Tunnel-Based Network Access Control for Application Layer Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network access control technologies, such as ARP spoofing, firewalls, and VPNs, face challenges in managing data packet flow securely, particularly at the application layers, and are vulnerable to bypass attacks and security threats due to their reliance on TCP/IP protocols.
Innovation Solution
A system and method for controlling network access by detecting network events, identifying authorized tunnels, and ensuring data packets are transmitted only through validated channels, using a terminal with a processor, memory, and communication circuit to manage access control applications and communicate with an external server to verify tunnel authorization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ARP spoofing is used to block unauthorized terminals, then network access control is improved, but network load increases and the system becomes vulnerable to bypass attacks
Solution Approach 1:
The patent introduces a gateway as an intermediary component between terminals and the network. The gateway receives data packets from terminals, verifies tunnel authorization, and forwards authorized packets to the network. This mediator approach replaces ARP spoofing with a centralized authorization mechanism that doesn't generate excessive network traffic.
Solution Approach 2:
The system performs preliminary authorization by establishing encrypted tunnels between terminals and the gateway before data transmission. The gateway pre- validates tunnel authorization and stores authorization information in a database, so that subsequent data packets can be quickly verified without generating control traffic for each packet.
2Reliability
If firewall is used to control data packet flow, then network security is improved, but the system cannot directly involve in connection generation between nodes
Solution Approach 1:
The gateway is designed with multi-functionality, combining firewall capabilities for data packet filtering with connection management capabilities for generating and maintaining tunnels between terminals and the network. This universal component can both control data flow and establish connections, eliminating the limitation of traditional firewalls.
3Reliability
If VPN is used to ensure data integrity and confidentiality, then security is improved, but the system is vulnerable to managing data packet flow after tunnel generation
Solution Approach 1:
The gateway acts as a centralized intermediary that manages both tunnel generation and data packet flow. By consolidating these functions in one component, the system simplifies packet flow management compared to distributed VPN implementations, while maintaining encrypted tunnel security.
4Reliability
If TCP/IP-based security technologies are used, then network access control is achieved, but the system is vulnerable to security threats at other OSI layers
Solution Approach 1:
The patent extends security control from the network layer (TCP/IP) to the application layer by implementing access control at the application level. The system identifies applications on terminals, generates application-specific tunnels, and controls data packets based on application authorization, adding a vertical dimension of security control across OSI layers.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a node comprising: a communication circuit; a processor operatively connected to the communication circuit; and a memory operatively connected to the processor and storing a target application and an access control application, wherein the memory stores instructions that when executed by the processor, cause the node to: detect, through the access control application, a network access event of the target application to a destination network, identify, through the access control application, whether a tunnel exists between the node and a gateway, identify, through the access control application, whether the target application is accessible to the destination network, based on data flow information received from an external server, wherein the data flow information is based on the target application and the destination network, in response to determining that the tunnel exists and the target application is accessible to the destination network, transmit, through the access control application, a data packet of the target application via the tunnel, and in response to determining that the tunnel does not exist or the target application is not accessible to the destination network, drop, through the access control application, the data packet of the target application.