Agent-Mediated Security Scanning for Private Targets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security scanning technologies struggle to identify and respond to security breaches in computer systems that are not directly accessible or require persistent software installations, especially when target systems lack publicly accessible addresses.
Innovation Solution
A testing computer system sends test payloads to client systems, which forward them to target systems for scanning, generating results that indicate breaches, and allows for user-selected responses through runtime payloads executed by the client system or target systems without requiring persistent software installations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If persistent software installations are used on target systems for security scanning, then scanning capability is improved, but system complexity and long-term performance impact increase
Solution Approach 1:
The patent introduces an agent program as an intermediary component that runs on the client computer system. This agent receives test payloads from the testing computer, forwards them to target systems, and collects results. By using this intermediary, the system achieves reliable security scanning of target systems without requiring direct persistent software installations on each target, thus reducing overall system complexity while maintaining scan capability.
Solution Approach 2:
The security scanning function is segmented into separate components: the testing computer system that generates test payloads, the agent program that distributes and collects results, and the target systems that are scanned. This segmentation allows the scanning capability to be implemented without installing persistent software on target systems, reducing the complexity and performance impact on those systems while maintaining reliable security monitoring.
2Adaptability or versatility
If security scans are performed on systems with private addresses, then coverage is improved, but accessibility and response capability worsen
Solution Approach 1:
The agent program installed on the client computer system acts as a mediator that enables the testing computer to indirectly access target systems with private addresses. The agent receives test payloads from the testing computer and forwards them to target systems that are not directly accessible from the external network. This intermediary approach improves scan coverage to include private address systems while avoiding the accessibility problems that would arise from direct connection attempts.
3Reliability
If runtime payloads are executed for response actions, then response effectiveness is improved, but execution time and resource usage increase
Solution Approach 1:
The system compiles runtime payloads in advance based on the analysis of test results and user selections. By preparing the response payloads beforehand and having them ready for immediate execution through the agent program, the system achieves effective breach response while minimizing execution time. The payloads are prepared and queued before actual breach events occur, allowing rapid response when needed.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A testing computer system (110) communicates with a client computer system (120) coupled to one or more target computer systems (124A-124n). The testing computer system (110) sends test payloads (134) to the client computer system (120), which are forwarded to the target computer systems (124A-124n). Based on the test results (136) generated by the target computer system (124A-124n), the testing computer system (110) generates a runtime payload (138) that is executable to perform a response to a security breach identified using the test results and sends the runtime payload (138) to the client computer platform for execution. The testing computer system (110) receives from the client computer platform (120) an indication of the execution of the runtime payload.