Micro-Segmented Network Access for Quarantining Vulnerable Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network systems struggle to effectively manage and secure devices that are no longer supported by security patches or are infected with malware, posing a risk to the network and other connected devices.
Innovation Solution
Dynamic Software Defined Networking (DSDN) is employed to quarantine or limit network traffic of vulnerable devices, create VPN tunnels for secure connections, and implement micro-segmented networks to isolate and protect devices, using techniques such as micronets and software-defined networking to manage and secure IoT and other interconnected devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If devices that are no longer supported by security patches or infected with malware are allowed to access the network freely, then network functionality and device usability are maintained, but network security and reliability deteriorate
Solution Approach 1:
The network is segmented into multiple zones using Software Defined Networking (SDN), where vulnerable devices are isolated in specific segments rather than having free access to the entire network. This allows the network to maintain functionality for secure devices while containing potential threats from vulnerable devices in isolated segments.
Solution Approach 2:
An SDN controller acts as an intermediary between vulnerable devices and the rest of the network infrastructure. The controller dynamically manages traffic flow, applying security policies and routing decisions that protect the network while allowing controlled access for vulnerable devices through intermediary security layers.
2Reliability
If network traffic from vulnerable devices is completely blocked, then network security is improved, but device functionality and network utility deteriorate
Solution Approach 1:
Different security policies and traffic handling approaches are applied to different devices based on their security status. Vulnerable devices receive localized security measures such as traffic filtering and routing restrictions, while secure devices enjoy full network access, thereby maintaining overall network utility while protecting against threats.
Solution Approach 2:
Instead of completely blocking all traffic from vulnerable devices, the system applies partial action by allowing only essential traffic while restricting potentially harmful traffic. This selective approach maintains necessary device functionality while providing sufficient security protection.
3Measurement precision
If traditional network security systems are used to identify and mitigate infected devices, then detection capability is maintained, but response effectiveness and adaptability to modern threats deteriorate
Solution Approach 1:
The network security system transitions from static, pre-configured security policies to dynamic, real-time security management using SDN. The controller continuously monitors network traffic and device status, dynamically adjusting security policies and traffic routing based on current threat levels and device security states, thereby improving response adaptability to evolving threats.
Solution Approach 2:
The system implements continuous feedback loops where the SDN controller monitors network traffic patterns, device behavior, and security events, then uses this feedback to dynamically adjust security policies and traffic routing decisions. This closed-loop approach enhances both detection precision and response adaptability to modern threats.
Data Source
AI summary
A system for micro-segmented networking is provided. A system controller is programmed to a) store a plurality of micro-segmented network accounts and a plurality of subscriber accounts, b) receive a request from a user device to activate a first micro-segmented network associated with a first subscriber account, c) authenticate the first subscriber account based on the subscriber information, d) activate the first micro-segmented network, including a plurality of device slots for a plurality of devices, e) transmit, to the user device, first device slot authentication information for a first device slot of the plurality of device slots; f) receive, from a first device connecting to the wireless network, the first device slot authentication information; g) authenticate the first device slot authentication information; and h) in response to authenticating the first device slot authentication information, connect the first device to the first micro-segmented network.