Network Access Control via Local Domain Name Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security measures, such as honeypot systems, are ineffective in actively preventing worm viruses and hackers from infiltrating internal networks, leading to potential security threats and the spread of malware.
Innovation Solution
A network access control method that generates local domain names for internal network devices and authenticates them based on preset naming rules, recording IP addresses in forwarding information to determine whether to forward data packets, thereby enhancing security by filtering unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a honeypot system is deployed in the internal network, then hacker access behavior can be discovered, but the system cannot actively prevent worm virus spread and has low detection probability
Solution Approach 1:
The system performs preliminary authentication on domain name request packets before allowing communication. By verifying domain names in advance and pre-establishing forwarding information for authenticated devices, the system proactively prevents unauthorized access and worm propagation before they can spread through the network
Solution Approach 2:
The forwarding device acts as an intermediary between internal network devices and the external network. It mediates all communications by authenticating domain names and controlling packet forwarding based on authentication results, thereby preventing direct unauthorized access between devices
2Reliability
If domain name authentication is implemented for all internal devices, then network security is improved, but device complexity and authentication overhead increase
Solution Approach 1:
Each internal device performs self-authentication by generating domain names that encode its identity information and verifying its own domain name against authentication rules. This self-service mechanism eliminates the need for complex centralized authentication servers while maintaining security
Solution Approach 2:
The system transforms device identity parameters into domain name parameters for authentication. By encoding device identifiers (such as MAC addresses) into domain name structures and verifying these parameter transformations, the system achieves authentication through parameter validation rather than complex cryptographic protocols
3Measurement precision
If forwarding information is recorded for all authenticated address pairs, then access control precision is improved, but memory usage and processing overhead increase
Solution Approach 1:
The system extracts only the essential authentication result from domain name verification and stores only the necessary forwarding information for authenticated pairs. By taking out only the critical access control data rather than storing complete authentication records, the system reduces memory usage while maintaining precise access control
Solution Approach 2:
The system implements partial authentication by verifying only the necessary domain name components for access control decisions. Rather than performing exhaustive authentication checks on all packet fields, it focuses on validating the domain name structure and extracting sufficient information for forwarding decisions, reducing processing overhead
Data Source
AI summary
This application provides a network access control method. Before a second device accesses a target to-be-accessed device in an internal network, authentication is first performed on the second device by using a local domain name carried in a domain name request packet. Only when the local domain name is authenticated, an IP address of the second device and an IP address of the target device to be accessed by the second device are recorded in forwarding information. Therefore, when a data request packet is received, it may be determined, based on a source IP address, a destination IP address, and the forwarding information that are carried in the data request packet, whether to forward the data request packet.