Visa-Based Secure Network for Authorized Packet Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network protocols are vulnerable to attacks from malicious actors within and outside the network, especially in heterogeneous environments, making it difficult to secure communication and protect organizational resources effectively.
Innovation Solution
A secure communication system (SNS) using a selective network (SNN) with agents, adaptors, and secure channels that enforce policies through visas to authenticate and authorize communication, ensuring only permitted agents can communicate securely via a compliant flow mechanism.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional network protocols are used to allow all connected users and devices to communicate, then network accessibility and ease of operation are improved, but network security and reliability deteriorate due to vulnerability to malicious actors
Solution Approach 1:
The patent introduces a visa service as an intermediary component that mediates all communication between agents in the selective network. The visa service issues visas to authenticated agents, which are then required for packet transmission. This intermediary mechanism enables secure authentication and authorization while maintaining network accessibility, resolving the contradiction between ease of operation and reliability.
Solution Approach 2:
The patent implements preliminary authentication and authorization actions through the visa service before agents can communicate. Agents must be authenticated and receive visas in advance of any communication activities. This preliminary action ensures that only authorized agents can access the network, improving security while maintaining accessibility through proper authentication mechanisms.
2Ease of operation
If firewalls are configured to enable legitimate communication outside the enclave, then network accessibility is improved, but security vulnerabilities increase that can be exploited by attacks
Solution Approach 1:
The visa service acts as an intermediary that controls and authorizes communication flows between agents. Instead of using traditional firewalls that create security holes, the visa service issues visas that explicitly authorize specific communication paths. This approach enables legitimate communication while maintaining security through granular authorization control.
Solution Approach 2:
The patent changes the security control parameter from binary firewall rules (allow/deny) to a visa-based authorization system with multiple parameters including agent identity, communication destination, and authorized actions. This parameter change enables precise control over communication accessibility while eliminating security vulnerabilities associated with broad firewall rules.
3Reliability
If monitoring and auditing tools are used to detect and stop security breaches, then security response capability is improved, but system complexity and loss of time increase
Solution Approach 1:
The visa service performs preliminary authentication and authorization before communication occurs, preventing unauthorized access rather than merely detecting and responding to breaches. This preliminary action reduces the need for complex monitoring and auditing tools, as the visa mechanism proactively blocks unauthorized communication before it can occur.
Solution Approach 2:
The visa-based system enables self-service security control where the visa service automatically authenticates agents and issues appropriate visas without requiring manual monitoring or auditing intervention. This self-service approach reduces system complexity while maintaining strong security response capability through automated authorization decisions.
Data Source
AI summary
A secure communication system enabling secure transport of information is disclosed. The system comprises a secure network with one or more packet processing units connected by links through an internal communication system. The secure network transports packets of information between credentialed and authenticated agents. Each packet is associated with a visa issued by a visa service. The visa specifies the procedures governing the processing of the packet by the packet processing units as it is transported along a compliant flow, between agents thorough the network, according to a set of policies specified in a network configuration. Packet processing units include docks and forwarders. Adaptors serving the agents communicate with the network through tie-ins to docks. The system also includes and admin service, accessible to one more admins, that facilitates configuration and management of the network.