Application-Aware Tunnel Access Control for Secure Network Connections
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security technologies, such as TCP/IP-based systems, are vulnerable to ARP spoofing, firewall limitations, and VPN vulnerabilities, leading to indiscriminate access and security breaches, particularly at the application layer.
Innovation Solution
A system and method for controlling network access using a node with a communication circuit, processor, and memory that includes an access control application to inspect data packets based on rule databases, determine authorized data flows and tunnels, and manage network access through a controller to ensure secure connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TCP/IP-based network access control (NAC, firewall, VPN) is used, then network access control is provided, but security vulnerabilities remain (ARP spoofing, firewall bypass, VPN management issues)
Solution Approach 1:
The patent segments network access control into multiple independent components: tunnel establishment module, data packet inspection module, and authorization module. Each component operates independently to perform specific functions (tunnel creation, packet inspection, authorization verification), eliminating the monolithic structure of traditional NAC systems and reducing security vulnerabilities associated with single-point failures.
Solution Approach 2:
The patent introduces a tunnel as an intermediary layer between the terminal and the external network. All data packets must pass through this tunnel, which is established through secure authentication with the access network device. This intermediary structure prevents direct unauthorized access and enables centralized control of all network traffic.
2Ease of operation
If firewall is used to control data packet flow, then data transmission control is improved, but the firewall cannot directly control connection generation between nodes
Solution Approach 1:
The patent merges connection control and data transmission control into a single tunnel-based framework. The tunnel establishment process simultaneously creates the connection path and sets up the control mechanism, eliminating the need for separate firewall rules for each connection. This unified approach simplifies operation while maintaining comprehensive control.
Solution Approach 2:
The patent performs preliminary actions by establishing the tunnel and authorization rules before any data transmission occurs. The access network device pre-authenticates the terminal and configures the tunnel parameters in advance, so that subsequent data packets can be controlled automatically without real-time intervention, improving both ease of operation and control effectiveness.
3Reliability
If VPN tunnel is established to ensure data integrity, then confidentiality is improved, but the tunnel generation and flow management become vulnerable
Solution Approach 1:
The patent implements self-service mechanisms where the access network device automatically authenticates terminals, establishes tunnels, and manages data packet inspection without manual intervention. The system autonomously handles tunnel creation, authorization verification, and packet filtering based on pre-configured policies, reducing the complexity of tunnel management while maintaining strong security.
Solution Approach 2:
The patent incorporates feedback mechanisms where the access network device continuously monitors data packets passing through the tunnel and compares them against authorization rules. Based on this feedback, the system can dynamically adjust tunnel parameters, block suspicious traffic, and update authorization policies, making tunnel management more efficient and less complex.
4Reliability
If data packet inspection is performed based on authorization rules, then unauthorized access is blocked, but network processing overhead increases
Solution Approach 1:
The patent applies partial inspection by focusing data packet verification only on critical fields such as source address, destination address, and protocol type, rather than inspecting the entire packet content. This selective approach maintains high access control accuracy while minimizing processing overhead and preserving network throughput.
Solution Approach 2:
The patent performs preliminary authorization verification during the tunnel establishment phase, creating a trusted relationship between the terminal and the access network device. Once the tunnel is established, subsequent data packets are trusted by default, requiring minimal inspection. This preliminary action significantly reduces processing overhead for ongoing traffic while maintaining security.
Data Source
AI summary
A node according to an embodiment disclosed in the present specification includes a communication circuit, a processor operatively connected to the communication circuit, and a memory operatively connected to the processor and that stores a target application and a access control application, and the memory stores instructions that when executed by the processor, cause the node to detect an event of a network access with respect to a destination network of the target application through the access control application, to determine whether a data flow and a tunnel, which correspond to identification information of the target application and the destination network and are authorized from an external server exist through the access control application, to determine whether an inspection of a data packet of the target application is necessary based on data packet inspection information included in the authorized data flow when the authorized data flow and the authorized tunnel exist, to inspect the data packet based on a rule database included in the data packet inspection information when the inspection of the data packet is necessary, and to forward the data packet based on the authorized data flow and the authorized tunnel when the inspection of the data packet is not necessary or when a result of the inspection of the data packet is successful.