Network Security Specification Discrepancy Detection via Permitted Connections
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques fail to identify discrepancies between two distinct network security specifications that are expected to implement the same underlying network security policy in computer networks, leading to potential security vulnerabilities during migrations or changes in security policies.
Innovation Solution
A system compares two network security specifications by generating a representation of permitted connections between subnetworks using a data structure, allowing for efficient identification of discrepancies, and takes appropriate action such as generating a report or sending alerts to ensure consistency in network security policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional techniques are used to determine discrepancies, then inconsistencies within the same network security specification can be identified, but discrepancies between two distinct network security specifications cannot be detected
Solution Approach 1:
The patent segments the comparison task into two distinct phases: first comparing rules within each individual specification, then comparing the aggregated permitted connections between services across both specifications. This segmentation allows the system to handle multiple specifications independently before performing inter-specification comparison, thereby resolving the contradiction between detecting intra-specification inconsistencies and identifying inter-specification discrepancies.
Solution Approach 2:
The patent introduces an intermediary representation called 'permitted connections structure' that aggregates all permitted connections between services from a given specification. This intermediary structure serves as a mediator that enables comparison between distinct specifications by translating their respective rules into a common format, thus allowing discrepancy detection between specifications while maintaining the ability to handle different specification formats and languages.
2Adaptability or versatility
If network security specifications are migrated from one language to another, then the new specification can be implemented, but discrepancies between the old and new specifications may go undetected
Solution Approach 1:
The patent creates a copied representation of the permitted connections structure from both the old and new network security specifications. By generating these copies in a standardized format, the system can compare the semantic meaning of connections across different languages without being constrained by syntax differences. This copying approach preserves the original specifications while enabling reliable comparison, thus maintaining policy consistency during language migration.
Solution Approach 2:
The patent transforms the network security specifications by changing their representation parameters from language-specific syntax to a unified permitted connections structure format. This parameter transformation allows the system to compare specifications across different languages by focusing on the essential connection relationships rather than language-specific details, thereby ensuring reliability during migration while maintaining adaptability to various languages.
3Measurement precision
If a comprehensive comparison between two network security specifications is performed, then all discrepancies can be identified, but the complexity of the comparison process increases
Solution Approach 1:
The patent divides the comprehensive comparison process into manageable segments: first building permitted connections structures for each specification separately, then comparing these structures in a second phase. This segmentation reduces the overall complexity by breaking down the monolithic comparison task into smaller, independent sub-tasks that can be processed sequentially, while still achieving comprehensive discrepancy identification.
Solution Approach 2:
The patent extracts only the essential permitted connection relationships from the network security specifications, removing irrelevant details such as language-specific syntax and implementation particulars. By extracting and comparing only the critical connection permissions between services, the system achieves comprehensive discrepancy identification while minimizing comparison complexity by focusing solely on the essential security policy elements.
Data Source
AI summary
A system compares two network security specifications expected to implement the same network security policy for a network and identifies possible discrepancies between them. The system generates a representation of relations between subnetworks of the network for each network security specification. The representation efficiently stores permitted connections between subnetworks. The system compares the representations corresponding to the two network security specifications to identify discrepancies across the two network security specifications. If discrepancies are identified across the two network security specifications the system generating a report identifying the discrepancies.