Distributed Wireless Access Security With Server-Selected Policies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing wireless communication protocols are vulnerable to exploitation by malicious access points, allowing attackers to intercept and manipulate data, steal credentials, and gain unauthorized access to enterprise networks, with existing security mechanisms failing to prevent such attacks.
Innovation Solution
A distributed wireless communication security system that uses a server computer to characterize devices, select policies based on device data, and communicate these policies to endpoint devices to determine allowable access points, using white or black lists and authentication protocols, with client applications enforcing these policies and reporting compliance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If standard wireless communication protocols are used, then device connectivity and ease of access are improved, but security vulnerability to malicious access points increases
Solution Approach 1:
The patent introduces a server computer as an intermediary between endpoint devices and wireless access points. The server receives device data, selects appropriate policies from a database, and communicates these policies to devices. These policies define criteria for determining allowable access points, creating a layered security model that mediates between connectivity desires and security requirements without blocking legitimate wireless communication.
Solution Approach 2:
The system performs preliminary security assessment by characterizing devices before they connect to wireless networks. The server pre-selects policies based on device characteristics and communicates allowability criteria in advance. This preliminary action enables endpoint devices to make informed connection decisions before actually connecting, preventing malicious access points from compromising security while maintaining ease of legitimate connectivity.
2Reliability
If access control policies are implemented, then security against unauthorized access is improved, but device complexity increases
Solution Approach 1:
The patent extracts the complex policy selection and characterization logic from the endpoint devices and places it in the server computer. The server handles device data characterization, policy selection from the database, and communication of allowability criteria to devices. This extraction reduces the computational burden and complexity on endpoint devices while maintaining strong access security through centralized policy management.
Solution Approach 2:
Endpoint devices perform self-characterization by providing their own data to the server computer. This self-service approach simplifies the device architecture as devices autonomously provide the information needed for policy selection without requiring complex external characterization systems. The server then uses this self-provided data to select and communicate appropriate access policies.
3Adaptability or versatility
If centralized policy management is used, then adaptability to different device types is improved, but server processing requirements increase
Solution Approach 1:
The patent segments the policy management function into a database of pre-defined policies, each tailored for specific device types or scenarios. The server computer characterizes incoming devices, selects the appropriate pre-defined policy from the database, and communicates it to the device. This segmentation approach enables high adaptability to different device types while reducing server processing requirements compared to creating custom policies for each device individually.
Solution Approach 2:
The system adapts to different device types by changing the parameters used for policy selection based on device characteristics. The server receives device data, determines relevant selection criteria, and retrieves corresponding policies from the database. This parameter-based adaptation allows versatile support for multiple device types using a unified server architecture without requiring proportional increases in processing power for each device type.
Data Source
AI summary
A computer implemented method of distributed wireless communications access security, the method comprising steps a computer processor of a server computer is programmed to perform, the steps comprising: receiving data characterizing a device, selecting a policy from a database of policies using the received data characterizing the device, for the device, the policy defining a criterion for determining which wireless access points are allowable, and communicating data defining the selected policy to the device, for the device to use for determining whether access to an active wireless access point is allowable.