Hardware Firewall Circuit for Secure Data Exchange

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current data exchange security solutions, such as software and hardware firewalls, are vulnerable to user manipulation, dependent on operating systems, and lack end-to-end encryption capabilities, failing to provide robust protection against network threats.

Innovation Solution

An electronic circuit mounted within a computer station with autonomous operation, limited hardware interaction, and end-to-end encryption capabilities, featuring a cryptographic module and anomaly detection, ensuring secure data transfer through network interfaces accessible only externally.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If a software firewall is used to provide fine-grained security policies, then adaptability to each user is improved, but vulnerability to user manipulation and software environment threats worsens

Engineering Contradiction:

Improvepersonalized security policiesVSAvoidvulnerability to manipulation

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent introduces a hardware firewall as an intermediary device between the network and the computer station. This hardware firewall operates independently from the operating system and user software environment, providing reliable security enforcement that cannot be manipulated by users or compromised by software vulnerabilities. The hardware firewall mediates all network traffic while maintaining personalized security policies through its own configuration interface, thus resolving the contradiction between adaptability and reliability.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Quantity of substance

If a hardware firewall is used to protect multiple computer stations, then coverage scope is improved, but ability to protect individual stations behind the firewall worsens

Engineering Contradiction:

Improvenumber of protected stationsVSAvoidprotection of individual stations

Core Design Contradiction:

Quantity of substanceVSReliability

Solution Approach 1:

The patent segments the firewall functionality by providing both a centralized hardware firewall for protecting multiple stations and individual hardware firewalls that can be installed in each computer station. This segmentation allows the centralized firewall to provide broad coverage while individual firewalls provide targeted protection for specific stations, resolving the contradiction between coverage scope and individual station protection capability.

Inventive Principle:

Principle #1Segmentation

3Reliability

If end-to-end encryption is implemented to secure data streams, then security level is improved, but difficulty of analyzing encrypted data worsens

Engineering Contradiction:

Improvesecurity levelVSAvoiddata stream analysis

Core Design Contradiction:

ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent implements end-to-end encryption as a preliminary action before data leaves the computer station. The hardware firewall encrypts data streams at the source and maintains encryption throughout transmission. This preliminary encryption action ensures high security levels while making the encrypted data unreadable to potential interceptors, thus resolving the contradiction between security level and data analysis difficulty by making the data inherently secure from the outset.

Inventive Principle:

Principle #10Preliminary action

4Device complexity

If a network card with firewall functionality is used to provide integrated security, then device integration is improved, but vulnerability to user circumvention worsens

Engineering Contradiction:

Improveintegrated security cardVSAvoiduser circumvention risk

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The patent introduces an external hardware firewall as an intermediary device that sits between the network and the computer station. This external firewall cannot be easily circumvented by users because it operates independently from the computer's internal components and user-accessible interfaces. The firewall mediates all network traffic while maintaining physical and logical separation from the protected system, thus resolving the contradiction between device integration and vulnerability to circumvention.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentEP2192515B1Electronic circuit for securing data exchanges between a computer terminal and a network

Publication Date: 2014.11.05 THALES SA

Figure 1a~1b
Figure 2~3
Figure 4

AI summary

The present invention relates to an electronic circuit for securing data exchange between a computer workstation and a network. The circuit comprises a first network interface (113) connected to the network. The circuit is characterized in that it includes at least one second network interface (112) connected to a network interface (111) of the computer workstation, a data processing unit for data transiting between the first network interface (113) and the second network interface (112), and an interface for connecting to an internal bus (103) of the computer workstation adapted to provide electrical connection. The electronic circuit does not include any means for transferring the processed data to the bus of the computer workstation. The invention is particularly applicable to the protection of personal computers handling confidential data.