Tunnel-Based Node Access Control for Blocking Unauthorized Packets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network access control technologies, such as NAC, VPN, and TCP/IP-based security, are vulnerable to ARP spoofing, bypass attacks, and lack comprehensive application-layer security, making them ineffective in managing unauthorized data packet transmission and susceptible to MITM attacks.
Innovation Solution
A node and system comprising a communication circuit, processor, and memory with access control applications that manage network access through authorized tunnels, block unauthorized applications, and enforce policies to prevent bypass attacks and MITM threats, providing secure network connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ARP spoofing is used to block unauthorized terminals, then network access control is improved, but network performance deteriorates due to increased network load
Solution Approach 1:
The patent introduces a gateway as an intermediary component between terminals and the network. The gateway receives authorization requests from terminals, verifies credentials against stored information, and only allows authorized terminals to establish network connections. This mediator approach replaces direct ARP spoofing with a more efficient authentication mechanism that maintains security without significantly impacting network performance.
Solution Approach 2:
The system performs preliminary authentication actions before allowing network access. Terminals must first provide credentials to the gateway, which verifies authorization in advance. This preliminary verification ensures that only authenticated terminals can subsequently access the network, eliminating the need for continuous ARP spoofing operations during data transmission.
2Reliability
If firewall is used to control data packet flow, then data security is improved, but connection establishment capability deteriorates
Solution Approach 1:
The patent segments the network access control function into distinct components: a gateway for authentication and authorization, and firewalls for data packet filtering. The gateway handles connection establishment and credential verification separately from the firewall's data packet inspection function. This segmentation allows each component to specialize in its task, maintaining both security and ease of connection establishment.
Solution Approach 2:
The gateway acts as an intermediary that establishes authorized connections before data traffic reaches the firewall. By pre-authenticating terminals and establishing legitimate connection pathways through the gateway, the system ensures that firewalls only need to enforce security policies on already-authorized traffic, simplifying the overall connection establishment process while maintaining data security.
3Reliability
If VPN tunnel is used to guarantee data integrity and confidentiality, then data protection is improved, but packet flow management capability deteriorates
Solution Approach 1:
The patent segments network access control into multiple functional layers: authentication layer (gateway), data protection layer (VPN tunnel), and packet management layer (firewall). Each layer handles specific tasks independently - the gateway manages authentication, the VPN tunnel ensures data protection, and the firewall handles packet flow management. This segmentation reduces the complexity burden on any single component while maintaining comprehensive security.
Solution Approach 2:
The gateway serves as an intermediary that establishes VPN tunnels and manages packet flow between authorized terminals and the network. By centralizing tunnel management and packet flow control in the gateway, the system simplifies packet flow management complexity while maintaining robust data protection through encrypted VPN connections.
4Reliability
If TCP/IP-based security technologies are used, then network access control is improved, but vulnerability to application layer attacks increases
Solution Approach 1:
The patent extends security control from the traditional TCP/IP network layer to the application layer by implementing gateway-based authentication and authorization mechanisms. The gateway verifies terminal credentials and manages access rights at a higher dimensional level, creating security boundaries that span multiple OSI layers. This multi-layer security approach addresses application layer vulnerabilities by establishing authentication and authorization before data reaches the application tier.
Solution Approach 2:
The gateway acts as an intermediary security layer between network infrastructure and application services. It performs authentication and authorization functions that bridge network layer control with application layer security requirements. By validating terminal credentials and managing access rights at the gateway, the system creates a security intermediary that protects against application layer attacks while maintaining network access control capabilities.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A node may: detect, through an access control application, a network access event in which a target application accesses a destination network; check, through the access control application, whether or not there is a tunnel generated in a unit of nodes or IPs and applied from an external server, and whether or not there is a data flow generated in a unit of TCP sessions or applications and generated by the external server; if there is the applied tunnel and data flow, transmit a data packet of the target application through the applied tunnel by using a communication circuit; and if there is no applied tunnel or data flow, drop a data packet of the target application.