Persistent Device Identifier Quarantine Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security measures face challenges in effectively quarantining compromised devices due to the transient nature of Internet Protocol addresses, which can change with each connection, compromising security even with virtual private networks (VPNs).
Innovation Solution
The use of persistent device identifiers, such as host identifiers and device serial numbers, to enforce quarantine policies, allowing for the adaptation of quarantine lists in the data plane regardless of IP address changes, by mapping transient identifiers to persistent ones and propagating updates across the network for effective quarantining.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IP addresses are used to quarantine compromised devices, then quarantine enforcement is simple and direct, but the quarantine becomes ineffective when devices change IP addresses
Solution Approach 1:
The patent introduces a mapping system that acts as an intermediary between transient IP addresses and persistent device identifiers. This mapping table correlates current and previous IP addresses with permanent device identities, allowing the firewall to track and quarantine devices based on their persistent identifiers rather than transient IP addresses, thus maintaining quarantine effectiveness across IP changes
Solution Approach 2:
The system creates and maintains copies of device identifier information across multiple data structures including mapping tables that store persistent identifiers alongside transient IP addresses. These copied and correlated identifier sets enable the firewall to recognize and quarantine devices regardless of which IP address they currently hold
2Reliability
If persistent device identifiers are used for quarantine, then quarantine remains effective across IP changes, but the system complexity increases due to identifier mapping and propagation
Solution Approach 1:
The system performs preliminary actions by collecting and storing persistent device identifiers and their mappings to IP addresses in advance, before quarantine situations arise. The mapping tables are pre-populated with device identity information, enabling rapid and accurate device identification and quarantine enforcement when security incidents occur, without requiring complex real-time analysis
Solution Approach 2:
The system implements feedback mechanisms where the firewall continuously monitors IP address assignments, updates the mapping tables with current device identifiers, and propagates quarantine status information back across the network. This feedback loop ensures that all network components have synchronized information about compromised devices, maintaining consistent quarantine enforcement across the entire network infrastructure
Data Source
AI summary
Leveraging non-transient or persistent device identifiers to enforce device quarantine instead of IP addresses accommodates the transient associations of IP addresses to devices without compromising the effectiveness of quarantine. When a device has been determined to be compromised and is quarantined, the quarantine of the device is enforced using the IP address of the device. However, IP address assignment is transient. With each connection, a device can be assigned a different IP address. After a connection is established, a gateway can collect a device identifying value(s) that persists across network connections (e.g., host identifier (host ID) and device serial number). With a persistent device identifier, a quarantine list can be enforced in a data/forwarding plane regardless of a compromised device being assigned different network addresses.