Host Information Collection via Prioritized Probes and Counter Nonces
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network access control systems face challenges in efficiently collecting host information, managing host devices across various states, determining the appropriate peer sensor for probing, synchronizing host tables, and preventing replay attacks, particularly due to processor-intensive pseudorandom number generation for nonces.
Innovation Solution
The system initiates a host detection phase by transmitting information probes, including an agent probe, and generates nonces through hashing source values to authenticate host devices, while prioritizing probe types and synchronizing host tables based on timestamp comparisons.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pseudorandom number generation is used to generate nonces for authentication, then authentication security is improved, but processor intensity and computational overhead increase
Solution Approach 1:
The patent changes the method of nonce generation from pseudorandom number generation to sequential counter incrementing. Instead of using computationally intensive cryptographic random number generators, the system uses a simple counter that increments by one for each nonce, dramatically reducing processor intensity while maintaining authentication security through the use of cryptographic hashing functions on the counter values
Solution Approach 2:
The patent employs disposable, easily generated nonce values based on sequential counters rather than complex pseudorandom sequences. Each nonce is a simple incremental value that is used once and discarded, eliminating the need for expensive pseudorandom number generation while ensuring each authentication attempt uses a unique value
2Loss of information
If multiple information probes are transmitted to collect host information, then information collection completeness is improved, but network traffic and processing time increase
Solution Approach 1:
The patent applies preliminary action by sending a prioritized sequence of information probes before completing host authentication. High-priority probes that collect critical information are sent first, allowing the system to make authentication decisions based on essential data without waiting for all lower-priority probes to complete, thus reducing overall processing time while maintaining necessary information collection
Solution Approach 2:
The patent segments information collection into prioritized probe types, dividing the monolithic information gathering process into hierarchical tiers. Critical host identification and authentication data are collected through high-priority probes, while secondary information is gathered through lower-priority probes, allowing the system to proceed with essential functions using only the most important collected data
3Loss of energy
If a primary sensor is designated to probe host devices in a failover configuration, then network traffic is reduced, but reliability decreases when the primary sensor has poor communication channels
Solution Approach 1:
The patent implements dynamic sensor role assignment where the primary and secondary sensor roles are not fixed but can switch based on communication channel quality. The system continuously monitors the effectiveness of probes from the designated primary sensor and can dynamically transfer the probing role to the secondary sensor if the primary's communication channels are determined to be unreliable, thereby maintaining both traffic efficiency and probing reliability
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for collecting information of host devices. In one aspect, a method includes transmitting a plurality of information probes to the host device, including an agent probe that queries an agent installed on the host device for a unique agent identifier, monitoring for replies to the information probes from the host device during the host detection phase, ending the host detection phase in response to receiving a reply to the agent probe and that includes the unique agent identifier, resending the plurality of information probes and incrementing a repeat counter in response to not receiving a reply to the agent probe after the expiration of a time period and ending the host detection phase in response to a value of the repeat counter exceeding a maximum repeat value.