SD-WAN Site Remediation Using External Security Telemetry
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current enterprise networks lack the ability to identify compromised endpoints within the network and take corrective action, leading to inefficiencies and security vulnerabilities due to the inability of existing applications to communicate network-level remedial actions.
Innovation Solution
A system that integrates telemetry data from non-enterprise providers, such as Microsoft Defender, to identify impacted users and groups, apply security policies, and perform remedial actions like quarantining or staging compromised endpoints, using APIs to access additional data and enforce firewall policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If applications identify threats and vulnerabilities at the endpoint level, then security detection capability is improved, but the ability to take network-level remedial action deteriorates
Solution Approach 1:
The patent introduces a network intermediary system that receives telemetry data from endpoint applications and translates it into network-level remedial actions. This intermediary bridges the gap between endpoint detection capabilities and network-level response abilities, allowing the network to act on application-generated security data without requiring the application itself to have network-level control
Solution Approach 2:
The patent combines endpoint-level threat detection functionality with network-level remedial action capabilities into a unified security system. By merging data from multiple sources (application telemetry, network traffic analysis, endpoint security status) and coordinating responses across different layers, the system achieves both precise detection and effective remediation
2Adaptability or versatility
If applications operate independently at the endpoint level, then application autonomy is improved, but network security coordination deteriorates
Solution Approach 1:
The patent implements a feedback mechanism where endpoint applications report security telemetry data to the network, which then coordinates remedial actions and provides status updates back to the applications. This closed-loop feedback system maintains application autonomy while ensuring network-wide security coordination through continuous information exchange and coordinated response
3Device complexity
If the network lacks integrated security mechanisms, then system simplicity is improved, but security vulnerability identification and response capability deteriorates
Solution Approach 1:
The patent implements a universal security mechanism that operates across multiple network functions and layers. The integrated security system performs diverse functions including threat detection, data collection, analysis, and coordinated remediation through a single multi-functional platform, thereby enhancing security capability without proportionally increasing overall system complexity
Data Source
AI summary
This disclosure describes techniques and mechanisms for improving security within SDWAN fabric and utilizing telemetry data from non-enterprise providers to remediate compromised SDWAN site(s) and/or user(s). The techniques may implement an integration of non-enterprise application(s) and API(s) with an enterprise network, thereby enabling the enterprise network to identify compromised endpoint(s), identify user(s), group(s), site(s) that are impacted, and take a corrective action (by the enterprise network and/or the non-enterprise application(s) or API(s)) on the enterprise fabric.