Distributed Security Framework for Compromised System Management

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing distributed systems face challenges in efficiently managing security, particularly in reducing resource costs and minimizing the impact of compromises on the system.

Innovation Solution

A security framework is implemented that distributes authority for validating entities across the distributed system, using a hierarchy based on weighted reputation scores to prioritize more reliable data processing systems. This framework allows for the identification and remediation of compromised systems, and the exclusion of untrusted systems from the hierarchy.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If a centralized security management approach is used in distributed systems, then security control is simplified, but system reliability decreases when the central authority is compromised

Engineering Contradiction:

Improvesecurity control simplicityVSAvoidsystem security reliability

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent divides the centralized security authority into multiple distributed security authorities throughout the system. Each security authority manages authentication and authorization for a specific subset of system resources, eliminating the single point of failure while maintaining manageable control segments.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces security agents as intermediary components that operate between users and system resources. These agents locally cache security decisions and authentication tokens, mediating access control without requiring constant communication with central authorities, thereby improving both reliability and operational simplicity.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Difficulty of detecting and measuring

If comprehensive security monitoring is implemented across all system components, then detection of compromises improves, but computational resource consumption increases

Engineering Contradiction:

Improvecompromise detection capabilityVSAvoidcomputational resource consumption

Core Design Contradiction:

Difficulty of detecting and measuringVSUse of energy by moving object

Solution Approach 1:

The patent implements security monitoring with local quality by having security agents perform detection and analysis only for resources under their specific jurisdiction. Each agent monitors local system behavior, authentication events, and access patterns relevant to its assigned resources, avoiding unnecessary monitoring of entire system components.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent applies partial monitoring by focusing security detection efforts on critical system components and high-value resources rather than uniformly monitoring all components. The system monitors authentication events, access patterns, and anomaly indicators selectively based on risk assessment, reducing computational overhead while maintaining effective compromise detection.

Inventive Principle:

Principle #16Partial or excessive action

3Stability of the object's composition

If the system maintains detailed authentication records for all users and resources, then authentication stability improves, but storage requirements and processing overhead increase

Engineering Contradiction:

Improveauthentication process stabilityVSAvoiddata storage requirements

Core Design Contradiction:

Stability of the object's compositionVSQuantity of substance

Solution Approach 1:

The patent extracts essential authentication information into distributed security agents that locally cache authentication tokens, user credentials, and access decisions. This extraction reduces the need to maintain comprehensive authentication records across the entire system while preserving authentication stability through local caching of critical security data.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent changes the storage parameters by transitioning from storing complete authentication records to storing condensed authentication tokens and security decisions. The system maintains authentication stability by caching essential parameters locally at security agents rather than maintaining full detailed records throughout the distributed system.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS12316684B2System and method for managing communication paths responsive to compromise events

Publication Date: 2025.05.27 DELL PROD LP

AI summary

Methods and systems for securing distributed systems are disclosed. The distributed systems may include data processing systems subject to compromise by malicious entities. If compromised, the data processing systems may impair the services provided by the distributed system. To secure the distributed systems, the data processing systems may implement a security framework. The security framework may utilize a hierarchy that defines authority for validating trusted entities. The hierarchy may vest authority across the distributed system, and may be based on a reputation (e.g., weighted reputation) of each of the data processing systems within the distributed system. If the reputation indicates that a data processing system is compromised, the data processing system may be ejected and a communication topology of the distributed system may be remodeled.