Zero Trust File Scanning With Virtual Network Interface Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure web gateways (SWG) solutions are not easily integrated into organizational workflows and do not effectively manage security vulnerabilities when users access resources from both secure and public networks, particularly in a bring your own device (BYOD) setup, leading to potential exposure of sensitive information.
Innovation Solution
A system and method that configures a client device with an agent to generate a virtual network interface (VNI) for seamless communication through a zero trust network environment, allowing secure access to both private and public networks while performing deep packet inspection and content signature matching to control network traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a standalone secure web gateway is deployed to filter and inspect content, then security control is improved, but integration with organizational workflow and log monitoring becomes difficult
Solution Approach 1:
The patent combines the secure web gateway functionality with the virtual network interface agent, merging security control mechanisms into the existing network infrastructure. The SWG leverages the virtual network interface's packet capture and routing capabilities while adding deep packet inspection and content filtering, eliminating the need for separate standalone security appliances and improving integration with organizational workflows.
Solution Approach 2:
The virtual network interface agent is designed to perform multiple functions: it provides virtual network connectivity, captures network packets for inspection, enforces security policies, and integrates with existing monitoring systems. This multi-functional approach allows a single component to handle both network access control and security monitoring, improving ease of operation while maintaining strong security control.
2Adaptability or versatility
If users can access both private and public networks, then connectivity versatility is improved, but security vulnerability increases due to potential data exposure
Solution Approach 1:
The patent introduces a secure web gateway as an intermediary between users and network resources. This intermediary inspects all network traffic, including both incoming requests to private networks and outgoing transfers to public networks. The SWG analyzes packet contents, compares files against known malicious patterns, and controls data flow based on security policies, thereby enabling versatile network access while preventing data exposure through continuous monitoring and filtering.
3Reliability
If deep packet inspection is performed on all network traffic, then content security is improved, but processing time and network throughput are reduced
Solution Approach 1:
The patent applies partial deep packet inspection by analyzing only the necessary portions of network traffic packets. Instead of inspecting every packet in full detail, the system performs targeted inspection on packets that match security criteria or contain suspicious patterns. This selective approach maintains content security by catching malicious traffic while reducing processing overhead and preserving network throughput for legitimate traffic.
Data Source
AI summary
A system and method for providing file scanning between a client device and a resource through a zero trust network environment (ZTNE) are disclosed. The method includes detecting in network traffic between the client device and the ZTNE a request to receive a first content from a resource deployed in a private network, wherein the resource is accessible to the user device making first request through the ZTNE; detecting in network traffic between the client device and the ZTNE a second request to send a second content from the client device to a public network, wherein the public network is accessible to the user device making the second request through the ZTNE; sending the request to the public network, in response to determining that the second content is allowable; and blocking the request to the public network, in response to determining that the second content is not allowable network traffic.