Network Access Control via Gatekeeper Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems rely solely on user authentication, which does not ensure that access devices meet security policies, and the use of gatekeepers to enforce these policies can be bandwidth-limited and costly, especially in large networks with many access points.
Innovation Solution
Implementing a network architecture that divides the protected network into a restricted subset with a gatekeeper and a less-restricted subset, where access requests are initially processed by the gatekeeper, and if approved, the communication port is reconfigured to allow access to the less-restricted subset, reducing the need for continuous gatekeeper involvement in data transfer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a gatekeeper is used to enforce security policies on all access devices, then network security is improved, but bandwidth efficiency deteriorates and system cost increases
Solution Approach 1:
The network is segmented into two distinct zones: a restricted subset containing the gatekeeper for policy enforcement, and a less-restricted subset for general network access. Access points are configured to redirect traffic to appropriate subsets based on device compliance status, separating security functions from data transmission functions.
Solution Approach 2:
Access points dynamically reconfigure their communication ports based on device authentication results. Unauthenticated devices are directed to the restricted subset, while authenticated compliant devices are reconfigured to access the less-restricted subset, enabling dynamic adaptation to device security states.
2Reliability
If a gatekeeper processes all access requests and traffic, then security policy enforcement is ensured, but system complexity and cost increase
Solution Approach 1:
The gatekeeper's function is extracted and limited to processing only access requests and policy enforcement decisions. Routine data traffic is extracted from the gatekeeper's processing path and routed directly through access points to the less-restricted subset, reducing the gatekeeper's processing burden.
Solution Approach 2:
Access points serve as intermediaries that handle both authentication decisions and data traffic routing. They mediate between the restricted subset (gatekeeper) and the less-restricted subset, configuring communication ports to direct traffic appropriately without requiring continuous gatekeeper involvement.
3Ease of operation
If user authentication alone is used for access control, then ease of operation is maintained, but security reliability deteriorates
Solution Approach 1:
Security policy verification is performed as a preliminary action during the authentication process. The gatekeeper evaluates device compliance with security policies before granting access to the less-restricted subset, ensuring that only secure devices receive full network access.
Solution Approach 2:
Different quality levels of network access are provided based on device security compliance. Compliant devices receive access to the less-restricted subset with full functionality, while non-compliant devices are limited to the restricted subset, applying differentiated security measures to different users.
Data Source
AI summary
A new approach to network security includes manipulating an access point such that an initial communication from an external device is passed to a restricted subset of a computing network including a gatekeeper. The gatekeeper is configured to enforce a security policy against the external device before granting access to a less-restricted subset of the computing network. If requirements of the security policy are satisfied, then the gatekeeper reconfigures the access point such that further communication from the external device may be received by elements of the less-restricted subset. Enforcement of the security policy optionally includes performing a security audit of the external device.