Endpoint Self-Isolation and Shunning in Heterogeneous Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Securing endpoints in heterogeneous enterprise networks is challenging due to their complexity and diversity, requiring significant administrator resources and posing risks from malicious actors.
Innovation Solution
Endpoints are configured to self-isolate upon detection of compromise and shun other compromised endpoints, with network devices managing communications and threat management facilities coordinating remediation, using out-of-band security information to facilitate integrated endpoint management across network boundaries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security tools (anti-virus software and behavioral monitoring) are used to secure endpoints, then endpoint protection is provided, but administrator resources are significantly consumed due to network complexity and device diversity
Solution Approach 1:
The patent implements automated self-service mechanisms where security agents on endpoints autonomously detect compromises, send notifications to the network address translation device, and trigger automatic shunning actions. This eliminates the need for administrator intervention in daily security operations, reducing resource consumption while maintaining protection reliability
Solution Approach 2:
The network address translation device serves as an intermediary that centralizes security management functions. It receives compromise notifications from security agents, maintains shun lists, and enforces communication restrictions. This intermediary approach simplifies complexity by consolidating security operations into a single management point rather than requiring distributed administrator control across diverse devices
2Reliability
If endpoints are isolated and communications are restricted upon compromise detection, then network security is improved, but network communication management becomes more complex
Solution Approach 1:
The network address translation device acts as an intermediary that automatically manages communication restrictions. When a compromise is detected, the device automatically adds the compromised endpoint to a shun list and blocks its communications without requiring complex manual configuration or coordination across multiple network devices
Solution Approach 2:
The system implements automated feedback loops where security agents continuously monitor endpoint status, send real-time compromise notifications to the network address translation device, and receive automatic enforcement actions. This feedback mechanism simplifies communication management by creating a closed-loop automated response system rather than requiring manual intervention
Data Source
AI summary
Endpoints and a corresponding switch within a heterogeneous network work cooperatively to respond to notifications of compromise in order to protect the enterprise network. Endpoints self-isolate when a local security agent detects a compromise, and shun a compromised one of the other endpoints in response to a corresponding notification. The switch forwards a notice of compromise from an endpoint to a threat management facility for the enterprise network and prevents communications from a compromised endpoint through the switch in response to receiving a corresponding request from the threat management facility.