Device Blocking Tool for Network Security via VLAN Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large networks face challenges in timely identification and removal of compromised devices, which can reconnect and compromise the network, making it difficult to maintain security against malicious activities and data theft.
Innovation Solution
A device blocking tool that uses a user interface, location engine, retrieval engine, and update engine to identify devices connected through wired or wireless connections, determines their switch and VLAN type, and updates access control lists to disconnect and block compromised devices from reconnecting, thereby enhancing network security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If devices are blocked from reconnecting to the network, then network security is improved, but device complexity increases due to the need for identification and blocking mechanisms
Solution Approach 1:
The blocking tool is divided into distinct functional modules: a user interface for input, a location engine for determining device connection details (switch and VLAN), a retrieval engine for accessing access control lists, and an update engine for applying blocks. This segmentation allows each component to perform its specific function independently, reducing overall system complexity while maintaining security effectiveness.
Solution Approach 2:
The patent introduces an access control server as an intermediary component that receives device identification information, determines connection details, and facilitates the blocking process. This intermediary handles the complex logic of identifying compromised devices and managing access control lists, thereby simplifying the overall system architecture.
2Reliability
If compromised devices are identified and blocked timely, then network security is improved, but loss of time increases due to the identification and blocking process
Solution Approach 1:
The system maintains access control lists that are pre-configured with blocking rules. When a compromised device is identified, the update engine can immediately apply pre-prepared blocking actions to the appropriate access control lists, significantly reducing the time required to block the device compared to creating blocking rules from scratch.
Solution Approach 2:
The location engine receives device identification information and immediately determines connection details, providing rapid feedback to the update engine. This feedback loop enables timely blocking decisions by continuously monitoring device status and quickly implementing blocking actions based on real-time information.
3Measurement precision
If the blocking tool determines switch and VLAN information for wired connections, then blocking accuracy is improved, but device complexity increases due to additional determination logic
Solution Approach 1:
The location engine is designed to handle multiple connection types (wired and wireless) using a unified approach. It receives device identification information and automatically determines the appropriate switch and VLAN details regardless of connection type, eliminating the need for separate complex logic for each connection method while maintaining high identification accuracy.
Data Source
AI summary
A device blocking tool includes a user interface, a location engine, a retrieval engine, and an update engine. The user interface receives at least one of a MAC address and an IP address of a device. The location engine communicates a query to an access control server, receives a response, and determines, based on the response, that the device connected to a network through a wired connection. In response that determination, the location engine determines a switch through which the device connected. The location engine also determines a number identifying a VLAN through which the device connected and determines that the device is an IP telephone. The retrieval engine retrieves an access control list. The update engine disconnects the device from the VLAN and reconnects the device through a second VLAN.