Home Gateway Security Rules for Malicious IoT Device Containment

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing security measures for home communication networks do not adequately protect the gateway from malicious devices that can exploit security flaws, leading to potential damage or overload.

Innovation Solution

Implementing a method to manage security rules for each connected device based on its interactions with the gateway, including acquisition, observation, and decision steps to enforce containment actions if rules are violated, thereby safeguarding the gateway and network.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If security rules are imposed on connected objects, then communication security is improved, but the gateway remains vulnerable to attacks from malicious devices

Engineering Contradiction:
Improvecommunication securityVSAvoidgateway vulnerability
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a gateway as an intermediary device between connected objects and the local network. The gateway implements a security management system that acts as a mediator to filter, monitor, and control communications from connected objects before they reach other network devices. This intermediary mechanism protects the gateway itself and the broader network from malicious activities while still allowing legitimate communications to pass through.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent implements preliminary security actions by establishing security rules and policies before malicious attacks can occur. The gateway pre-configures security management systems, defines communication restrictions, and sets up monitoring mechanisms in advance. When devices connect, their communications are immediately subject to these pre-established security measures, preventing potential damage before it can occur to the gateway or network.

Inventive Principle:
Principle #10Preliminary action

2Reliability

If the gateway monitors and enforces security rules for each connected object, then network protection is improved, but system complexity increases

Engineering Contradiction:
Improvenetwork protectionVSAvoidsecurity management complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent implements a universal security management system at the gateway that handles multiple functions simultaneously. The gateway's security management system universally applies to all connected objects regardless of their type or purpose. It performs multiple functions including authentication, authorization, monitoring, and enforcement of security rules for diverse devices (smartphones, tablets, sensors, cameras) through a single integrated mechanism, reducing the need for separate security systems for each device type.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Solution Approach 2:

The patent utilizes parameter changes to manage security dynamically. The security management system adjusts security parameters such as communication limits, data transmission rates, and access permissions based on the device type, connection status, and observed behavior. These parameter changes allow the system to adapt security measures to different scenarios without requiring complete reconfiguration, simplifying the management of complex security requirements for multiple diverse devices.

Inventive Principle:
Principle #35Parameter changes

Data Source

PatentEP4173249B1Management of the security of a communicating object
Publication Date: 2026.01.28 ORANGE SA
  • EP4173249B1 patent drawingFigure 1~2
  • EP4173249B1 patent drawingFigure 3

AI summary

The invention relates to a method for managing a home gateway (10) of a local area communication network. The gateway comprises a plurality of components, called sensitive components (MEM, PROC, BUS, CLINT, CLOC, SWEB, DOMOS). The network comprises at least one communicating object (14, 15, 16) able to be connected to said network via the gateway. The method comprises: - a step of acquiring (E22) at least one security rule (RULE) relating to at least one interaction of the object with at least one of said components of the gateway; - an observation step (E27) involving observing at least one interaction of said communicating object with at least one of said components of said gateway; - a step of deciding (E28), on the basis of said observation, on an action on said connected object.