Network Access Security Verification for Connected Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Connected devices, such as smart objects, face security risks when accessing websites directly using IP addresses, as they can be compromised by malicious third parties for data transmission and unauthorized access without preliminary domain name resolution checks.
Innovation Solution
A method that intercepts and analyzes requests to access websites by obtaining and comparing IP address information from a domain name resolution server, stored in a secure environment, to determine whether to proceed with the access request, considering both website and device information for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If connected devices access websites directly using IP addresses, then access speed is improved, but security risk increases due to lack of preliminary domain name resolution checks
Solution Approach 1:
The patent performs domain name resolution and security verification in advance before allowing direct IP access. The system pre-resolves domain names to IP addresses, checks the IP addresses against malicious domain databases, and stores verified results for subsequent direct access, thus eliminating the need for real-time DNS queries while maintaining security
Solution Approach 2:
The patent introduces an intermediary security verification system that acts as a mediator between the device and the target website. This intermediary checks IP addresses against databases of malicious domains, blocklists, and category filters before allowing access, providing security validation without requiring the device to perform complex DNS resolution for each access attempt
2Reliability
If domain name resolution is performed for every website access, then security is improved through preliminary checks, but access time increases due to additional resolution steps
Solution Approach 1:
The system performs domain name resolution and security verification in advance, storing the results for future direct access. Verified IP addresses are cached with their security status, allowing subsequent accesses to bypass DNS resolution entirely while maintaining security checks through the pre-computed verification database
Solution Approach 2:
The system dynamically adapts its access method based on the verification result: for verified domains, it uses direct IP access to save time; for unverified or suspicious domains, it performs full domain name resolution with security checks. This dynamic approach optimizes access time based on the trust level of each domain
3Ease of operation
If direct IP address access is allowed, then device simplicity is maintained, but vulnerability to malicious third parties increases
Solution Approach 1:
The patent introduces an intermediary security verification system that automatically checks IP addresses against databases of malicious domains, blocklists, and category filters. This intermediary operates transparently in the background, requiring no changes to the device's simple interface while providing robust security validation before allowing access
Solution Approach 2:
The system implements self-service security verification by automatically maintaining updated databases of malicious domains and blocklists, and performing real-time checks without requiring user intervention. The security verification operates autonomously, keeping the device interface simple while providing protection against malicious access
Data Source
AI summary
A method for managing a request to access an internet site originating from a device and transmitted through a telecommunication network. The method includes: receiving a request including a domain name, originating from the device, intended to be transmitted to a domain name resolution server; routing the request to a domain name resolution server; receiving a response including an IP address and information, called first information, linked to the IP address; transmitting or not transmitting the request over the network as a function of the first information.