RFprotect System Architecture - Overview
Network Chemistry's RFprotect System utilizes intelligent purpose-built sensors for radio frequency (RF)-based surveillance monitoring combined with centralized data analysis and anomaly detection to reduce hacker threats and improve WLAN performance. RFprotect’s patent-pending Shared Constituent Analysis™ technology puts the analysis "smarts" in both the sensors and the servers to improve detection accuracy, system scalability, and administrative simplicity - all at a price that any enterprise can afford.
The key to RFprotect’s superior capabilities lie in this major system architectural difference. Until now, WLAN monitoring solutions perform traffic analysis and alert detections in one of two ways: either with the smarts (1) in the central server, or (2) in the distributed sensors on the edge. Each of these approaches come with significant drawbacks and hence ineffective for WLAN security and performance monitoring.
Legacy Approach #1: Dumb Sensors / Smart Server
Some vendors utilize a Dumb Sensors / Smart Server approach whereby the WLAN activity analysis is performed by the server and the sensors essentially act as simple capture devices forwarding wireless packets via the back-haul link to the server. The benefit of this approach is that the server can apply multi-sensor correlation within its detection algorithms, providing more advanced and accurate alerts. The major drawbacks of this approach are that it is slow, bandwidth hogging, and less secure to forward packets to a centralized server. Moreover, the Dumb Sensor / Smart Server approach proves less scalable, both at the server and at remotely monitored branch sites where WAN backhaul is at a premium.
Legacy Approach #2: Smart Sensors / Dumb Server
Other vendors utilize a Smart Sensors / Dumb Server approach whereby the WLAN activity analysis is performed by each sensor and the server essentially acts as an aggregated data logger. Although inherently more scalable than the previous, this approach requires expensive sensors, else they become prone to processor limitations and memory constraints as the analysis features and detection count increase over time. The major administrative drawback is that the sensor firmware must be updated each time a new alert is released - becoming an operational nightmare in a large deployment, no matter how automated the vendor tries to make the procedure. As a result, new releases are less frequent to minimize customer frustration with the tedium of system upgrades. This lessened update frequency in turn leads to new attack alerts getting installed long after the fact.
RFprotect’s Next Generation Approach: Smart Sensors / Smart Server
Network Chemistry’s RFprotect takes an entirely different approach, call Shared Constituent Analysis™, achieving the best of the previous approaches but without any of the drawbacks. Utilizing a Smart Sensors / Smart Server approach, RFprotect intelligently splits the analysis by what’s best done at the edge on sensors and what’s best done centrally on the server. The RFprotect Sensors monitor all WLAN activity, then analyzes and distills all the information into "core data constituents". This distilled data is forwarded to the server engine in real time, consuming very little network bandwidth. The server engine then identifies security and performance anomalies by performing all the detection algorithms, correlating data from all sensors and from its real time database of the entire network (WLAN) state. New alerts, be it attack detections or operational alarms, are simply loaded onto the server, not down to each sensor.
In summary, RFprotect’s next-generation system architecture delivers these key benefits:
- Highest Scalability - smart sensors that consume very low back-haul bandwidth and offload analysis from the server, critical in large deployments
- Highest Accuracy - alert detection algorithms based on multi-sensor correlation and a real time network state knowledge base, eliminating false positives and enabling more advanced alert detections
- Easiest Administration system upgrades and new alert releases are simply applied once to the central server, not downloaded to each of the sensors
- Lowest Cost - RFprotect utilizes the intelligence distributed across the system to minimize system bottlenecks and enabling lowest cost sensor and server components
|
