Network Device Access Control via Threat Management Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network systems are unable to distinguish between malicious and trusted devices attempting to reconnect to a network, leading to vulnerabilities in data access control and security, as they either allow all devices to reconnect or block all devices, including trusted ones.
Innovation Solution
The system employs a threat management server that authenticates devices and uses whitelists and blacklists to differentiate between trusted and malicious devices, allowing only authenticated trusted devices to reconnect while blocking malicious ones, thereby enhancing network security and data access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional systems allow all devices to reconnect to the network, then device connectivity is improved, but network security deteriorates as malicious devices can rejoin
Solution Approach 1:
The system segments devices into distinct categories using authentication mechanisms. Devices are divided into authenticated (trusted) and unauthenticated (untrusted) groups, allowing differentiated access policies. This segmentation enables the network to selectively reconnect trusted devices while blocking malicious ones, resolving the contradiction between connectivity and security.
Solution Approach 2:
An authentication server acts as an intermediary between devices and the network. This mediator verifies device credentials and determines whether to permit reconnection. The intermediary enables fine-grained control over device access, allowing the system to maintain security while permitting legitimate devices to reconnect.
2Object-affected harmful factors
If conventional systems block all devices from reconnecting to the network, then network security is improved, but legitimate device connectivity deteriorates
Solution Approach 1:
The system implements dynamic access control where device connection status is not static but changes based on authentication results. Devices can transition between blocked and connected states depending on their credentials. This dynamic approach allows the system to maintain security blocks while permitting reconnection for authenticated devices, resolving the contradiction between security and connectivity.
Solution Approach 2:
The system changes the authentication parameter to determine device access. By verifying authentication credentials as a variable condition, the system can adjust access permissions dynamically. This parameter change enables differentiated treatment of devices based on their authentication status, allowing security maintenance while enabling legitimate reconnections.
3Object-affected harmful factors
If the system implements authentication verification for reconnection, then network security is improved, but system complexity increases
Solution Approach 1:
The authentication server provides multiple functions within a single system component. It handles device identification, credential verification, access decision-making, and connection state management. This multi-functionality consolidates complex security operations into a unified system, reducing overall complexity while maintaining enhanced security capabilities.
Data Source
AI summary
A system that includes a switch, a network authentication server (NAS), and a threat management server. The NAS sends a device identifier for an endpoint device and a port identifier identifying a port on the switch to a threat management server in response to the device passing authentication. The threat management server determines the endpoint device has a block on the port of the switch using the device identifier and the port identifier. The threat management server determines a block timeout period for the endpoint device and the port on the switch has expired. The threat management server removes the block for the endpoint device on the port on the switch in response to determining the block timeout period for the endpoint device and the port on the switch has expired.