Dynamic Posture Assessment Mitigating Reverse Engineering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network admission control (NAC) systems are vulnerable to reverse engineering attacks, particularly on devices where posture assessment software is executed, and communications between devices and NAC systems are susceptible to man-in-the-middle attacks, compromising network security.
Innovation Solution
Implementing a dynamic posture assessment system where the PA server generates commands for a thin PA client that dynamically executes them without statically storing proprietary code, using a secure connection and encryption with one-time keys, and employing a dynamic execution library like Java Reflection to minimize observability and protect against reverse engineering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If posture assessment software is loaded onto untrusted devices for execution, then network security protection is improved, but the software becomes vulnerable to reverse engineering attacks
Solution Approach 1:
The patent extracts the proprietary posture assessment logic from the device-executable software and relocates it to the NAC server. Only a minimal client agent remains on the device, which communicates with the server. This extraction eliminates the vulnerability to reverse engineering while maintaining the security assessment functionality, as the critical proprietary code never resides on untrusted devices.
Solution Approach 2:
The patent introduces an intermediary NAC server that mediates between the untrusted devices and the network. The server hosts the proprietary posture assessment software and communicates with device clients through standardized interfaces. This intermediary architecture allows the proprietary logic to remain protected on the server while still enabling security assessments of devices, resolving the contradiction between deployment and protection.
2Reliability
If posture assessment software is deployed on devices to enable security checks, then network access control is improved, but communications become susceptible to man-in-the-middle attacks
Solution Approach 1:
The patent applies preliminary anti-action by implementing encryption and authentication mechanisms before communications occur. The NAC server establishes secure communication channels with device clients using cryptographic protocols, preventing man-in-the-middle attacks from compromising the posture assessment data transmission. This preliminary security measure counteracts the vulnerability inherent in network communications.
3Productivity
If proprietary posture assessment code is stored on devices, then assessment functionality is improved, but the proprietary information becomes exposed to malicious software
Solution Approach 1:
The patent extracts proprietary posture assessment code from device storage and relocates it to the NAC server environment. The device client retains only minimal communication and execution capabilities, while the proprietary assessment logic resides exclusively on the server. This extraction eliminates proprietary information exposure to malicious software on devices while maintaining full assessment functionality through server-based processing.
Solution Approach 2:
The patent transitions the proprietary code from the device dimension to the server dimension, creating a spatial separation between where the code executes and where it is stored. This dimensional change allows the code to be protected in the server environment while still providing assessment functionality to devices, resolving the contradiction between functionality and information protection.
Data Source
AI summary
Methods and associated systems are provided to perform a security posture assessment (PA) of a device based on a PA process implemented on a server but not statically stored on the device. The method includes generating, by the server, commands to be performed by a dynamic command executor on the device. The dynamic command executor is configured to dynamically launch and execute system modules on the device, based on the commands, to perform operations in the PA process. The commands and the results may be exchanged between the server and the device via a secure communication connection. The commands may be sent in a message with an encryption key that encrypts the messages, and the received command results may also be encrypted using the encryption key. By not statically storing the PA process on the device, the PA process is protected from reverse engineering attacks.