Network Security Module for Application Packet Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Bring Your Own Device (BYOD) trend poses security challenges for enterprise networks, including authentication, encryption, malware risk, and data protection, as conventional security measures like VPN tunnels and Mobile Device Management (MDM) either compromise user experience or fail to reduce malware risks effectively.
Innovation Solution
A computer-readable storage medium with code that intercepts and filters packets between devices and a protected network, identifying trusted applications and disposing of packets accordingly, either by forwarding, encrypting, decrypting, or dropping them, to control access and mitigate malware risks without restricting user device functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If MDM software is implemented to reduce malware risk, then security is improved, but user control and user experience deteriorate
Solution Approach 1:
The system segments security control by creating separate trusted and untrusted application environments. Trusted applications run with full access to enterprise resources, while untrusted applications are isolated in a restricted environment. This segmentation allows security to be improved for enterprise resources without completely restricting user control over their personal devices.
Solution Approach 2:
The system applies different security qualities to different applications on the same device. Instead of uniformly restricting all applications through MDM, the system identifies specific trusted applications and grants them appropriate access rights while maintaining restrictions on untrusted applications. This local differentiation preserves user control for personal use while enhancing security for enterprise resources.
2Reliability
If VPN tunnel is used for authentication and encryption, then network security is improved, but malware risk is not reduced
Solution Approach 1:
The system introduces an intermediary security layer between the VPN tunnel and enterprise resources. This intermediary layer identifies and classifies applications as trusted or untrusted, and routes traffic accordingly. The VPN tunnel continues to provide encryption and authentication, but the intermediary prevents untrusted applications from exploiting the tunnel to access enterprise resources, thereby reducing malware risk while maintaining network security.
3Object-affected harmful factors
If MDM software is implemented to prevent unauthorized apps, then malware risk is reduced, but device functionality and user experience are restricted
Solution Approach 1:
The system dynamically adjusts security restrictions based on application trust status rather than applying static MDM restrictions to all applications. Trusted applications are dynamically granted appropriate access rights, while untrusted applications receive restricted access. This dynamic approach reduces malware risk without permanently restricting device functionality, allowing users to maintain full control over their personal devices while protecting enterprise resources.
Data Source
AI summary
A computer-readable storage medium has embedded thereon non-transient computer-readable code for controlling access to a protected computer network, by intercepting packets that are being exchanged between a computer system and the protected network, and then, for each intercepted packet, identifying the associated application that is running on the computer system, determining whether the application is trusted, for example according to a white list or according to a black list, and disposing of the packet accordingly.