Universal Configuration References for Secure Admission Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional admission control systems lack a comprehensive and consistent method to describe the software and hardware configurations of computing entities, limiting their ability to make informed decisions about establishing secure communication sessions.
Innovation Solution
A universal reference system is introduced to exhaustively describe computing entities using a hierarchical representation of software and hardware components, enabling detailed inventory and vulnerability assessment through a lightweight reference that can be used for admission control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If conventional admission control methods are used, then the system can perform basic identity verification, but it cannot obtain comprehensive software and hardware configuration details for informed security decisions
Solution Approach 1:
The patent segments the configuration description into hierarchical components: computing entities are divided into software components and hardware components, which are further segmented into sub-components. This segmentation allows comprehensive configuration details to be obtained through a structured, manageable hierarchy rather than attempting to capture all information at once.
Solution Approach 2:
The patent creates a universal reference structure that can represent any computing entity's configuration in a consistent, standardized format. This universal description method works across different software and hardware platforms, enabling the admission control system to handle diverse configurations uniformly without requiring platform-specific approaches.
2Measurement precision
If comprehensive configuration details are obtained through detailed inventory methods, then security assessment accuracy improves, but the time and computational resources required increase significantly
Solution Approach 1:
The patent performs preliminary actions by pre-computing and storing the hierarchical configuration descriptions in a standardized format before admission control is needed. The universal reference structure is prepared in advance, allowing the admission control system to quickly retrieve and assess configurations without performing complex inventory operations at the time of admission decision-making.
Solution Approach 2:
The patent extracts only the essential configuration information needed for security assessment into a compact universal reference format. Rather than processing complete configuration dumps, the system extracts and stores key identifiers and hierarchical relationships that can be quickly compared against security policies, reducing processing time while maintaining assessment accuracy.
3Productivity
If a lightweight reference system is used for admission control, then processing speed improves, but the ability to exhaustively describe software and hardware components is reduced
Solution Approach 1:
The patent implements a nested hierarchical structure where computing entities contain software components, which contain sub-components, which in turn contain hardware components and their sub-components. This nesting allows the system to represent exhaustive configuration details at each level while maintaining a compact overall structure that can be processed efficiently. The nested organization enables selective traversal of only the necessary hierarchy levels for each admission control decision.
Data Source
AI summary
A method, computer system, and computer program product are provided for performing admission control tasks. A universal reference for an executing application is obtained, wherein the universal reference identifies one or more components of the executing application by additional universal references assigned to the one or more components. A description of the executing application is determined by enumerating each additional universal reference of the one or more components and additional sub-components, wherein the description exhaustively identifies components and sub-components of the executing application. The identified one or more components and sub-components are assessed to perform an admission control operation between the executing application and a second application.