Firewall Rule Segmentation for Attack Resilience
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems face challenges in reliably restricting network traffic to prevent unauthorized changes to firewall configurations during attacks, as untrained users or attackers may inadvertently or maliciously revert to original settings.
Innovation Solution
A security system with an administration module that activates an additional set of rules for filtering data traffic between networks, preventing reversion to original settings by using a blocking command, and incorporating a filter module that enforces both original and additional rules for secure data forwarding.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the firewall configuration is made reconfigurable during attacks, then the ability to defend against attacks is improved, but the risk of improper revocation or change by attackers or untrained users increases
Solution Approach 1:
The rule set is segmented into two distinct parts: an originally activated rule set and an additional rule set. The administration module can selectively activate the additional rule set during attacks while maintaining the original rule set. This segmentation allows the system to enforce strict filtering during attacks without completely disabling the original configuration, thus improving defense capability while preventing complete configuration loss.
Solution Approach 2:
The system performs preliminary action by pre-configuring the additional rule set in advance, specifically designed to restrict data traffic more strictly during attack scenarios. This pre-prepared rule set can be quickly activated when needed, providing immediate defense enhancement without requiring complex real-time configuration changes, thereby improving both response capability and configuration security.
2Reliability
If the originally activated rule set is completely replaced during an attack, then the restriction of data traffic is improved, but the risk of unauthorized changes or accidental reversion increases
Solution Approach 1:
The system merges the originally activated rule set and the additional rule set into a unified filtering mechanism. Both rule sets are evaluated together when filtering data traffic, ensuring that the strict restrictions of the additional rule set are enforced while maintaining the structure and manageability of the original rule set. This combination improves traffic restriction capability without significantly increasing configuration management complexity.
Solution Approach 2:
The additional rule set acts as a temporary copy or supplement to the original rule set rather than a complete replacement. This copying approach allows the system to enforce strict traffic restrictions during attacks by applying the additional rules alongside the original rules, while preserving the original configuration for easy management and potential restoration, thus balancing traffic restriction with configuration simplicity.
3Reliability
If a blocking command is implemented to prevent reversion to original settings, then the security during attacks is improved, but the ease of restoring normal operation may be reduced
Solution Approach 1:
The system implements feedback mechanisms where the administration module continuously monitors the activation state of the additional rule set and the current data traffic patterns. When the attack condition ceases or a restoration command is received, the system provides feedback to automatically or manually deactivate the additional rule set and restore normal operation. This feedback loop maintains high security during attacks while enabling straightforward restoration when needed.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
The invention relates to a security system (100) and a method for filtering data traffic between a first network (NW1) and a second network (NW2), wherein the security system (100) is arranged between the first and the second network. The security system (100) comprises a management module (101) configured to activate an additional rule set (P2) for the security system for filtering the data traffic, depending on a control command, and to prevent a reset to an originally activated rule set (P1) of the security system and a modification of the additional rule set by means of a lock command and/or upon activation of the additional rule set.Furthermore, the backup system (100) includes a filter module (102) which is configured to filter the data traffic between the first network (NW1) and the second network (NW2) according to the originally activated rule set (P1) and the additional rule set (P2) or only according to the additional rule set (P2) and to allow the correspondingly filtered data traffic.