Virtual Security Subsystem with User-Specific Policy Segmentation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current network security tools, such as firewalls, intrusion prevention systems, and virus scanners, are typically packaged for either individual or enterprise use and lack the ability to tailor security policies on a user-specific basis, failing to provide adequate protection for diverse user groups within an enterprise setting.

Innovation Solution

A system comprising a router coupled with a security sub-system that includes virtual firewalls, virtual intrusion prevention systems, and virtual virus scanners, each configurable on a user-specific basis, along with additional modules like anti-spam and content filtering, allowing for user-specific policies to be selected through a graphical user interface.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If traditional security tools are packaged for enterprise use, then comprehensive security coverage is achieved, but the ability to tailor security policies on a user-specific basis is lost

Engineering Contradiction:

Improveuser-specific security policy tailoringVSAvoidsecurity system configuration complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The security system is segmented into multiple virtual security instances (virtual firewall, virtual IPS, virtual virus scanner), each assignable to different user groups or individuals. This segmentation enables user-specific security policies while maintaining system manageability through modular architecture.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The security appliance is designed with multi-functionality, serving both enterprise-wide security needs and individual user-specific requirements through a unified platform. The system can simultaneously enforce organization-wide policies while allowing customization for specific users or groups.

Inventive Principle:

Principle #6Universality (Multi-functionality)

2Reliability

If security tools are configured for individual use, then user-specific protection is provided, but enterprise-wide security management capability is reduced

Engineering Contradiction:

Improveuser-specific security protectionVSAvoidenterprise security management efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

Multiple virtual security instances are merged into a single physical security appliance, combining individual user protection capabilities with centralized enterprise management. This consolidation allows simultaneous delivery of personalized security and efficient enterprise-wide administration.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The security appliance acts as an intermediary between individual users and enterprise security management, mediating between user-specific security requirements and organization-wide policies through a unified interface and centralized control mechanism.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Adaptability or versatility

If multiple virtual security instances are deployed, then user-specific security configurations are enabled, but system resource consumption increases

Engineering Contradiction:

Improvesecurity policy customizationVSAvoidappliance resource consumption

Core Design Contradiction:

Adaptability or versatilityVSUse of energy by moving object

Solution Approach 1:

Multiple virtual security instances are nested within a single physical appliance, with each virtual instance containing its own security functionality. This nesting approach enables user-specific configurations while consolidating hardware resources and reducing overall system footprint.

Inventive Principle:

Principle #7Nested doll (Nesting)

Data Source

PatentUS8555389B2Integrated firewall, IPS, and virus scanner system and method

Publication Date: 2013.10.08 MCAFEE LLC

AI summary

A system, method and computer program product are provided including a router and a security sub-system coupled to the router. Such security sub-system includes a plurality of virtual firewalls, a plurality of virtual intrusion prevention systems (IPSs), and a plurality of virtual virus scanners. Further, each of the virtual firewalls, IPSs, and virus scanners is assigned to at least one of a plurality of user and is configured in a user-specific.