Security Risk Visualization in Network Configuration Displays
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network configuration management systems, such as those described in Patent Literature 1, do not facilitate easy grasping of security risks within information systems, as they primarily group elements by security policy rather than highlighting attackable and protective measures.
Innovation Solution
A display apparatus and method that acquires configuration information of an information system, determines a display method based on security characteristics of attackable and preventive elements, and displays the system configuration to highlight security risks visually.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If network configuration diagram displays constituent elements with the same security policy grouped together, then network management is enabled, but security risk grasping becomes difficult
Solution Approach 1:
The patent segments security information display into multiple dimensions: security policy grouping (for management) and security risk highlighting (for risk assessment). Nodes are segmented by security policy categories while simultaneously being marked with security risk indicators, allowing both management and risk visualization to coexist without conflict.
Solution Approach 2:
The patent applies local quality by adding specific security risk indicators to individual nodes within the grouped display. Each node maintains its grouping characteristics while also displaying localized security risk information through color coding, icons, or labels, enabling risk identification without disrupting the organizational structure.
2Stability of the object's composition
If security policies are used as the basis for grouping elements, then organization is improved, but security risk identification becomes less obvious
Solution Approach 1:
The patent merges two display functions into one unified visualization: security policy-based grouping and security risk indication. The system combines organizational grouping with risk assessment markers on the same nodes, allowing users to see both the structured organization and security vulnerabilities simultaneously without requiring separate displays.
Solution Approach 2:
The patent uses color changes to encode security risk information on grouped nodes. Nodes displaying security risks are highlighted with specific colors or color intensities, allowing risk detection while maintaining the security policy grouping structure. This visual encoding enables rapid risk identification without disrupting the organizational hierarchy.
3Measurement precision
If detailed security information is displayed for each node, then risk assessment accuracy is improved, but system complexity increases
Solution Approach 1:
The patent applies partial action by selectively displaying security risk information only for nodes that have identified risks, rather than showing all possible security attributes for every node. This approach provides sufficient risk assessment information for decision-making while avoiding the complexity of displaying complete security profiles for all nodes uniformly.
Solution Approach 2:
The patent adds security risk information in a visual dimension (color, icon, label) rather than expanding textual information horizontally. This dimensional approach allows detailed risk assessment data to be conveyed through visual encoding, maintaining display simplicity while improving measurement precision for security risk evaluation.
Data Source
AI summary
A display apparatus (10) includes an acquiring unit (11) configured to acquire configuration information of an information system that includes a plurality of nodes; a determining unit (12) configured to determine a display method of displaying an object of security information display concerning a node in the acquired configuration information, based on a security characteristic of an attackable element used to attack the object of security information display and a security characteristic of a preventive measure element preventing an attack on the object of security information display; and a display unit (13) configured to, when displaying a system configuration of the information system, display the object of security information display in accordance with the determined display method.