Secured Network Switch Filtering for Home Device Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Home networks are increasingly vulnerable to cyberattacks due to the growing number of connected devices, lack of technical expertise among users, and ineffective reliance on traditional security measures like firewalls and VLANs, which can be easily bypassed or exploited.
Innovation Solution
A secured network switch that employs a Layer 2 filter/firewall to isolate devices based on predefined relationships, manages network neighbor discovery, and controls broadcast, multicast, and multicast traffic, providing a user-friendly interface for administrators to manage device permissions and relationships.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security measures like firewalls and VLANs are used, then network security is provided, but they can be easily bypassed or exploited and require technical expertise to manage
Solution Approach 1:
The patent segments network traffic into control plane traffic and data plane traffic, processing them through different paths. Control plane traffic receives full security inspection and filtering, while data plane traffic uses optimized fast-path forwarding. This segmentation allows robust security without requiring users to manually configure complex security rules for all traffic.
Solution Approach 2:
The patent introduces an intermediary security processing layer that sits between the network interface and the forwarding engine. This intermediary layer handles security inspections, threat detection, and filtering automatically, shielding users from the complexity of security management while maintaining strong security posture.
2Reliability
If comprehensive security filtering is applied to all packets, then network security is improved, but network latency increases due to processing overhead
Solution Approach 1:
The patent divides packet processing into two segments: control plane processing for security-critical packets and fast-path processing for routine data traffic. By segmenting the processing paths, the system applies comprehensive security filtering only where necessary while allowing bulk traffic to flow with minimal latency.
Solution Approach 2:
The patent applies full security inspection selectively to control plane traffic and suspicious packets, while applying lighter-weight filtering to data plane traffic. This partial action approach ensures security is maintained for critical traffic without subjecting all traffic to the full overhead of comprehensive security processing.
3Reliability
If network segmentation and device isolation are implemented, then unauthorized communication is prevented, but network management complexity increases
Solution Approach 1:
The patent implements self-service security where the system automatically discovers devices, profiles them, and applies appropriate security policies without user intervention. The system autonomously manages device isolation and segmentation, preventing unauthorized communication while eliminating the need for users to manually configure complex security policies.
Solution Approach 2:
The patent employs feedback mechanisms where the system continuously monitors network traffic, device behavior, and security events. Based on this feedback, the system dynamically adjusts security policies and device isolation rules, automatically adapting to new threats and devices without requiring manual reconfiguration.
Data Source
AI summary
A secured network switch is configured to enforce security between devices on a home network to ensure vulnerable devices do not compromise assets on privileged devices. The secured switch operates at the data link layer and is configured to enforce security based on device management and enforcement. The switch is configured to only allow devices that have been classified to allow communication with each other to forward packets to each other. The switch is configured to use broadcast, multicast, and network neighbor management to control the device discovery through the switch. The secured switch will also gather device information by snooping various sources of device ‘broadcast’ information and present this information via a user interface to aid network administrators in classifying devices and creating device to device relationships.