Overlay-Underlay Network Blocking for Unauthorized IoT Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures, such as Endpoint Detection and Response (EDR), require high costs for deployment on each terminal and cannot be applied to devices like OA and IoT terminals, leaving them vulnerable to security risks.
Innovation Solution
An information processing system comprising an upper NW device that detects unauthorized communication and notifies a lower NW device, which then blocks such communication, allowing for cost-effective security enhancement by separating detection and blocking points.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If EDR is deployed on each terminal to improve security detection, then security detection capability is improved, but deployment cost increases significantly
Solution Approach 1:
The patent introduces a network device as an intermediary that performs security detection functions centrally. Instead of deploying EDR on each terminal, the network device acts as a mediator that detects unauthorized communications and coordinates with terminals to block threats, thereby maintaining security detection capability while eliminating the need for complex terminal-by-terminal deployment
Solution Approach 2:
The patent extracts the security detection function from individual terminals and consolidates it in a network device. The detector component is taken out from distributed terminals and placed in a centralized network device, which then manages security operations across the network without requiring EDR installation on each endpoint
2Reliability
If EDR is deployed on each terminal to improve security coverage, then security coverage is improved, but cost increases
Solution Approach 1:
The network device is designed to serve multiple functions: it acts as both a detector for unauthorized communications and a coordinator for blocking operations. This multi-functional design eliminates the need for separate EDR installations on each terminal, reducing overall deployment cost while maintaining comprehensive security coverage across all terminals including OA and IoT devices
Solution Approach 2:
The network device serves as a cost-effective intermediary that provides security coverage to all terminals without requiring expensive EDR licenses on each device. By centralizing detection and coordination functions in the network device, the system achieves broad security coverage at a fraction of the cost of terminal-by-terminal deployment
3Reliability
If security measures are applied at terminal level to improve security precision, then security precision is improved, but adaptability to different devices deteriorates
Solution Approach 1:
The patent segments security operations into distinct functional components: detection, specification, and blocking. The detector in the network device handles detection and specification of unauthorized communications, while the terminal's blocker handles the actual blocking action. This segmentation allows the system to adapt to different terminal types (OA devices, IoT terminals, personal computers) while maintaining precise security detection through the standardized network device interface
4Device complexity
If centralized detection is implemented to reduce cost, then deployment cost is reduced, but response speed may deteriorate
Solution Approach 1:
The network device performs preliminary detection and specification of unauthorized communications before blocking is required. By pre-identifying threats and specifying their characteristics (source, destination, communication type), the system enables rapid blocking responses at terminals without the delay of real-time analysis, thus maintaining fast response speed while using centralized detection
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
The information processing system (1) is an information processing system including: an upper NW device (100) being a device constituting an overlay network; and a lower NW device (200) being a device constituting an underlay network. In this system, the upper NW device (100) detects unauthorized communication, specifies at least one of a communication destination and a communication source of the unauthorized communication using information regarding the unauthorized communication detected, notifies the lower NW device (200) of at least one of the communication destination and the communication source of the specified unauthorized communication. The lower NW device (200) acquires information related to communication of a terminal connected to the lower NW device (200), and blocks unauthorized communication based on the information regarding the unauthorized communication notification of which is provided.