Scan Assistant TLS Authentication for Credential-Free Asset Assessment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Authenticated scans in network computing systems require administrative or root access credentials, which complicate deployment and increase the risk of credential compromise, leading to potential unfettered access and non-compliance with policy benchmarks.
Innovation Solution
A scan assistant is implemented on network assets to authenticate scan engines without using third-party credentials, utilizing TLS protocol with two-way client certificate authentication to establish secure communication and bypass policy exceptions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If administrative or root access credentials are used for authenticated scans, then authentication capability is improved, but device complexity and security risk increase
Solution Approach 1:
The patent extracts the authentication capability from traditional credential-based methods by implementing a scan assistant that uses TLS certificates and signed commands. This separates the authentication mechanism from administrative credentials, allowing the scan engine to authenticate without requiring complex credential management while maintaining reliable authentication capability.
Solution Approach 2:
The scan assistant acts as an intermediary component deployed on the asset that mediates between the scan engine and the asset's network services. It uses TLS certificates for mutual authentication and signed commands for authorization, eliminating the need for administrative credentials while enabling authenticated scanning through this intermediate layer.
2Reliability
If administrative credentials are distributed for scan authentication, then authentication capability is improved, but vulnerability to credential compromise increases
Solution Approach 1:
The patent removes administrative credentials from the authentication process entirely, replacing them with TLS certificates and signed commands. This extraction eliminates the vulnerability to credential compromise while preserving authentication capability, as the scan assistant and scan engine authenticate through certificate-based mutual authentication rather than sharing sensitive credentials.
Solution Approach 2:
The patent uses signed commands with embedded authorization that are valid only for specific scan operations. Each command is signed by the scan assistant and can be independently validated, creating short-lived, operation-specific authorization tokens that do not provide unfettered access if compromised, unlike persistent administrative credentials.
3Productivity
If policy exceptions are implemented to allow scan authentication, then scan capability is improved, but compliance status deteriorates
Solution Approach 1:
The scan assistant is a self-contained component that implements its own authentication and authorization mechanisms using TLS certificates and signed commands. It does not require policy exceptions or administrative credentials to function, as it independently establishes secure communication with the scan engine and executes authorized scan operations, thereby maintaining both scan capability and policy compliance simultaneously.
Data Source
AI summary
A method for authenticated asset assessment is provided. The method involves executing a scan assistant on an asset to allow a remote scan engine to execute one or more scan operations on the asset for determining a state of the asset. The scan assistant may verify the identity of the scan engine by checking that a certificate received from the scan engine is signed with a private key associated with the scan engine. In some embodiments, the authentication may be performed as part of a TLS handshake process that establishes a TLS connection between the scan engine and the scan assistant. Once the scan engine is authenticated, the scan engine may communicate with the scan assistant according to a communication protocol to collect data about the asset. Advantageously, the disclosed technique reduces security risks associated with authenticated scans and improves the performance of authenticated scans.