Wireless Terminal Packet Filtering for Embedded Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Standard firewalls are ineffective in embedded systems with limited resources, such as those in wireless communication systems, making it difficult to establish a secure connection and resist malware attacks.
Innovation Solution
A method and apparatus that set protocol information for terminals in a wireless communication system, checking packets based on protocol type, source port, and destination port to determine whether to drop or forward packets, thereby preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a standard firewall is used to secure connections, then security against malware attacks is improved, but device complexity and resource consumption increase beyond what embedded systems can handle
Solution Approach 1:
The patent segments the firewall functionality into two parts: a comprehensive firewall engine that runs on the host system (PC), and a lightweight client application that runs on the embedded terminal. The host system handles complex security processing, while the terminal only needs to execute simple instructions from the host, dividing the computational burden and allowing strong security without overloading the embedded device resources.
Solution Approach 2:
The host system acts as an intermediary between the external network and the embedded terminal. Instead of placing the full firewall burden on the terminal, the host mediates security operations by analyzing packets and instructing the terminal on whether to accept or reject connections, thereby protecting the terminal while maintaining security.
2Reliability
If protocol checking is performed on every packet to prevent malware, then security is improved, but processing time and energy consumption increase
Solution Approach 1:
The system performs preliminary protocol analysis and security rule configuration during the connection setup phase. The host system pre-processes security requirements and establishes filtering rules before actual data transmission begins. This preliminary action allows subsequent packet filtering to be faster and more efficient, as the complex analysis work is done in advance.
Solution Approach 2:
The patent implements partial packet inspection by focusing only on critical packet header information (source IP, destination IP, port numbers, protocol type) rather than analyzing the entire packet content. This partial action approach provides sufficient security for connection establishment while significantly reducing processing time and energy consumption compared to full packet inspection.
3Reliability
If comprehensive packet filtering rules are implemented, then protection against unauthorized access is improved, but ease of operation and configuration difficulty increase
Solution Approach 1:
The firewall system operates in a self-service manner where the host system automatically manages security configuration and rule updates. The terminal client automatically receives instructions from the host and applies filtering rules without requiring manual configuration by users. This automation maintains strong protection while simplifying operation, as users don't need to understand complex firewall settings.
Solution Approach 2:
The host-based firewall system serves multiple functions: it protects multiple terminals simultaneously, handles various protocol types (TCP, UDP, ICMP), manages connection tracking, and provides centralized security policy enforcement. This multi-functionality allows comprehensive protection while simplifying operation, as a single centralized system manages all security needs rather than requiring individual configuration at each terminal.
Data Source
AI summary
A method of setting a secure connection in a wireless communications system is disclosed. The method comprises setting a protocol information to a terminal; and checking a packet received in the terminal according to the protocol information; wherein the packet comprises a protocol type, a source port, and a destination port.