threats in advance, building contextual understanding that speeds up real-time decision-making. This preliminary analysis reduces the computational burden during actual request handling, thereby reducing processing time while maintaining real-time detection capability.
4Ease of manufacture
If WAF is implemented inside the web server, then network reconfiguration is eliminated, but web server performance worsens
Solution Approach 1:
The patent introduces a mediator component that acts as an intermediary between the web server and the WAF system. This mediator handles the communication and data exchange, allowing the WAF to function as a separate process or service rather than being embedded within the web server. This approach eliminates the need for complex network reconfiguration while preventing the WAF from directly impacting web server performance, as the mediator buffers and manages the interaction between the two systems.
Data Source
AI summary
A system for web application security includes an interface and a processor. The interface of a web server is to receive a pending request made to the web server using an in-line request process. The processor of the web server is to provide information regarding the pending request to an agent process; and in the event that an instruction to block the pending request is received from the agent process at the in-line request process within a time constraint, block the pending request using the in-line request process.