Dynamic device isolation in a network
First Claim
1. A method comprising:
- inserting, by a device in a network, a profile tag into an address request sent by an endpoint node in the network to a lookup service, wherein the lookup service is configured to identify one or more addresses with which the endpoint node is authorized to communicate based on a profile for the endpoint node associated with the inserted profile tag, wherein the profile is indicative of one or more services the endpoint node is expected to communicate with;
receiving, by the device, an address response sent from the lookup service to the endpoint node that indicates the set of one or more addresses with which the endpoint node is authorized to communicate, wherein the one or more addresses are associated with the one or more services;
determining, by the device, whether a communication between the endpoint node and a particular network address is authorized using the set of one or more addresses with which the endpoint node is authorized to communicate;
blocking, by the device, the communication based on a determination that the particular network address is not in the set of one or more addresses with which the endpoint node is authorized to communicate;
determining, by the device, whether a second communication between the endpoint node and a second particular network address is authorized using the set of one or more addresses with which the endpoint node is authorized to communicate; and
sending, by the device, the second communication to the endpoint node or the second particular network address based on a determination that the second particular network address is in the set of one or more addresses with which the endpoint node is authorized to communicate.
1 Assignment
0 Petitions
Accused Products
Abstract
In one embodiment, a device in a network inserts a profile tag into an address request sent by an endpoint node in the network to a lookup service. The lookup service is configured to identify one or more addresses with which the endpoint node is authorized to communicate based on a profile for the endpoint node associated with the inserted profile tag. The device receives an address response sent from the lookup service to the endpoint node that indicates the set of one or more addresses with which the endpoint node is authorized to communicate. The device determines whether a communication between the endpoint node and a particular network address is authorized using the set of one or more addresses with which the endpoint node is authorized to communicate. The device blocks the communication based on a determination that the particular network address is not in the set of one or more addresses with which the endpoint node is authorized to communicate.
17 Citations
18 Claims
-
1. A method comprising:
-
inserting, by a device in a network, a profile tag into an address request sent by an endpoint node in the network to a lookup service, wherein the lookup service is configured to identify one or more addresses with which the endpoint node is authorized to communicate based on a profile for the endpoint node associated with the inserted profile tag, wherein the profile is indicative of one or more services the endpoint node is expected to communicate with; receiving, by the device, an address response sent from the lookup service to the endpoint node that indicates the set of one or more addresses with which the endpoint node is authorized to communicate, wherein the one or more addresses are associated with the one or more services; determining, by the device, whether a communication between the endpoint node and a particular network address is authorized using the set of one or more addresses with which the endpoint node is authorized to communicate; blocking, by the device, the communication based on a determination that the particular network address is not in the set of one or more addresses with which the endpoint node is authorized to communicate; determining, by the device, whether a second communication between the endpoint node and a second particular network address is authorized using the set of one or more addresses with which the endpoint node is authorized to communicate; and sending, by the device, the second communication to the endpoint node or the second particular network address based on a determination that the second particular network address is in the set of one or more addresses with which the endpoint node is authorized to communicate. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. A method comprising:
-
receiving, at a lookup service device in a network, an address request from an endpoint node in the network, wherein the address request includes profile tag for the endpoint node inserted into the address request by a networking device in the network; retrieving, by the lookup service device, a profile for the endpoint node associated with the inserted profile tag, wherein the profile is indicative of services the endpoint node is expected to communicate with; identifying, by the lookup service device, one or more addresses with which the endpoint node is authorized to communicate based on the profile for the endpoint node, wherein the one or more addresses are associated with the services; and sending, by the lookup service device, the one or more addresses with which the endpoint node is authorized to communicate to the networking device, wherein the networking device La blocks communications between the endpoint node and addresses that are not in the one or more addresses with which the endpoint node is authorized to communicate and (b) sends communications between the endpoint node and addresses that are in the one or more addresses with which the endpoint node is authorized to communicate. - View Dependent Claims (8, 9, 10, 11)
-
-
12. An apparatus, comprising:
-
one or more network interfaces to communicate with a network; a processor coupled to the network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed operable to; insert a profile tag into an address request sent by an endpoint node in the network to a lookup service, wherein the lookup service is configured to identify one or more addresses with which the endpoint node is authorized to communicate based on a profile for the endpoint node associated with the inserted profile tag, wherein the profile is indicative of one or more services the endpoint node is expected to communicate with; receive an address response sent from the lookup service to the endpoint node that indicates the set of one or more addresses with which the endpoint node is authorized to communicate, wherein the one or more addresses are associated with the one or more services; determine whether a communication between the endpoint node and a particular network address is authorized using the set of one or more addresses with which the endpoint node is authorized to communicate; block the communication based on a determination that the particular network address is not in the set of one or more addresses with which the endpoint node is authorized to communicate; determine whether a second communication between the endpoint node and a second particular network address is authorized using the set of one or more addresses with which the endpoint node is authorized to communicate; and send the second communication to the endpoint node or the second particular network address based on a determination that the second particular network address is in the set of one or more addresses with which the endpoint node is authorized to communicate. - View Dependent Claims (13, 14, 15, 16, 17, 18)
-
Specification