Enterprise Network Policy Enforcement Using VEX and Synthetic Tests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network controllers in enterprise environments struggle to identify and address vulnerabilities proactively due to limited visibility into software components and their potential exploitability, leading to increased risk of data breaches and compromised user privacy.
Innovation Solution
A system utilizing SBOM and VEX intelligence to generate dynamic and intelligent network controller policies by monitoring network devices, generating context data, conducting synthetic tests, and determining policies to mitigate vulnerabilities, thereby reducing false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network controllers use static VEX data for policy enforcement, then vulnerability information can be shared between network controller and components, but false positives occur due to lack of dynamic context
Solution Approach 1:
The patent transforms static VEX data into dynamic vulnerability assessment by continuously collecting runtime context data from network devices, applications, and software components. The system dynamically updates vulnerability status based on current exploitation conditions, threat intelligence, and environmental factors, enabling policies to adapt in real-time rather than relying on fixed vulnerability databases.
Solution Approach 2:
The system implements feedback loops where vulnerability assessments are continuously refined based on synthetic test results, threat intelligence feeds, and actual exploitation attempts. The network controller receives feedback from deployed policies and adjusts vulnerability prioritization and policy enforcement accordingly, creating a closed-loop system that learns from operational data.
2Reliability
If network controllers lack visibility into software components, then device management is simplified, but vulnerability identification and proactive mitigation are compromised
Solution Approach 1:
The patent segments the software inventory into hierarchical layers including network devices, applications, software components, and underlying libraries. Each segment is tracked independently with its own SBOM data and vulnerability profile, allowing the system to manage complexity through modular organization while maintaining comprehensive visibility into the entire software supply chain.
Solution Approach 2:
The system introduces intermediary components including Software Bill of Materials (SBOM) data structures and vulnerability intelligence platforms that mediate between network devices and the controller. These intermediaries standardize software component information exchange, enabling the controller to gain visibility without directly managing the complexity of individual software inventories.
3Productivity
If generic network policies are enforced across the network, then policy deployment is efficient, but false positives increase due to lack of contextual awareness
Solution Approach 1:
The patent implements local quality by customizing policy enforcement at each network device based on its specific vulnerability profile, software composition, and operational context. Instead of uniform policies, the system generates device-specific policy recommendations that consider local factors such as criticality, exploitation risk, and business impact, thereby maintaining high deployment efficiency while eliminating false positives.
Solution Approach 2:
The system dynamically changes policy parameters based on vulnerability severity, exploitation conditions, and contextual factors. Policy enforcement transitions from static rules to adaptive parameters that adjust thresholds, prioritization weights, and mitigation strategies based on real-time vulnerability assessments and threat intelligence, enabling efficient deployment with high precision.
Data Source
AI summary
The techniques described herein enable a network controller to create multi-faceted policies. The network controller may comprise a VEX processing engine that captures VEX data and generates vulnerability insights, a retrieval augmented generation (RAG) component that can be utilized to generate context data based on the VEX data, vulnerability insights, and data captured by the network controller. The network controller may implement or input the context data to a model, which outputs customized synthetic test(s). The network controller identify, generate, or modify network policies and/or network control policies based on the output from executing the synthetic tests.