Security Labeling for Network ACL Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional access control lists (ACLs) in network security are inflexible and require frequent updates, leading to increased complexity and administrative burdens, especially with changes in network topology, which can result in security vulnerabilities and network outages.
Innovation Solution
Implementing a security label-based method where packets are tagged with security information, allowing for dynamic security level comparisons and decisions on packet handling, independent of network topology changes, using a security label pruning protocol that supports various label formats and operates within existing network architectures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional ACLs are used to enforce security policies, then security control is achieved, but the system requires frequent updates and becomes complex when network topology changes
Solution Approach 1:
The patent segments security policy management by introducing intermediate security labels that separate the security policy definition from the ACL rules. Security labels are assigned to users and packets, allowing the system to match security requirements without directly modifying complex ACL structures. This segmentation reduces the coupling between network topology changes and security policy updates.
Solution Approach 2:
The patent introduces security labels as an intermediary mechanism between users and ACLs. Instead of directly modifying ACLs when network topology changes, the system uses security labels to mediate security decisions. The labels carry security information that can be matched against security requirements without requiring direct ACL rule modifications, thus simplifying management.
2Adaptability or versatility
If ACL rules are updated frequently to accommodate network changes, then security policy adaptability improves, but the rate of updates increases causing processing overhead
Solution Approach 1:
The patent applies preliminary action by pre-assigning security labels to users based on their security requirements before they access the network. These labels are established in advance through authentication processes, so when network topology changes occur, the system can adapt by matching existing labels against updated security requirements without requiring frequent ACL recompilation. This preliminary labeling reduces the need for reactive ACL updates.
3Measurement precision
If individual IP addresses are mapped in ACLs, then precise security control is achieved, but the size of ACLs increases dramatically
Solution Approach 1:
The patent changes the parameter used for security control from IP addresses to security labels. Instead of creating ACL rules based on individual IP address mappings, the system assigns security labels to users that encapsulate their security requirements. This parameter change allows precise security control to be achieved through label matching rather than exhaustive IP address enumeration, significantly reducing ACL size.
4Manufacturing precision
If ACLs are recompiled for every change, then security policy accuracy is maintained, but processing cost increases quadratically with the number of users
Solution Approach 1:
The patent introduces dynamics by making security label assignment flexible and adaptable without requiring static ACL recompilation. Security labels can be dynamically assigned and updated based on user authentication and network conditions, allowing the system to maintain security policy accuracy while avoiding the quadratic processing cost of recompiling large ACL structures. The dynamic label system responds to changes without triggering full ACL recompilation.
Data Source
AI summary
A method and apparatus for providing network security using security labeling is disclosed. The method includes comparing first security level information and second security level information, and indicating processing to be performed on the packet based on the comparing. The first security level information is stored in a security label of a packet received at a network node, while the second security level information is stored at the network node.