Security-Aware Path Computation Using Vulnerability Remediation Scores
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing path computation engines in connection-oriented communication networks are insufficient in addressing security vulnerabilities, as they either reactively switch paths after compromise or provide impractical proactive switching, lacking scalability and practical security awareness.
Innovation Solution
A path computation engine that quantifies node security by using common vulnerability scores and remediation levels to proactively compute paths, accounting for the extent to which nodes have remediated security vulnerabilities, facilitating scalable and cost-effective security-aware path computation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If proactive path switching is implemented before path compromise, then network security is improved, but device complexity and cost increase due to requirements for security audits, assessments, and log elaborations
Solution Approach 1:
The patent extracts the security assessment function from complex manual audits and log analyses, consolidating it into automated vulnerability score retrieval from external databases. The PCE obtains vulnerability scores directly from databases without performing comprehensive security audits, thereby reducing device complexity while maintaining proactive security awareness.
Solution Approach 2:
The system enables self-service by automatically retrieving vulnerability scores from external databases without requiring manual security assessments. The PCE autonomously obtains and processes vulnerability information, eliminating the need for complex security audit procedures and reducing operational complexity.
2Reliability
If comprehensive security audits and log elaborations are performed, then path security awareness is improved, but loss of time and productivity decrease due to impractical complexity and cost
Solution Approach 1:
The patent extracts the time-consuming security audit and log analysis functions from the path computation process. Instead of performing comprehensive security assessments, the system retrieves pre-computed vulnerability scores from external databases, dramatically reducing the time required for security-aware path computation while maintaining accurate security awareness.
Solution Approach 2:
Vulnerability scores are computed and stored in external databases in advance, before path computation is needed. This preliminary action allows the PCE to quickly retrieve pre-analyzed security information during path computation, eliminating the need for real-time security audits and log elaborations that would slow down path computation.
3Reliability
If security-aware path computation is implemented, then network security is improved, but scalability is reduced due to computational complexity and data requirements
Solution Approach 1:
The patent introduces external vulnerability databases as intermediaries between the PCE and network security data. These databases store pre-computed vulnerability scores for numerous nodes, allowing the PCE to efficiently query security information without performing complex analyses. This intermediary approach enables scalability by centralizing security data management and allowing parallel queries across multiple nodes.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A path computation engine (16) computes a path (14) over which data (12) is to be conveyed in a communication network (10). The path computation engine (16) obtains a vulnerability score set and a remediation level set for each node (10-1…10-N) that is a candidate for including in the path (14). The vulnerability score set obtained for a node (10-1…10-N) includes common vulnerability score(s) (20C) for one or more security vulnerabilities applicable to the node (10-1…10-N), with the common vulnerability score (20C) for a security vulnerability quantifying an extent to which the security vulnerability is exploitable and/or impactful. The remediation level set obtained for a node (10-1…10-N) includes remediation level(s) (18) for the one or more security vulnerabilities that are applicable to the node (10-1…10-N), with the remediation level (18) for a security vulnerability quantifying an extent to which the node (10-1…10-N) has remediated the security vulnerability. The path computation engine (16) computes the path (14) as a function of these vulnerability score set(s) and remediation level set(s).