Zero-Trust Node Classification for Cloud Network Threat Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based telecommunication networks lack effective methods to determine and classify network nodes, leading to security issues such as DDoS attacks, exploitation of vulnerabilities, zero-day exploits, lateral movement of attacks, and supply chain attacks.
Innovation Solution
Implement a zero trust-remote access system (ZTRAS) that validates user requests and classifies nodes as internal trusted, external trusted, or untrusted, using a unique subscription identifier and trust percentage, enabling centralized monitoring and detection of adversary requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If cloud-based telco network systems are virtualized and software-based, then system flexibility and scalability are improved, but security vulnerabilities and attack surfaces increase
Solution Approach 1:
The patent segments the network into trusted and untrusted zones using virtual network functions. Security policies are segmented and applied differently to internal trusted nodes, external trusted nodes, and untrusted nodes. This segmentation allows the system to maintain flexibility while implementing targeted security measures for different network segments.
Solution Approach 2:
The patent introduces a security policy enforcement function as an intermediary between network nodes and services. This intermediary validates access requests, enforces security policies, and monitors traffic without requiring changes to the underlying virtualized infrastructure, thus maintaining system flexibility while adding security layers.
2Reliability
If node classification and trust validation systems are implemented, then network security is improved, but system complexity increases
Solution Approach 1:
The patent implements a universal security policy enforcement function that handles multiple security tasks: node classification, trust validation, access control, and traffic monitoring. This multi-functional approach consolidates what could be multiple separate systems into a single framework, improving security while limiting complexity growth through consolidation.
Solution Approach 2:
The patent uses parameter-based node classification where nodes are assigned trust parameters and security attributes. These parameters can be dynamically adjusted based on node behavior, location, and security requirements. This parameter-driven approach allows flexible security management without requiring complex structural changes to the network architecture.
3Measurement precision
If security logging and monitoring are configured for all nodes, then detection capability is improved, but processing overhead and resource consumption increase
Solution Approach 1:
The patent applies security logging and monitoring with local quality by differentiating between trusted and untrusted nodes. Untrusted nodes undergo comprehensive security logging and validation, while trusted nodes receive reduced monitoring. This localized approach maintains high detection capability for critical threats while reducing processing overhead for established secure connections.
Solution Approach 2:
The patent implements partial monitoring action where security logging intensity is adjusted based on node trust levels. For trusted nodes with established security credentials, monitoring is reduced to essential parameters only. For untrusted or suspicious nodes, comprehensive monitoring is applied. This partial action approach optimizes the balance between detection capability and resource consumption.
Data Source
AI summary
Provided are a method, system, and computer-readable recording medium for registering a node in a zero trust remote access system. The method includes: receiving a request to subscribe a node to a zero trust remote access system for a network; generating a subscription identification (ID) for the node based on one or more parameters of the node; configuring the node with security logging; initiating a service of the node based on a trust percentage calculated for the node according to a security configuration of the node; and receiving security logs from the node based on the configured security logging.