Communication Requirement Filtering by Logical Distance and Security Risk
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network requirement generation systems automatically generate communication requirements but require manual confirmation by network operators, leading to increased workload and potential misalignment with security policies.
Innovation Solution
A communication requirement generation system that calculates logical distances and security costs between network components, identifying requirements that need operator confirmation based on security levels and distances, reducing the operator's workload by focusing on high-risk communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automatic generation of communication requirements is implemented, then the workload of generating communication requirements is reduced, but the network operator still needs to confirm all generated requirements, increasing review workload
Solution Approach 1:
The patent segments communication requirements into two categories: high-risk requirements (requiring operator confirmation) and low-risk requirements (automatically permitted). This segmentation is based on calculating logical distances between components and comparing them against security policy thresholds, allowing the system to handle different types of requirements differently and reduce unnecessary confirmation workload.
Solution Approach 2:
The patent introduces an intermediary mechanism (logical distance calculation and security policy evaluation) between automatic requirement generation and operator confirmation. This intermediary automatically filters and prioritizes requirements, presenting only those that need human review to the operator, thus reducing the confirmation workload while maintaining security.
2Reliability
If distributed firewalls are introduced for each component in micro service architecture, then security control is improved, but the complexity of managing communication requirements increases
Solution Approach 1:
The patent implements a universal communication requirement management system that works across all distributed firewalls in the micro service architecture. The system calculates logical distances and evaluates security policies centrally, then applies the same evaluation logic to all components uniformly, simplifying management despite the distributed nature of the firewalls.
Solution Approach 2:
The patent changes the management approach from component-specific configuration to parameter-based evaluation. By introducing logical distance as a key parameter and using it to automatically evaluate communication requirements against security policies, the system simplifies management complexity while maintaining security control across all distributed firewalls.
3Measurement precision
If all communication requirements are manually reviewed, then security accuracy is improved, but time consumption and operator workload increase significantly
Solution Approach 1:
The patent applies partial action by reviewing only the necessary portion of communication requirements - specifically, only high-risk requirements that exceed security policy thresholds based on logical distance calculations. Low-risk requirements are automatically permitted without manual review, reducing time consumption while maintaining security accuracy for critical cases.
Solution Approach 2:
The patent implements a feedback mechanism where the system calculates logical distances, evaluates them against security policies, and uses the results to automatically classify requirements. This feedback loop enables the system to learn and adapt, maintaining high security accuracy for reviewed requirements while minimizing unnecessary reviews.
Data Source
AI summary
Provided is a communication requirement generation system capable of easily generating a communication requirement. The communication requirement generation system includes a storage unit that stores definition information for calculating a logical distance between components that perform communication in a predetermined network, a determining unit that calculate, for each of a plurality of communication requirements related to the component connected to the network, a logical distance between the component and a component which is a communication partner of the component based on the definition information stored in the storage unit, and determines, based on the calculated distance, whether each of the communication requirements is a communication requirement that requires confirmation of an operator of the network, and an output unit that outputs the communication requirement determined by the determining unit when the communication requirement is the communication requirement that requires confirmation of the operator of the network.