Network protection software and method

• US 20050138431A1
• Filed: 12/23/2004
• Published: 06/23/2005
• Est. Priority Date: 12/23/2003
• Status: Abandoned Application

• Current Assignee: Jay P. Harrison
• Original Assignee: Jay P. Harrison
• Inventors: Harrison, Jay P.
• Application Number:
  US11/021,621
• Publication Number:
  US 20050138431A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 61/50 Address allocation
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A software-based system allows immediate isolation of all IP traffic until a newly added machine has been qualified. In the preferred embodiment, this verification is carried out using a variety of mechanisms, optionally including a local agent, vulnerability scanning, and system fingerprinting. Any newly attached machine requesting an IP address is quarantined into a restricted address space until an authorization server validates that it is running a valid operating system at the appropriate patch levels, is not actively scanning or transmitting malicious data, has the proper virus software and engine, and is not vulnerable on known Trojan ports.

Claims

3-1. The method of claim 1, wherein the step of verifying that the machine meets certain criteria includes verifying that the machine is using a valid operating system at the appropriate patch levels.

6. A system for protecting a network against a newly added machine, comprising:

a Dynamic Host Configuration Protocol (DHCP) administrator operative to perform the following functions;

assign a temporary IP address to a machine added to a network;

verify that the machine meets certain criteria; and

, if it does, assign the machine a non-temporary IP address.

7. The system of claim 6, wherein the DHCP is operative to perform vulnerability scanning on the new machine.

8. The system of claim 6, wherein the DHCP is operative to fingerprint the new machine.

9. The system of claim 6, wherein the DHCP is operative to verify that the machine meets certain criteria includes verifying that the machine is using a valid operating system at the appropriate patch levels.

10. The system of claim 6, wherein all IP traffic is isolated until the machine is verified.

11. The system of claim 6, further including a local agent.