Network Access Control via Source Address Filtering and Traffic Thresholds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security methods fail to effectively prevent unauthorized access and malicious attacks in packet-based networks, particularly in voice and multimedia communications, while balancing security with user convenience.
Innovation Solution
A system with a storage module and controller that filters incoming data units by matching source addresses against stored information, denying entry if they do not match, and using network address and port translation to prevent unauthorized access and detect malicious attacks by establishing traffic thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network security filtering is implemented to prevent unauthorized access, then security of private network is enhanced, but device complexity increases
Solution Approach 1:
The system performs preliminary actions by pre-storing valid source address information in the storage module before actual data unit filtering occurs. This allows the controller to quickly compare incoming data units against pre-established criteria, enhancing security without requiring complex real-time analysis of each packet's full content.
Solution Approach 2:
The filtering system is segmented into distinct functional modules: a storage module for maintaining valid address information, a controller for detecting and comparing data units, and a decision-making component for allowing or denying entry. This segmentation reduces overall system complexity by assigning specific simple tasks to each module rather than requiring a monolithic complex filtering system.
2Reliability
If source address matching filtering is applied to all incoming data units, then unauthorized entry is reduced, but processing time increases
Solution Approach 1:
The system extracts only the critical source address information from incoming data units for comparison purposes, rather than analyzing entire packets or performing complex security checks on all data. This extraction of essential identifying information maintains effective access control while significantly reducing processing time by focusing only on the most relevant security-critical field.
3Object-affected harmful factors
If dynamic storage and matching of source addresses is implemented, then malicious attacks are prevented, but system resource consumption increases
Solution Approach 1:
The system uses simple, easily manageable data structures for storing source address information in the storage module. These stored address patterns are relatively simple in format and can be quickly updated or replaced as needed, allowing the system to maintain effective attack prevention through dynamic updates without requiring substantial computational resources or complex data management infrastructure.
Data Source
AI summary
A method and apparatus of protecting a first network from unauthorized access includes storing profile information for each call session, and determining if an unauthorized access of the first network is occurring based on the profile information. The profile information includes a predetermined threshold indicating a maximum acceptable rate of incoming data units from an external network to the first network. If the incoming data unit rate exceeds the predetermined threshold, then a security action is taken, such as generating an alarm or preventing further transport of data units from the external network to the first network.