Reducing a possible attack on a weak point of a device via a network access point
AssigneeSiemens Aktiengesellschaft
InventorRAINER FALK
Life of this patent
Estimating the term…
Abstract
A method for reducing a possible attack on a weak point of a device via a network access point to a network is proposed, wherein a configuration of the device is analysed in a first step, wherein communication via the network access point is restricted by a network access filter with the aid of a selectable filter rule in a second step if a weak point is detected on the basis of the analysed configuration, in particular a lack of up-to-dateness of the configuration, and wherein the filter rule is topologically applied between the network access point and a main function of the device. A corresponding device and a computer program product are proposed. A type of reverse network admission control principle is therefore applied.
Claims13
A method for reducing a possibility of attack on a weak point of a device via a network access point to a network,
- analyzing in a first step, a configuration of the device,
- detecting in a second step, in the event of a weak point on the basis of the analyzed configuration, in particular a lack of up-to-dateness of the configuration, communication via the network access point is restricted by way of a network access filter with the aid of a selectable filter policy, and
- applying the filter policy topologically between the network access point and a main function of the device.
An access device for protecting against an attack on a weak point of a device via a network access point to a network, comprising
- a component for analyzing a configuration,
- a network access filter for restricting communication via the network access point with the aid of a filter policy in the event of a weak point detected on the basis of the analyzed configuration,
- wherein the network access filter is provided topologically between the network access point and a main function of the device.
The access device as claimed in 7, wherein the component has a local interface or a network interface to the device or a communication interface to a virtual twin of the device.
Dependencies are inferred from the claim text.