Network Security Policy Generator for Automated Device Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security configuration verification methods for network devices are time-consuming and require significant manufacturer intervention, especially when multiple devices with different configurations need to be verified, leading to increased costs and efforts.
Innovation Solution
A security configuration verification device and method that generate a new scanning policy based on preconfigured policies, allowing network administrators to select and modify security check items according to specific network devices and environments, enabling self-defined verification policies without manufacturer intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security configuration verification is performed on multiple network devices using traditional methods, then security verification can be accomplished, but the time consumption increases significantly due to repeated manufacturer intervention
Solution Approach 1:
The patent applies preliminary action by pre-configuring scanning policies for different network device types before actual verification. The scanning policy configuration is performed in advance and stored in a database, so when verification is needed, the pre-configured policies can be directly selected and applied without requiring manufacturer intervention each time, thus reducing verification time while maintaining completeness
Solution Approach 2:
The patent uses copying by creating scanning policy templates for different network device types. Once a scanning policy is configured for a particular device type, it can be copied and reused for other devices of the same type, eliminating the need to reconfigure each device individually and significantly reducing the time required for verifying multiple devices
2Measurement precision
If custom scanning policies are created for each network device type, then verification accuracy improves, but the complexity of the verification system increases due to multiple preconfigured policies
Solution Approach 1:
The patent applies segmentation by dividing scanning policies into distinct templates based on network device types (routers, switches, firewalls, etc.). Each device type has its own dedicated scanning policy template with specific verification items tailored to that device type. This segmentation allows for precise verification of each device while managing complexity through organized categorization
Solution Approach 2:
The patent implements universality by creating a unified scanning policy management system that handles multiple device types through standardized templates. The system provides universal functions for policy creation, storage, selection, and execution that work across all network device types, reducing management complexity while maintaining verification accuracy through type-specific policy templates
3Reliability
If security manufacturers customize scanning schemes for each verification task, then verification thoroughness is ensured, but the cost and effort increase significantly
Solution Approach 1:
The patent applies self-service by enabling network administrators to independently select and apply pre-configured scanning policy templates without requiring security manufacturer intervention. The system provides self-service capabilities for policy selection, configuration application, and verification execution, eliminating the need for external manufacturer support while maintaining thorough verification through specialized templates
4Reliability
If comprehensive security check items are included in scanning policies, then verification completeness improves, but the time required for each verification increases
Solution Approach 1:
The patent applies local quality by tailoring the scope and depth of security check items to match the specific requirements of each network device type. Each scanning policy template includes only the verification items relevant to that device type, avoiding unnecessary checks. This localized approach ensures comprehensive verification for each device while reducing overall verification time by eliminating redundant checks across different device types
Data Source
AI summary
The invention discloses a security configuration verification device for performing a security configuration verification on a network device, which comprises: one or more preconfigured scanning policies; a scanning policy generator, which selects a scanning policy from the one or more preconfigured scanning policies to generate a new scanning policy corresponding to the network device; and a scanner, which performs the security scanning on the network device with the generated new scanning policy and thereby performs the security configuration verification. The invention also discloses a corresponding security configuration verification method and a network system employing the verification device.