Trust-Based Packet Filtering for VoIP Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current packet filtering methods in enterprise networks, particularly for VoIP systems, face performance overhead, security vulnerabilities, and inflexibility due to reliance on packet content analysis, and existing trust-based filtering solutions are inefficient, leading to unmanageable rule sets and performance issues.
Innovation Solution
A trust-based filtering mechanism that determines connection trust levels based on credentials and policies, allowing dynamic trust scoring and flexible filtering policies, decoupling trust determination from packet content inspection, and enabling centralized policy management across the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If application filtering is applied to all packets received at the enterprise network, then network security is improved, but performance overhead increases significantly
Solution Approach 1:
The patent segments the filtering process into two distinct stages: connection-level filtering (CF) that evaluates trust based on connection attributes, and packet-level filtering (PF) that inspects packet contents. This segmentation allows the system to apply lightweight connection filtering to all packets while reserving resource-intensive packet filtering only for suspicious traffic, thereby maintaining security while reducing performance overhead.
Solution Approach 2:
The patent implements preliminary connection-level filtering before packet-level filtering. By evaluating trust scores based on connection attributes (IP address, port, protocol) upfront, the system can pre-classify connections and apply appropriate filtering policies before examining packet contents, thus avoiding unnecessary deep packet inspection for trusted connections and improving overall filtering performance.
2Measurement precision
If packet content inspection is used for filtering, then filtering accuracy is improved, but security vulnerabilities increase due to forged packet contents
Solution Approach 1:
The patent introduces connection-level filtering as an intermediary layer between untrusted networks and the enterprise network. This intermediary evaluates trust based on connection attributes that are harder to forge than packet contents, and uses the trust score to modulate the stringency of subsequent packet-level filtering. This intermediary approach maintains filtering accuracy while reducing security vulnerabilities by not relying solely on packet content inspection.
3Adaptability or versatility
If traditional application filtering mechanisms are modified to consider trust scores, then filtering flexibility is improved, but device complexity increases due to dynamic rule generation
Solution Approach 1:
The patent extracts the trust score calculation and filtering rule generation into a separate, centralized component. This extracted module dynamically generates filtering rules based on connection trust scores and predefined policies, allowing the main filtering system to remain relatively simple while gaining flexibility through the dedicated trust-based rule generation component.
4Reliability
If trust-based filtering rules are implemented for large networks with many devices, then filtering effectiveness is improved, but implementation complexity becomes unmanageable
Solution Approach 1:
The patent implements universal connection-level filtering policies that can be applied across the entire enterprise network regardless of the number of devices. By focusing on connection attributes (IP address, port, protocol) rather than device-specific characteristics, the system achieves multi-functionality where a single set of connection filtering policies can effectively manage trust assessment for all connections in the network, making implementation manageable even in large networks.
Data Source
AI summary
Methods, devices, and systems are provided for filtering packets and other communication messages or portions thereof. Particularly, mechanisms are provided for efficiently determining and applying a set of trust-based filtering rules. Trust scores may be assigned to various connections and packets received on a particular connection may have filtering rules applied thereto in accordance with the trust score of the connection.