Overlay Underlay Network Security for Unauthorized Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security measures struggle to effectively detect and block unauthorized communication, particularly in cases where a normally functioning device is infected with malware, blurring the network boundaries and complicating protection strategies.
Innovation Solution
An information processing system comprising an upper NW device and a lower NW device, where the upper NW device blocks unauthorized communication based on notifications from the lower NW device, which acquires, detects, and notifies the upper NW device of unauthorized communication, enhancing detection and blocking capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional security measures (firewall, IPS) are installed in gateway to detect unauthorized communication, then detection capability is provided, but detection accuracy and response speed are insufficient for immediately infected terminals
Solution Approach 1:
The network is divided into overlay network and underlay network with different security functions. The underlay network performs deep packet inspection for accurate detection, while the overlay network provides blocking control. This segmentation allows each layer to specialize in specific tasks, improving both detection accuracy and response speed.
Solution Approach 2:
Security policies and blocking rules are pre-configured in the overlay network device before unauthorized communication occurs. When the underlay network detects suspicious traffic, the overlay network can immediately apply pre-prepared blocking rules, eliminating the time lag for rule generation and deployment.
2Reliability
If deep packet inspection is performed to detect malware communication, then detection capability is improved, but device complexity and processing overhead increase
Solution Approach 1:
The system separates detection functions (underlay network with DPI) from control functions (overlay network with policy enforcement). This segmentation allows the detection system to focus on accurate identification while the control system handles blocking decisions, reducing overall system complexity and processing overhead.
Solution Approach 2:
The overlay network acts as an intermediary layer between the underlay network and terminal devices. It receives detection information from the underlay network, applies security policies, and executes blocking actions. This intermediary structure simplifies the architecture by centralizing control logic and avoiding direct modification of detection devices.
3Adaptability or versatility
If traditional firewall and IPS are deployed at network boundary, then basic protection is provided, but they cannot handle cases where network boundaries are blurred due to malware infection
Solution Approach 1:
The system adds a new dimension to network security by implementing an overlay network that operates independently from the traditional underlay network. This overlay layer provides an additional security dimension that can enforce policies regardless of the underlay network's state, enabling protection even when traditional boundary-based security fails due to malware-induced boundary blurring.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
An information processing system (1) is an information processing system including: an upper NW device (100) being a device constituting an overlay network; and a lower NW device (200) being a device constituting an underlay network. In this system, the lower NW device (200) acquires information related to communication of a terminal connected to the lower NW device (200), detects unauthorized communication based on the acquired information related to communication of a terminal connected to the lower NW device (200), and notifies the upper NW device (100) of information regarding the detected unauthorized communication, and the upper NW device (100) blocks unauthorized communication notification of which is provided from the lower NW device (200) based on information regarding unauthorized communication.