Application-Aware Tunnel Access Control Against Bypass Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network access control technologies, such as TCP/IP-based firewall and VPN, are vulnerable to security threats like ARP spoofing and man-in-the-middle attacks, and lack effective mechanisms to manage data flows at the application layer, leading to indiscriminate access and security breaches.
Innovation Solution
A system and method for controlling network access based on tunnels and data flows, utilizing a controller to manage authorized tunnels and data flows at the application level, including a communication circuit, processor, and memory to detect and authorize access requests, and a server to generate and manage control flows and data flows through a database.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ARP spoofing is used to block unauthorized access, then network access control is improved, but network performance deteriorates due to increased network load
Solution Approach 1:
The patent extracts the access control function from the data plane and places it in the control plane. The controller centrally manages access control decisions, while network access controllers simply forward packets based on pre-established rules. This separation removes the burden of active ARP spoofing from individual network devices, improving performance while maintaining security.
Solution Approach 2:
The controller acts as an intermediary that centrally manages access control policies. Instead of each network device actively participating in ARP spoofing, the controller receives access control rules from the authentication server and distributes them to network access controllers, which then enforce them passively. This intermediary approach reduces network load while maintaining effective access control.
2Reliability
If firewall is used to control data packet flow, then data security is improved, but connection establishment capability deteriorates
Solution Approach 1:
The system performs preliminary authentication and access control decisions before data transmission begins. The authentication server evaluates access requests and establishes authorized tunnels in advance, so that when data packets arrive at the network access controller, the access decision is already made and the tunnel is ready for direct forwarding, eliminating the need for real-time firewall-style connection establishment checks.
Solution Approach 2:
The patent replaces the mechanical firewall approach of inspecting and deciding on each packet's connection establishment with a software-based tunneling mechanism. Once authentication is complete and a tunnel is established, data packets are forwarded through the tunnel without requiring continuous firewall-style inspection, substituting the mechanical packet-by-packet decision process with a more efficient tunnel-based forwarding mechanism.
3Reliability
If VPN tunnel is used to guarantee data integrity, then data confidentiality is improved, but data flow management capability deteriorates
Solution Approach 1:
The patent segments the data flow management function into two distinct components: the authentication server handles authentication and tunnel establishment, while the network access controller handles data forwarding. This segmentation allows each component to focus on its specific function, simplifying data flow management while maintaining the security benefits of VPN-like encryption through the authorized tunnels.
Solution Approach 2:
The system enables self-service authentication and tunnel establishment. The authentication server automatically evaluates access requests against stored credentials and establishes tunnels without requiring manual configuration or complex flow management interventions. The network access controllers automatically forward packets through established tunnels, eliminating the need for complex centralized flow management while maintaining data confidentiality.
4Reliability
If TCP/IP-based security technologies are used, then network access control is improved, but vulnerability to application layer attacks increases
Solution Approach 1:
The patent moves the security control from the network layer (TCP/IP) to the application layer by implementing application-aware access control. The authentication server evaluates access requests based on application-specific criteria and authentication tokens, creating a security dimension that operates above the traditional TCP/IP layers. This allows the system to maintain network access control while adding application layer security through token-based authentication and authorization.
Data Source
AI summary
A technology for controlling network access based on a tunnel and a data flow in a network environment, including a node to detect, through an access control application, a network access event in which a target application accesses a destination network; check, through the access control application, whether or not there is a tunnel generated in a unit of nodes or IPs and applied from an external server, and whether or not there is a data flow generated in a unit of TCP sessions or applications and generated by the external server; if there is the applied tunnel and data flow, transmit a data packet of the target application through the applied tunnel by using a communication circuit; and if there is no applied tunnel or data flow, drop a data packet of the target application.