Network Security Device Using IP Address Country Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network management systems lack effective methods to block communication with security-threatening countries based on IP addresses, particularly in scenarios where users attempt to bypass restrictions through virtual private networks or proxy servers.
Innovation Solution
A network security method that maintains a blocked country database (DB) to identify and block communication packets by extracting and analyzing source and destination IP addresses, using a country-by-country IP database to determine the country of origin and apply blocking rules based on predetermined packet thresholds or administrator instructions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network management systems block communication based on IP addresses, then network security is improved, but the system complexity increases due to the need for country-by-country IP databases and multiple blocking criteria
Solution Approach 1:
The patent pre-establishes a blocked country database containing country codes and IP address ranges before operation. This preliminary preparation allows the system to quickly determine whether communication should be blocked without complex real-time analysis, thereby improving security while managing system complexity through advance configuration.
Solution Approach 2:
The patent segments the blocking criteria into multiple independent components: country code matching, IP address range matching, user identifier matching, protocol matching, and port matching. Each component operates independently and can be configured separately, which simplifies the overall system structure while achieving comprehensive security control.
2Reliability
If the system blocks all communication from certain countries, then security is improved, but legitimate communication may be blocked reducing productivity
Solution Approach 1:
The patent applies different blocking rules to different communication scenarios by allowing administrators to configure specific protocols and ports for each blocked country. This enables selective blocking where only certain types of communication from specific countries are restricted, while other legitimate communications remain unaffected, thus maintaining productivity while improving security.
Solution Approach 2:
The patent implements dynamic blocking rules that can be adjusted based on communication patterns and administrator decisions. The system can learn from communication behaviors and modify blocking decisions accordingly, allowing legitimate communications to pass through while blocking malicious ones, thereby balancing security and productivity.
3Measurement precision
If the system monitors and analyzes packet information to identify blocked countries, then blocking accuracy is improved, but the processing time and energy consumption increase
Solution Approach 1:
The patent extracts only the essential blocking criteria from packet information - specifically the destination IP address and comparing it against pre-configured IP ranges in the blocked country database. By extracting only the necessary information for blocking decisions rather than analyzing all packet fields, the system achieves accurate blocking while minimizing processing energy consumption.
Solution Approach 2:
The patent pre-loads and stores country IP address ranges, protocols, and ports in the blocked country database before operation. This preliminary preparation allows the system to perform simple lookup operations during packet processing rather than complex real-time analysis, thereby maintaining high blocking accuracy while reducing processing time and energy usage.
Data Source
AI summary
The present invention provides a network security method, which comprises the steps of: maintaining information on blocked countries, to be blocked from data communication, in a blocked country database; identifying an external IP address by extracting at least one of a source IP address and a destination IP address of a communication packet transmitted on a network; identifying a country to which the identified external IP address belongs; and blocking the communication packet when the country to which the identified external IP address belongs is included in the blocked countries.