Network Access Control via Process-Specific Vulnerability Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Network Admission Control (NAC) systems face inefficiencies due to infrequent host assessments, blanket blocking of network traffic based on single vulnerabilities, dependency on prior network maps, and time-consuming pattern matching for multiple applications rather than specific vulnerabilities.
Innovation Solution
Implement a method and system for network access control that uses traffic monitoring and vulnerability detection based on process-related information, allowing for targeted blocking of vulnerable processes rather than entire hosts, and employing a centralized engine to assess and block malicious connections in real-time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If periodic scans are run at high frequency to detect host status changes, then detection reliability is improved, but system resource consumption and complexity increase
Solution Approach 1:
The host itself performs self-assessment by executing assessment agents that collect security state information locally. This eliminates the need for external periodic scanning infrastructure while maintaining continuous detection capability. The host automatically generates assessment data and reports it to the NAC server, achieving high-frequency detection without adding external scanning complexity.
Solution Approach 2:
The system implements continuous feedback loops where hosts report their security state in real-time to the NAC server, which immediately processes and responds with access decisions. This feedback mechanism enables reliable detection of status changes without requiring complex periodic scan scheduling, as the system continuously monitors and reacts to state changes as they occur.
2Reliability
If blanket blocking of entire host is applied upon vulnerability detection, then network security is improved, but network productivity deteriorates
Solution Approach 1:
The system segments the host into individual processes and applications for granular security control. Instead of blocking the entire host, the NAC server identifies and blocks only the specific vulnerable process or application causing the security issue. This segmentation allows legitimate processes to continue operating while preventing malicious or vulnerable ones, maintaining both security and productivity.
Solution Approach 2:
The system applies different security actions to different processes on the same host based on their individual risk profiles. Some processes may be blocked while others are allowed, creating local quality variations in security enforcement. This enables selective blocking of vulnerable processes without affecting the overall host functionality or network productivity.
3Reliability
If pattern matching is applied to multiple applications installed on host, then detection coverage is improved, but processing time increases
Solution Approach 1:
The system extracts and applies only the specific pattern sets relevant to the identified vulnerable application or process, rather than scanning against all possible application patterns. The NAC server receives process identification information and selectively loads and applies only the corresponding vulnerability patterns, dramatically reducing processing time while maintaining detection coverage for the relevant application.
Solution Approach 2:
The system performs partial pattern matching by applying only the necessary subset of patterns required for the specific vulnerable application identified, rather than exhaustively checking all application patterns. This partial action approach maintains adequate detection coverage for the relevant application while significantly reducing unnecessary processing time spent on unrelated applications.
Data Source
AI summary
Disclosed are various embodiments of method and system for network access control. The method may involve traffic monitoring and vulnerability detection using process information. The system may analyze the vulnerability as a process malfunctioning where preventive action focuses on process blocking as opposed to host blocking, which can lead to improved performance and productivity of a network. Techniques may use process related information, connection information, and network packet information for network control. The information may be used to identify and detect a known vulnerability in network activities. Techniques may further transmit, in response to the detection, an authorization decision regarding allowing or blocking the process running on the host.