Network Access Control via Authorized Tunnel Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network access control technologies, such as ARP spoofing and VPNs, face vulnerabilities in managing data packet flow and are susceptible to security breaches at higher OSI layers, particularly after tunnel generation, and are not effective in controlling unauthorized access.
Innovation Solution
A system comprising a node and a server that utilize an access control application to detect network access events, verify the existence of authorized tunnels, and either transmit or drop data packets based on tunnel authorization, ensuring secure data transmission by managing access through a database that stores policy and tunnel information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ARP spoofing is used to block unauthorized terminals, then network access control is improved, but network performance deteriorates due to increased network load
Solution Approach 1:
The patent introduces a gateway as an intermediary component between terminals and the network. The gateway centrally manages access control decisions and tunnel establishment, eliminating the need for terminals to perform ARP spoofing. This mediator approach reduces network load while maintaining effective access control through centralized policy enforcement.
Solution Approach 2:
The patent replaces the mechanical ARP spoofing technique with a tunnel-based virtual private network approach. Instead of using IP address manipulation at the network layer, the system establishes encrypted tunnels through the gateway, providing access control at the application layer while avoiding the performance penalties of ARP-based methods.
2Reliability
If firewall is used to control data packet flow, then data transmission security is improved, but connection establishment capability deteriorates
Solution Approach 1:
The patent implements preliminary action by establishing tunnels before data transmission occurs. The gateway pre-authenticates terminals and sets up encrypted tunnels in advance, so that when data needs to be transmitted, the tunnel is already in place. This eliminates the need for real-time connection establishment decisions during data flow, simplifying the firewall's role to merely enforcing pre-established policies.
3Reliability
If VPN is used to ensure data integrity and confidentiality, then data security is improved, but flow management capability deteriorates after tunnel generation
Solution Approach 1:
The gateway serves as an intermediary that manages tunnel generation and data flow centrally. Rather than requiring complex flow management at individual terminals or within encrypted tunnels, the gateway mediates all connection requests and maintains simplified policy-based control. This centralization reduces the complexity of flow management while preserving VPN security benefits.
4Reliability
If TCP/IP-based access control is used, then network layer security is improved, but vulnerability to higher layer attacks increases
Solution Approach 1:
The patent applies dimensionality change by moving access control from the network layer (TCP/IP) to the application layer. Instead of controlling traffic based on IP addresses and ports, the system establishes tunnels based on application-level identities and policies. This vertical shift in the OSI model provides security at a higher dimension, making the system resistant to both network-layer and application-layer attacks simultaneously.
Data Source
AI summary
A node includes: a communication circuit; a processor operatively connected to the communication circuit; and a memory operatively connected to the processor and storing a target application and an access control application, wherein the memory stores instructions that when executed by the processor, cause the node to: detect a network access event of the target application to a destination network through the access control application, identify whether a tunnel corresponding to identification information of the target application and the destination network and authorized by an external server exists, transmit a data packet of the target application through the authorized tunnel using the communication circuit, when the authorized tunnel exists, and drop the data packet of the target application, when the authorized tunnel does not exist.