Wireless Access Point Isolation for Fast Cyberattack Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Wireless networks are more vulnerable to attacks than wired networks, making them susceptible to threats that can compromise connected wired networks, necessitating robust security mechanisms.
Innovation Solution
An apparatus with a volatile memory and non-volatile memory, including a first electronic circuit as a wireless access point and a second electronic circuit with a processor executing virtual machines for wireless network authentication and virtual private network (VPN) servers, ensuring data encryption and authentication within volatile memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virtual machines are stored in non-volatile memory, then data persistence is improved, but recovery time after attack increases
Solution Approach 1:
The system segments storage into two distinct types: volatile memory for active virtual machine instances and non-volatile memory for persistent storage. This segmentation allows the volatile memory to be quickly cleared upon detecting a cyber attack, enabling rapid recovery, while the non-volatile memory preserves critical system state and configuration information for subsequent operations.
Solution Approach 2:
The patent implements a disposable memory strategy where virtual machine instances stored in volatile memory can be quickly discarded and reinitialized after a security incident. The system is designed to accept the loss of volatile memory contents as a trade-off for achieving rapid recovery and eliminating persistent threats.
2Reliability
If comprehensive security mechanisms are implemented, then network security is improved, but device complexity increases
Solution Approach 1:
The patent employs a multi-functional security architecture where a single security module handles diverse security tasks including authentication, authorization, encryption, and virtual machine management. This universal approach consolidates multiple security functions into one integrated system, reducing overall device complexity while maintaining comprehensive security coverage.
Solution Approach 2:
The system introduces a security module as an intermediary component that mediates between the wireless access point functionality and the virtual machine execution environment. This intermediary layer centralizes security operations, simplifying the architecture by providing a dedicated interface for all security-related operations rather than distributing security logic throughout the system.
3Speed
If virtual machines are contained in volatile memory only, then recovery speed is improved, but data persistence deteriorates
Solution Approach 1:
The system segments storage into two distinct types: volatile memory for active virtual machine instances and non-volatile memory for persistent storage. This segmentation allows the volatile memory to be quickly cleared upon detecting a cyber attack, enabling rapid recovery, while the non-volatile memory preserves critical system state and configuration information for subsequent operations.
Data Source
AI summary
An apparatus is provided, comprising: a volatile memory; a non-volatile memory; a first electronic circuit that is configured to operate as a wireless access point, the first electronic circuit including a wireless controller for accessing a wireless network; and a second electronic circuit that is operatively coupled to the first electronic circuit, the second electronic circuit including at least one processor configured to execute: (i) a first virtual machine that includes a wireless network authentication server, and (ii) a second virtual machine that includes a virtual private network (VPN) server, wherein the wireless network authentication server is configured to authenticate devices that attempt to join the wireless network; wherein the VPN server is arranged to encrypt data that is received at the apparatus to produce encrypted data, and forward the encrypted data to the wireless controller for transmission over the wireless network.


