Adaptive Telemetry Control for Zero-Trust Risk Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In zero-trust computing environments, existing systems struggle to adaptively manage telemetry collection, leading to stale or inadequate data that compromises continuous validation of access to protected resources.
Innovation Solution
A policy decision point in a zero-trust computing environment adjusts telemetry definitions based on risk posture, instructing IHSs to increase or modify telemetry collection, such as location and user-presence measurements, through a remote access controller using sideband connections to ensure timely and relevant data for access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If telemetry collection is increased to improve security monitoring, then security reliability is improved, but system resource consumption and device complexity increase
Solution Approach 1:
The patent implements dynamic telemetry collection where the policy decision point adjusts telemetry definitions in real-time based on changing risk postures. Telemetry collection parameters are not static but adapt dynamically to current security conditions, collecting more detailed telemetry when risk increases and reducing collection when risk decreases, thus resolving the contradiction between security reliability and device complexity
Solution Approach 2:
The system changes telemetry collection parameters (such as collection frequency, data granularity, and sensor activation) based on risk posture assessments. When risk posture changes, the policy decision point modifies telemetry definition parameters to optimize the balance between security monitoring needs and system resource consumption, addressing the contradiction between improved security reliability and reduced device complexity
2Measurement precision
If telemetry data is collected more frequently to improve accuracy, then measurement precision is improved, but energy consumption increases
Solution Approach 1:
The patent implements periodic telemetry collection where the frequency and timing of data collection are adjusted based on risk posture. Instead of continuous high-frequency collection, the system uses periodic collection intervals that adapt to current security conditions, achieving necessary measurement precision while significantly reducing energy consumption during low-risk periods
Solution Approach 2:
The telemetry collection frequency is made dynamic rather than static. The policy decision point adjusts collection intervals based on changing risk postures, increasing frequency when precision is critical for security decisions and reducing frequency when lower precision suffices, thereby resolving the contradiction between measurement precision and energy consumption
3Adaptability or versatility
If adaptive telemetry adjustment is implemented to improve security responsiveness, then adaptability is improved, but system complexity increases
Solution Approach 1:
The patent introduces a policy decision point as an intermediary component that manages the complexity of adaptive telemetry adjustment. This intermediary receives risk posture information, determines appropriate telemetry definitions, and distributes them to relevant IHSs, thereby enabling security responsiveness without requiring each individual system component to implement complex adaptive logic independently
Solution Approach 2:
The system implements feedback loops where telemetry data and risk posture assessments are continuously monitored and fed back to the policy decision point. This feedback mechanism enables the system to automatically adjust telemetry collection strategies in response to changing conditions, improving security responsiveness while centralizing the complexity management in the policy decision point rather than distributing it throughout the entire system
Data Source
AI summary
Systems and methods provided adaptive collection of telemetry. A policy decision point of a zero-trust computing environment receives an indication of a change in risk posture within the environment. The policy decision point identifies a telemetry definition specifying telemetry being collected by one or more IHSs that are currently accessing a protected resource of the zero-trust computing environment. The telemetry definition is updated to specify adjusted telemetry to be collected by an IHS that is currently accessing the protected resource and the updated telemetry definition is transmitted to the IHS. Based on the updated telemetry definition received from the policy decision point, the IHS adjust measurements by one or more of the sensors of the IHS. Telemetry generated based on the adjusted measurements is transmitted by the IHS to one or more destinations specified in the updated telemetry definition.