Endpoint Policy Configuration via Attribute-Based Setting Retrieval
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large enterprises face significant network load and time inefficiencies when implementing security policies across thousands to hundreds of thousands of endpoint computers, as traditional methods require manual configuration from a central location, which is labor-intensive and time-consuming.
Innovation Solution
A database-driven policy management system that allows endpoint computers to query a configuration database for device settings based on current attributes, minimizing database queries and enabling efficient policy delivery by grouping endpoints and storing policy data in a structured format.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If configuration changes are pushed from a central location to all electronic devices, then uniform policy implementation is achieved, but network load increases significantly and completion time extends to hours or days
Solution Approach 1:
Instead of pushing configuration changes from the central server to all endpoints (traditional approach), the patent inverts the approach by having endpoints pull their specific configuration data from the database. Each endpoint queries the database using its identifier and receives only its relevant settings, transforming a push-based system into a pull-based system that reduces network load and deployment time while maintaining uniform policy implementation.
2Reliability
If configuration changes are pushed from a central location to all electronic devices, then uniform policy implementation is achieved, but network load increases significantly
Solution Approach 1:
The patent extracts only the necessary configuration data for each specific endpoint from the centralized database, rather than transmitting all configuration data to all endpoints. Each endpoint queries the database with its identifier and receives only its relevant settings, significantly reducing network bandwidth consumption while ensuring uniform policy implementation across all devices.
3Adaptability or versatility
If manual configuration is performed from a central location, then policy control is centralized, but labor intensity and time consumption increase
Solution Approach 1:
The patent implements a self-service mechanism where each endpoint automatically queries the centralized database for its configuration settings using its unique identifier. This eliminates the need for manual configuration by network administrators, as endpoints autonomously retrieve and apply their specific settings, thereby maintaining centralized policy control while dramatically improving configuration efficiency and reducing labor intensity.
4Reliability
If all endpoint computers receive policy notifications, then policy updates are comprehensive, but network traffic and processing overhead increase
Solution Approach 1:
The patent applies local quality by making policy update notifications endpoint-specific rather than universal. Each endpoint receives notifications and queries the database only for settings relevant to its specific identifier and policy requirements. This targeted approach ensures complete policy updates for each endpoint while minimizing network traffic volume by avoiding unnecessary data transmission to all endpoints.
Data Source
AI summary
A method comprises storing a policy type having a plurality of device settings for a plurality of endpoint computers; assigning a reference key to a device setting of the plurality of device settings, the reference key corresponding to a subset of endpoint computers of the plurality of endpoint computers; notifying the subset of the endpoint computers of the policy type; querying the database for a device setting of the plurality of device settings based on a current attribute of the endpoint computer; and fetching the device setting. Further disclosed are a computer system and computer program product configured to perform the method.