Home Network Segmentation by Certificate Type to Block Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication systems face difficulties in suppressing security attacks within home networks, particularly when devices with different certificates attempt to communicate via a relay apparatus.
Innovation Solution
A network device employs a setting method that identifies the type of certificates held by connecting devices and assigns them to specific segments based on their certificate types, preventing frame forwarding between devices with different types to mitigate security attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If frame forwarding is enabled between all devices in a home network, then network connectivity and communication flexibility are improved, but security attacks become more difficult to suppress
Solution Approach 1:
The network is divided into multiple segments based on certificate types. The network device identifies the certificate type of each connecting device and assigns it to a corresponding segment. Frame forwarding is then controlled within these segments, allowing connectivity while preventing unauthorized cross-segment communication that could lead to security attacks.
2Ease of operation
If devices are connected without certificate verification, then ease of connection is improved, but security control capability deteriorates
Solution Approach 1:
Certificate verification is performed in advance during the connection establishment phase. The network device obtains and identifies the certificate type before the device is fully connected. Based on this preliminary verification, the device is assigned to an appropriate segment, ensuring security control is established before full network access is granted.
Data Source
AI summary
A setting method for a network device that forwards frames in a home network includes obtaining a first certificate of one of a plurality of types from a first device that is attempting to connect to the network device and that holds the first certificate, identifying a first type as the type of the obtained first certificate, and performing first setting processing for connecting the first device to the network device such that the first device belongs to a first segment associated with the identified first type among one or more segments that are one or more forwarding ranges of the frames of the network device and that are each associated with a type of certificate.