Micronet Segmentation for Secure IoT Device Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems struggle to effectively manage and isolate infected or vulnerable devices within a network, particularly IoT devices, without significantly impacting other network operations, and fail to provide secure connectivity for devices lacking user interfaces or advanced authentication capabilities.
Innovation Solution
Dynamic Software Defined Networking (DSDN) is employed to create micronets that dynamically isolate infected devices, limit their network traffic, and establish secure VPN tunnels for trusted devices, using PKI certificates and intelligent service logic to manage network access and segmentation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network security systems are used to identify and mitigate infected devices, then network security is improved, but network performance and operation are significantly impacted
Solution Approach 1:
The network is segmented into multiple micronets, each with its own SDN controller. Infected devices are isolated into specific micronets, allowing security measures to be applied locally without affecting the entire network. This segmentation enables targeted mitigation while maintaining overall network performance.
Solution Approach 2:
SDN controllers act as intermediaries between infected devices and the rest of the network. The controllers manage traffic flow, apply security policies, and coordinate remediation actions, allowing security operations to proceed without direct interference with normal network operations.
2Reliability
If infected devices are quarantined or traffic is limited to approved destinations, then network security is improved, but device connectivity and functionality are reduced
Solution Approach 1:
The system dynamically adjusts traffic limitations based on device security status and remediation progress. Devices can transition between different connectivity states (full access, limited access, quarantined) as their security posture changes, allowing connectivity to adapt to security requirements rather than being statically restricted.
Solution Approach 2:
The system changes network access parameters (traffic limits, approved destinations, VPN tunnel configurations) based on device security status. These parameter changes allow flexible control over device connectivity, enabling security measures to be applied without permanently restricting device functionality.
3Reliability
If VPN tunnels are created for devices with strong security, then network security is improved, but system complexity increases
Solution Approach 1:
Devices with strong security credentials (PKI certificates) can autonomously establish VPN tunnels to approved destinations. The SDN controller automatically provisions and manages these tunnels based on device identity and security policies, reducing the need for manual configuration and lowering operational complexity.
Data Source
AI summary
A system for micro-segmented networking is provided. A system controller is programmed to a) store a plurality of micro-segmented network accounts and a plurality of subscriber accounts, b) receive a request from a user device to activate a first micro-segmented network associated with a first subscriber account, c) authenticate the first subscriber account based on the subscriber information, d) activate the first micro-segmented network, including a plurality of device slots for a plurality of devices, e) transmit, to the user device, first device slot authentication information for a first device slot of the plurality of device slots; f) receive, from a first device connecting to the wireless network, the first device slot authentication information; g) authenticate the first device slot authentication information; and h) in response to authenticating the first device slot authentication information, connect the first device to the first micro-segmented network.