Controller-Based Network Access via DNS Validation and Flow Checks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network access control technologies, such as TCP/IP-based systems, are vulnerable to ARP spoofing, bypass attacks, and man-in-the-middle attacks, and fail to provide comprehensive security, especially at the application layer, leading to potential data leaks and unauthorized access.
Innovation Solution
A controller-based system that utilizes a communication circuit, processor, and memory to perform domain name system (DNS) queries and domain validity checks, blocking unauthorized access and managing network connections through a trusted DNS, thereby enhancing security and preventing DNS pharming threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ARP spoofing is used for network access control, then unauthorized terminals can be blocked, but network load increases
Solution Approach 1:
The patent introduces a controller as an intermediary component that centralizes the ARP spoofing functionality. Instead of each network access controller (NAC) device performing ARP spoofing independently (which creates redundant network traffic), a single controller manages the ARP spoofing process for multiple NAC devices. This intermediary approach maintains the security function of blocking unauthorized terminals while significantly reducing the overall network load by eliminating duplicate ARP spoofing traffic from multiple devices.
2Reliability
If firewall is used to control data packet flow, then data transmission can be filtered, but connection establishment between nodes cannot be directly managed
Solution Approach 1:
The patent merges the functionality of firewalls (data packet filtering) with network access control (connection management) into a unified system. The controller integrates both the firewall's ability to filter data packets based on policies and the NAC's ability to manage connection establishment. This combination allows the system to both control data transmission and directly manage node connections, resolving the limitation where firewalls could filter packets but not establish connections.
3Reliability
If VPN is used for data packet integrity, then confidentiality can be guaranteed, but management of data packet flow becomes vulnerable
Solution Approach 1:
The patent introduces a controller as an intermediary that manages VPN tunnel creation and data packet flow. Instead of complex client-side flow management that is vulnerable to attacks, the controller centrally manages the VPN connections and enforces flow control policies. This intermediary approach simplifies the complexity by centralizing management functions and improves security by preventing client-side manipulation of flow management, while still maintaining the confidentiality benefits of VPN encryption.
4Reliability
If TCP/IP-based technologies are used for network access control, then network communication can be controlled, but security vulnerabilities at other OSI layers remain
Solution Approach 1:
The patent extends network access control from the traditional TCP/IP layer (lower OSI layers) to the application layer (higher OSI layer). By implementing control at the application layer through the controller, the system adds a new dimension of security that can inspect and control traffic based on application-specific information. This multi-layered approach maintains the existing TCP/IP-based communication control while adding security capabilities at the application layer, thereby addressing vulnerabilities that exist only at higher OSI layers.
Data Source
AI summary
A node according to an embodiment disclosed in the present document may store instructions which cause the node to: detect a network access event through an access control application; transmit a domain name system (DNS) query request packet to a first external server through the access control application; receive a DNS query result from the first external server, wherein the DNS query result includes domain information and IP information; and transmit a domain validation request or a network access request including the domain information to a second external server on the basis of whether a data flow corresponding to the IP information exists, through the access control application.