Containerized Health Check for Network Access Control

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

In bring-your-own device (BYOD) and Internet of Things (IoT) environments, unknown or untrusted computing devices pose a risk to networks due to potential vulnerabilities such as outdated patches and unmodified antivirus software, making it challenging to safely evaluate their health before granting access.

Innovation Solution

The method involves using segregated containers on a computing device to establish separate tunnels with a network server, where a health-check status is provided to determine the level of access, with containers being periodically updated based on the device's health status, ensuring secure access to the network.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If unknown or untrusted computing devices are allowed to access the network in BYOD and IoT environments, then device connectivity and user convenience are improved, but network security and reliability deteriorate due to potential vulnerabilities such as outdated patches and unmodified antivirus software

Engineering Contradiction:
Improvedevice connectivityVSAvoidnetwork security
Core Design Contradiction:
Adaptability or versatilityVSReliability

Solution Approach 1:

The system performs a health check on the computing device before granting network access. The health check container is executed to assess the device's security status, including checking for outdated patches and antivirus software. Only after this preliminary evaluation is complete does the system decide whether to allow network access, preventing potentially compromised devices from connecting to the network.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent introduces a health check container as an intermediary component between the computing device and the network. This container acts as a mediator that evaluates the device's health status and communicates the results to the network access control system. The container itself is designed with minimal privileges and is isolated from the main system, reducing the risk of compromise.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If health checks are performed on computing devices before network access, then network security is improved, but system complexity and processing time increase

Engineering Contradiction:
Improvenetwork securityVSAvoidsystem complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The health check functionality is segmented into a separate, isolated container that is distinct from the main computing device operating system. This containerization approach allows the health check to be performed independently with its own set of privileges and dependencies, reducing the complexity impact on the main system. The container can be updated, removed, or modified without affecting the core device functionality.

Inventive Principle:
Principle #1Segmentation

3Measurement precision

If health check containers are periodically updated and re-executed, then access control accuracy is improved, but processing time and energy consumption increase

Engineering Contradiction:
Improveaccess control accuracyVSAvoidprocessing time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The system implements periodic health checks where the health check container is re-executed at predetermined intervals to reassess the device's security status. This periodic action ensures that access control decisions are based on up-to-date information about the device's health, improving the accuracy of access control while allowing the system to return to normal operation between checks.

Inventive Principle:
Principle #19Periodic action

Data Source

PatentEP3832972B1Methods and systems for accessing a network
Publication Date: 2024.01.03 BLACKBERRY LTD
  • EP3832972B1 patent drawingFigure 1
  • EP3832972B1 patent drawingFigure 2
  • EP3832972B1 patent drawingFigure 3

AI summary

A method of accessing a network comprises providing, via a first container establishing a first tunnel between a computing device and a network server, a health-check status of the computing device to the network server, and accessing, via a second container establishing a second tunnel between the computing device and the network server, the network at a level of access based on the health-check status of the computing device.