Endpoint Security via Static Routing and Tamper Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Public cloud environments face significant security challenges due to unsecured endpoints, which can lead to data leaks and increased vulnerability to cyber attacks, especially in hybrid networks where endpoint security measures are inadequate.
Innovation Solution
Implementing a secure virtual network platform that uses agents and a controller to manage endpoints, with whitelisting and static routing tables to authenticate and authorize connections between components, and periodically checks for tampering to ensure secure data transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cloud endpoints are left unsecured to maintain ease of operation, then endpoint accessibility is improved, but security vulnerability increases
Solution Approach 1:
The patent introduces a virtual network controller and security agents as intermediaries between endpoints and the network. These components automatically manage security policies, authenticate connections, and monitor threats without requiring user intervention, thus maintaining ease of operation while significantly improving security reliability
Solution Approach 2:
The system performs preliminary security checks, authentication, and policy enforcement before allowing endpoint connections. Security agents are pre-installed on endpoints, and the controller pre-configures security policies and whitelists, ensuring that security measures are in place before vulnerabilities can be exploited
2Reliability
If security checks are performed at every connection request to improve security, then security reliability is improved, but network performance deteriorates
Solution Approach 1:
Security policies, authentication credentials, and connection rules are pre-configured in the virtual network controller and cached at security agents before connection requests occur. This allows the system to perform rapid lookups and decisions during actual connections, maintaining high security reliability while minimizing performance impact
Solution Approach 2:
The security checking process is segmented into multiple stages: initial authentication by the controller, ongoing monitoring by local agents, and periodic policy updates. This segmentation allows critical path operations to be fast while less time-sensitive operations (like full policy validation) occur asynchronously, preserving network performance
3Reliability
If static routing tables are implemented to control network traffic, then network security is improved, but routing flexibility deteriorates
Solution Approach 1:
The patent implements dynamic routing tables that are initially populated with static security-controlled routes but can be automatically updated by the virtual network controller based on real-time network conditions, security events, and policy changes. This allows the system to maintain strict security control while adapting to new requirements, thus improving both security reliability and routing flexibility
Solution Approach 2:
The system incorporates feedback mechanisms where security agents monitor network traffic and report anomalies to the controller, which then dynamically adjusts routing tables in response. This feedback loop ensures that routing remains flexible and adaptive while maintaining security, as changes are driven by monitored security needs rather than arbitrary modifications
Data Source
AI summary
A controller connects to endpoints. Profiles specify valid flows between groups of endpoints. Endpoints are provisioned according to the profiles. Provisioning includes the controller generating static routing tables. A static routing table includes an IP subnet that an endpoint will be allowed to connect to. The static routing table is programmed into a network kernel table of an OS at the endpoint. The network kernel table includes other routing information not provided by the controller. A copy is made of the network kernel table, maintained at the endpoint, and another copy is sent to the controller. The table in the OS is periodically compared with the copy of the table to detect tampering of the table in the OS. Upon detection of tampering, the tampered table in the OS is replaced with the copy of the table maintained at the endpoint and an alert is issued to the controller.