Threat Management Server for Untrusted Network Device Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network systems are unable to preemptively identify and block unauthorized network devices, allowing malicious activities such as data exfiltration and the introduction of malicious data before detection, which compromises network security and data access control.
Innovation Solution
A system that uses historical authentication data to identify and block untrusted network devices from accessing the network, isolates them within a safe zone for monitoring, and prevents reconnection attempts by utilizing a threat management server and database to maintain blacklists and whitelists, ensuring secure network access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional monitoring systems are used to detect malicious network devices, then the system can identify suspicious activity, but the malicious device is already connected and able to perform malicious activities before detection
Solution Approach 1:
The system performs preliminary identification and blocking of unauthorized network devices before they can connect to and compromise the network. By proactively scanning for devices attempting to connect and blocking them in advance, the system prevents malicious activities rather than detecting them after the fact, thus resolving the time loss between connection and detection
Solution Approach 2:
The system applies preliminary anti-action by preemptively blocking unauthorized devices before they can execute malicious activities. The threat management server identifies potential threats and prevents their connection to the network, countering potential malicious actions before they occur and enhancing network security without waiting for suspicious activity to manifest
2Reliability
If the system blocks untrusted devices using historical authentication data, then unauthorized access is prevented, but the system complexity increases due to database requirements
Solution Approach 1:
The threat management server performs multiple functions including authentication, historical data storage, device identification, and blocking operations within a single system component. By consolidating these functions, the system achieves reliable access control without proportionally increasing overall system complexity, as the server handles diverse tasks through integrated capabilities
Solution Approach 2:
The system introduces a threat management server as an intermediary between network devices and the core network infrastructure. This mediator handles the complexity of historical data management, authentication verification, and blocking decisions, isolating the complexity from the rest of the network system while maintaining simple access control at the network level
Data Source
AI summary
A system that includes a switch, a network authentication server (NAS), and a threat management server. The NAS sends a device identifier for an endpoint device to the threat management server in response to the endpoint device connecting to a port on the switch. The threat management server identifies the endpoint device for removal in response to receiving the device identifier. The threat management server determines the number of times the endpoint device has failed authentication exceeds a first threshold value within a first time period. The threat management server blocks the endpoint device from accessing the network via the port on the switch in response to identifying the endpoint device for removal.