Network Access Control via Security Zone Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional firewalls in IP networks are ineffective in selectively controlling user access to resources, as they cannot distinguish between users originating from multi-user systems, leading to unrestricted access to resources with heightened security requirements.
Innovation Solution
Implementing a system that classifies network resources into security zones and uses a data structure to map resources to their respective zones, allowing only authorized users access by determining the most specific security zone associated with each resource and verifying user permissions through a security manager like RACF, thereby enhancing access control beyond traditional packet filtering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional firewalls are used for packet filtering, then network access control is provided, but user-specific access control to network resources cannot be achieved
Solution Approach 1:
The patent segments the network space into multiple security zones (e.g., public, private, restricted zones) and assigns different access control policies to each zone. This allows the system to provide user-specific access control by determining which security zone a target resource belongs to and applying appropriate authorization rules for that zone, thereby resolving the contradiction between providing general access control and enabling user-specific control.
Solution Approach 2:
The patent introduces a security zone concept as an intermediary layer between the firewall and network resources. The security zone acts as a mediator that translates user authentication information into zone-based access decisions, enabling the system to control access to specific network resources based on user identity while working within the constraints of conventional firewall packet filtering capabilities.
2Object-affected harmful factors
If packet level filtering is used to control access, then basic security is provided, but selective user access control to specific resources is not achieved
Solution Approach 1:
The patent performs preliminary authentication of user identity before allowing access to network resources. By authenticating users in advance and associating them with specific security zones, the system ensures that only authorized users can access resources in their designated zones, thereby preventing unauthorized access while maintaining accurate user identification throughout the network communication process.
Solution Approach 2:
The patent implements a feedback mechanism where the system continuously monitors network traffic, identifies the security zone of target resources, and dynamically adjusts access decisions based on the authenticated user's authorized zones. This feedback loop ensures that packet filtering rules are applied precisely according to user identity and security zone requirements, improving both unauthorized access prevention and user identification accuracy.
Data Source
AI summary
Methods, systems and computer program products are provided for selectively allowing a user of a multi-user system access to a plurality of resources in a network. Pursuant to these methods, systems and computer program products, a request, originated by a user of the multi-user system, may be received to transmit a message over the network to one of the plurality of resources in the network. A security zone associated with this resource may then be identified. Pursuant to the operations of the present invention, if it is determined that the user is authorized access to the identified security zone, the message may be forwarded over the network to the resource.