Endpoint Product Management via Inventory Filtering

Solution Overview

Problem

Conventional patch management systems in managed networks often distribute unnecessary product updates, leading to inefficiencies and persistence of vulnerabilities due to lack of knowledge about the products installed on endpoints, resulting in wasted resources and unpatched endpoints.

Innovation Solution

The system discovers products on managed endpoints, generates an endpoint-specific inventory, filters out unnecessary updates, and distributes only relevant updates, ensuring endpoints are up-to-date and secure.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If product updates are distributed to all endpoints without verification, then cybersecurity vulnerabilities are addressed, but bandwidth and storage resources are wasted on unnecessary updates

Engineering Contradiction:

Improveendpoint securityVSAvoidbandwidth usage

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The system performs preliminary actions by discovering and inventorying products on endpoints before distributing updates. The management device queries each endpoint to identify installed products, then uses this information to pre-filter the update list, distributing only relevant updates rather than all available updates.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system extracts only the necessary subset of updates from the complete update catalog by comparing the update list against the discovered product inventory on each endpoint. This extraction process removes unnecessary updates before distribution, reducing bandwidth consumption while maintaining security coverage for actual installed products.

Inventive Principle:

Principle #2Taking out (Extraction)

2Reliability

If product updates are distributed to all endpoints without verification, then cybersecurity vulnerabilities are addressed, but storage and processing resources are consumed by unnecessary updates

Engineering Contradiction:

Improveendpoint securityVSAvoidstorage resources

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The system performs preliminary actions by discovering and inventorying products on endpoints before distributing updates. The management device queries each endpoint to identify installed products, then uses this information to pre-filter the update list, distributing only relevant updates rather than all available updates.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system extracts only the necessary subset of updates from the complete update catalog by comparing the update list against the discovered product inventory on each endpoint. This extraction process removes unnecessary updates before distribution, reducing bandwidth consumption while maintaining security coverage for actual installed products.

Inventive Principle:

Principle #2Taking out (Extraction)

3Measurement precision

If comprehensive product discovery is performed on endpoints, then update accuracy is improved, but system complexity increases

Engineering Contradiction:

Improveupdate relevanceVSAvoiddiscovery process complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The system introduces an intermediary agent on each endpoint that facilitates product discovery. This agent acts as a mediator between the management device and the endpoint's product inventory, providing a standardized interface for querying installed products without requiring complex direct analysis of each endpoint's file system or registry.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11853739B2Automated endpoint product management

Publication Date: 2023.12.26 IVANTI INC

AI summary

A method of automated software management includes importing update metadata consumed from an update list describing cybersecurity vulnerabilities and product updates. Based on the update metadata, the method includes generating an initial update list including outstanding product updates for endpoints included in a managed network. The method includes discovering products of an endpoint of the managed network. Based on discovered products, the method includes generating an endpoint-specific inventory including product metadata of the products loaded on the endpoint. The method includes identifying an unnecessary product update of the outstanding product updates not related to the discovered products. The method includes filtering the unnecessary product update from the initial update list to generate a modified update list including a subset of outstanding product updates and omitting the unnecessary product update. The method includes distributing only the subset of outstanding product updates of the modified update list to the managed endpoint.