Network Destination Gating via Multi-Criteria Address Evaluation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face challenges in controlling access to network destinations to prevent security risks, malware spread, and compliance violations, as existing methods are inefficient in evaluating and blocking inappropriate content and malicious sites.
Innovation Solution
Implementing a DNS system and security gate that evaluates network destination addresses based on legitimacy, latency, and location criteria, allowing only evaluated and legitimate addresses to access the network, thereby blocking malicious or inappropriate content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual whitelisting of addresses is used to control network access, then security control is achieved, but maintenance complexity and time consumption increase
Solution Approach 1:
The system performs preliminary evaluation of network destinations by evaluating addresses based on multiple criteria (legitimacy, latency, location) before allowing network access. This advance evaluation automates the security control process, eliminating the need for manual whitelisting maintenance while ensuring reliable security filtering.
2Measurement precision
If comprehensive address evaluation with multiple criteria is implemented, then security detection accuracy improves, but system complexity increases
Solution Approach 1:
The evaluation system is segmented into three independent modules, each responsible for a specific criterion: legitimacy evaluation, latency evaluation, and location evaluation. This modular segmentation allows comprehensive security detection through multiple criteria while managing system complexity through clear separation of concerns and independent module operation.
3Reliability
If automated address evaluation is performed for all network destinations, then security filtering effectiveness improves, but processing time increases
Solution Approach 1:
The system performs address evaluation in advance and stores the results, so when network traffic needs to be filtered, the evaluation is already complete. This preliminary action ensures effective security filtering without adding processing time to the actual network traffic flow, as the evaluation work was done beforehand.
4Measurement precision
If multiple evaluation criteria are applied to network addresses, then ability to identify threats improves, but evaluation processing time increases
Solution Approach 1:
The evaluation process is divided into separate parallel modules for legitimacy, latency, and location assessment. These segmented modules can operate independently and in parallel, improving threat identification accuracy through comprehensive criteria while minimizing processing time through concurrent execution rather than sequential processing.
Data Source
AI summary
This disclosure describes techniques that include filtering or gating access to a network based on attributes or an evaluation of the network destination. In one example, this disclosure describes a method that includes receiving, by a computing system and from a client device, a request for information about a network destination; identifying, by the computing system and based on the request, an address associated with the network destination; evaluating, by the computing system, the address to determine whether the address passes a plurality of tests; responsive to determining that the address passes the plurality of tests, storing the address, by the computing system, as one of a plurality of scrutinized addresses; outputting, by the computing system and to the client device, the address.