Edge-Based Auto Containment Without Inbound Network Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing auto containment solutions in public clouds face challenges in securely communicating with endpoints within a company network without allowing incoming connections, which can introduce security and operational risks.
Innovation Solution
Implementing a distributed framework with a Central Containment Component (CCC) and an Edge Containment Component (ECC) residing outside the perimeter of the company network, which is able to securely communicate with an endpoint residing inside the company network, which is able to securely communicate with an endpoint residing inside the company network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the company network allows incoming connections from the internet to enable cloud-based auto containment, then containment speed and automation are improved, but network security and risk exposure worsen
Solution Approach 1:
Instead of allowing incoming connections from the cloud to the company network, the solution inverts the communication direction: the edge containment component inside the company network initiates outgoing connections to poll for containment instructions from the cloud. This reversal maintains containment functionality while eliminating the security risk of incoming connections.
Solution Approach 2:
The patent introduces a messaging queue service as an intermediary between the cloud-based central containment component and the edge containment component inside the network. The edge component polls this queue for instructions, enabling indirect communication that avoids direct incoming connections while maintaining the containment workflow.
2Reliability
If manual containment procedures are used to maintain network security, then security control is improved, but containment time and response speed worsen
Solution Approach 1:
The edge containment component is deployed inside the company network and autonomously polls the messaging queue for containment instructions. When malicious activity is detected, the system automatically executes containment actions without requiring manual administrator intervention, achieving both speed and security through automated self-service containment.
3Ease of manufacture
If a SaaS-based central containment component runs in the public cloud, then deployment flexibility and cost-effectiveness are improved, but communication security and network exposure worsen
Solution Approach 1:
The communication architecture is inverted so that instead of the cloud-based central containment component initiating connections to endpoints inside the network, the edge containment component inside the network initiates outgoing polling connections to the cloud service. This maintains the SaaS deployment model while eliminating insecure incoming connections.
Solution Approach 2:
A messaging queue service acts as an intermediary layer between the public cloud and the private network. The edge containment component polls this queue for instructions, enabling the SaaS model to function while maintaining network security through indirect, controlled communication rather than direct cloud-to-endpoint connections.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention concerns a method for automatically sending containment instructions from a central containment component contained in a public cloud to an endpoint contained inside a company network where a malicious activity has been detected; the method comprising the following steps: - the central containment component elaborates and places a secured containment instruction inside a messaging queue of the central containment component, - a component, called edge containment component, running inside the company network, periodically polls the messaging queue service by creating an outgoing connection from the company network to the central containment component in the public cloud, - when the edge containment component detects the containment instruction, the edge containment component retrieves, decodes and sends the containment instruction to the endpoint inside the company network.