Network isolation by policy compliance evaluation

• US 10,142,364 B2
• Filed: 09/21/2016
• Issued: 11/27/2018
• Est. Priority Date: 09/21/2016
• Status: Active Grant

• Current Assignee: UpGuard Inc.
• Original Assignee: UpGuard Inc.
• Inventors: Baukes, Michael Franz, Sharp-Paul, Alan James
• Primary Examiner(s): Turchen, James R
• Application Number:
  US15/272,321
• Publication Number:
  US 20180084000A1
• Time in Patent Office: 797 Days
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

An internal network can include a plurality of linked internal nodes, each internal node being configured to communicate with other internal nodes or with one or more external servers over an external network. The internal network can analyze the configuration of the internal nodes and the network traffic between internal nodes of the internal network and external servers. Based on the analysis, a network vulnerability score measuring the vulnerability of the internal network to attack can be determined. If the vulnerability score is below a threshold, the internal network can be isolated from the external network, for example by preventing internal nodes from communicating with or over the external network.

Claims

1. A method comprising:

maintaining, in an internal network, a plurality of internal nodes, each node of the plurality of internal nodes comprising a corresponding node configuration;

receiving, at the internal network, network traffic from an outside network;

analyzing, by a node of the internal network, the node configuration of a first node of the internal network and the received network traffic;

calculating, in real-time and based on the analysis of the node configuration, a network vulnerability score, the network vulnerability score measuring the vulnerability of the network to malicious action;

determining if the network vulnerability score is below a vulnerability threshold;

responsive to determining that the network vulnerability score is below the vulnerability threshold, isolating the internal network from the outside network by instructing a DNS server of the internal network to prevent resolution of DNS requests from the outside network; and

after isolating the internal network;

reconfiguring the first node of the internal network;

simulating the received network traffic on the isolated network including the reconfigured first node;

calculating a simulated network vulnerability score based on the simulated received network traffic and measuring the expected vulnerability of the network to malicious action if the network were not isolated from the outside network; and

in response to the simulated network vulnerability score exceeding the vulnerability threshold, reversing the isolation of the internal network from the outside network.

2. The method of claim 1, wherein the first node is reconfigured based on the network vulnerability score.

3. The method of claim 2, wherein reconfiguring the first node comprises implementing one or more reconfiguration policies on the first node.

4. The method of claim 1, further comprising logging network traffic associated with the first node.

5. A non-transitory computer readable storage medium comprising instructions which when executed by a processor cause the processor to perform the steps of:

receiving, at an internal network comprising a plurality of internal nodes, each node of the plurality of internal nodes comprising a corresponding node configuration, network traffic from an outside network;

analyzing, by a node of the internal network, the node configuration of a first node of the internal network and the received network traffic;

calculating, in real time and based on the analysis of the node configuration, a network vulnerability score, the network vulnerability score measuring the vulnerability of the network to malicious action;

determining if the network vulnerability score is below a vulnerability threshold;

responsive to determining that the network vulnerability score is below the vulnerability threshold, isolating the internal network from the outside network by instructing a DNS server of the internal network to prevent resolution of DNS requests from the outside network; and

after isolating the internal network;

reconfiguring the first node of the internal network;

simulating the received network traffic on the isolated network including the reconfigured first node;

calculating a simulated network vulnerability score based on the simulated received network traffic and measuring the expected vulnerability of the network to malicious action if the network were not isolated from the outside network; and

in response to the simulated network vulnerability score exceeding the vulnerability threshold, reversing the isolation of the internal network from the outside network.

6. The non-transitory computer readable medium of claim 5, wherein the first node is reconfigured based on the network vulnerability score.

7. The non-transitory computer readable medium of claim 6, wherein reconfiguring the first node comprises implementing one or more reconfiguration policies on the first node.

8. The non-transitory computer readable medium of claim 5, wherein the processor is further caused to log network traffic associated with the first node.

9. A system comprising:

a plurality of internal nodes, each node of the plurality of internal nodes comprising a corresponding node configuration, the plurality of internal nodes connected in an internal network configured to receive network traffic from an outside network;

an operator node of the internal network, the operator node configured to;

analyze the node configuration of a first node of the internal network and the received network traffic;

calculate, in real time and based on the analysis of the node configuration, a network vulnerability score, the network vulnerability score measuring the vulnerability of the network to malicious action;

determine if the network vulnerability score is below a vulnerability threshold;

responsive to determining that the network vulnerability score is below the vulnerability threshold, isolate the internal network from the outside network by instructing a DNS server of the internal network to prevent resolution of DNS requests from the outside network; and

after isolating the internal network;

reconfiguring the first node of the internal network;

simulating the received network traffic on the isolated network including the reconfigured first node;

calculating a simulated network vulnerability score based on the simulated received network traffic and measuring the expected vulnerability of the network to malicious action if the network were not isolated from the outside network; and

in response to the simulated network vulnerability score exceeding the vulnerability threshold, reversing the isolation of the internal network from the outside network.

10. The system of claim 9, wherein the first node is reconfigured based on the network vulnerability score.

11. The system of claim 10, wherein reconfiguring the first node comprises implementing one or more reconfiguration policies on the first node.