Agentless Network Session Security via Proximity Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for securing computing resources are inadequate in detecting improper access or unauthorized use during a session, as they often rely on dedicated software agents that require user installation, are incompatible, and have limitations in detecting various forms of insecure activities, or they incur high overhead and privacy concerns when monitoring network traffic.
Innovation Solution
A method and system for automatically and transparently detecting potential compromises or unauthorized use of endpoint computing devices through an agentless management session, using a security server to control user-facing sessions by receiving indications of anomalous activity or loss of proximity, and implementing control actions such as terminating or freezing the session without requiring dedicated software agents or altering network traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dedicated software agents are installed on endpoint devices to detect unauthorized use, then detection capability is improved, but device complexity and ease of operation deteriorate due to installation requirements and compatibility issues
Solution Approach 1:
The patent introduces a session manager as an intermediary component that runs within the application itself rather than as a separate dedicated agent. This session manager handles detection of unauthorized use and coordination with security servers, eliminating the need for separate installed software while maintaining detection capabilities.
Solution Approach 2:
The application performs security detection functions through its own session manager component rather than relying on external dedicated agents. The session manager uses available application resources and data structures to detect unauthorized use, making the system self-sufficient without additional software installations.
2Reliability
If network traffic is monitored to detect unauthorized use, then detection capability is improved, but system overhead and privacy concerns worsen
Solution Approach 1:
The patent extracts only the essential session data needed for security detection rather than monitoring all network traffic. The session manager retrieves specific session identifiers and compares them against authorized lists, filtering out unnecessary traffic data to reduce overhead while maintaining detection effectiveness.
Solution Approach 2:
Instead of implementing full network traffic monitoring, the patent applies partial action by only checking session identifiers against authorized lists. This selective approach provides sufficient detection capability without the excessive overhead of comprehensive traffic analysis.
3Reliability
If session control actions are implemented to respond to unauthorized use, then security response capability is improved, but ease of operation worsens due to potential disruption of legitimate sessions
Solution Approach 1:
The session manager continuously monitors session status and provides feedback to the security server. When unauthorized use is detected, the system sends notifications and receives instructions for appropriate control actions, enabling responsive security measures while maintaining awareness of legitimate session states to avoid unnecessary disruptions.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed embodiments relate to systems and methods for automatically and transparently detecting potential compromises or unauthorized use of endpoint computing devices. Techniques include engaging, at a security server, in an agentless management session with an application running on an endpoint computing device; controlling, at the security server and through the agentless management session, a user-facing session of the application; receiving, at the security server, an indication of anomalous activity or loss of a proximity between at least one of: the one or more personal computing devices associated with the user and the endpoint computing device, or the one or more personal computing devices associated with the user and the user; and implementing a control action in the agentless management session, based on the received indication.