Cached Neighbor Data for Discovering Unscannable Network Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise security systems face challenges in efficiently collecting and managing data for network scans due to dynamic configuration needs and the inability to detect all devices in the network, leading to potential vulnerabilities from unscanned devices.
Innovation Solution
A software agent installed on network devices uses operating system protocols like ARP and NDP to gather neighboring device data, converting it into a standardized format and sending it to a scan engine to identify previously unseen devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a scan engine scans devices in a network for security vulnerabilities, then network security is improved, but some devices may remain unscanned due to firewall configurations or network accessibility issues
Solution Approach 1:
The patent introduces software agents as intermediary components installed on network devices to mediate between the scan engine and the devices. These agents collect device information locally and transmit it to the scan engine, enabling the scan engine to discover devices that firewalls or network configurations prevent direct scanning. The agents act as intermediaries that bridge the information gap without requiring changes to firewall settings.
Solution Approach 2:
The software agents perform self-service by automatically collecting device information from the network devices they are installed on and transmitting this data to the scan engine. This eliminates the need for the scan engine to directly interact with all devices, allowing devices to essentially scan themselves through their own agents while maintaining security through the centralized scan engine processing.
2Reliability
If enterprise security systems collect data from computing resources to monitor them, then monitoring capability is improved, but data collection requirements change over time making configuration management difficult
Solution Approach 1:
The patent applies preliminary action by having software agents pre-installed on network devices that continuously collect and maintain device information in advance. This preliminary data collection ensures that when security assessments are needed, the information is already available, eliminating the need for complex real-time configuration changes or ad-hoc data gathering operations.
Solution Approach 2:
The system implements feedback mechanisms where the scan engine receives device information from agents, processes it, and can trigger re-assessments or updates. This feedback loop allows the system to adapt to changing security requirements dynamically without requiring complex reconfiguration of data collection mechanisms, as the agents continuously provide updated device information.
3Measurement precision
If network scanners attempt to scan all devices, then completeness of network assessment is improved, but scan effectiveness is reduced when firewalls block access to devices
Solution Approach 1:
The software agents serve as intermediaries that bypass firewall blocking by collecting device information locally on the network devices and transmitting it to the scan engine through alternative means. This eliminates the dependency on direct scan engine access to devices, allowing complete network assessment regardless of firewall configurations that would otherwise block scanning traffic.
Data Source
AI summary
A software agent executing on a computing device receives a request from a client to provide data associated with neighboring devices to the computing device. The client includes a scan engine to perform a network scan of a network that includes the computing device. The software agent accesses device data in a cache of an operating system command, determines, based on the device data, an identifier associated with each device that is neighboring the computing device, converts the device data into a standardized format to create neighboring device data, and sends the neighboring device data to the client.