Self-isolating and self-healing networked devices

• US 20050276228A1
• Filed: 06/09/2004
• Published: 12/15/2005
• Est. Priority Date: 06/09/2004
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Crouch, Alan, Durham, David M., Yavatkar, Raj
• Granted Patent: US 8,154,987 B2
• Time in Patent Office: Days
• US Class Current: 370/242
• CPC Class Codes: H04J 3/14 Monitoring arrangements for SDH/SONET rings H04J3/085
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/303 Terminal profiles
• CPC Class Codes: H04L 67/61 taking into account QoS or priority requirements
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

Techniques for self-isolation of a network device that has been identified as potentially harmful. The network device may be isolated from the network except for an out-of-band communication channel that can be used for management purposes to restore or repair the device prior to the network connection being re-established.

Claims

1. A method comprising:

monitoring a host electronic system to determine whether the host electronic system is operating within a predefined operating profile;

generating an indication of out-of-profile operation when the host electronic system is not operating within the predefined operating profile; and

taking action on one or more components within the host electronic system in response to the indication of out-of-profile operation.

2. The method of claim 1 wherein monitoring the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprises monitoring network traffic from the host electronic system to determine whether a quantity of network traffic is within a network traffic quantity profile as defined by the operating profile.

3. The method of claim 1 wherein monitoring the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprises monitoring network traffic from the host electronic system to determine whether a quantity of network traffic in a plurality of network traffic categories is within a network traffic quantity and traffic category profile as defined by the operating profile.

4. The method of claim 1 wherein monitoring the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprises monitoring network traffic from the host electronic system to determine whether one or more destinations of network traffic are within a network traffic destination profile as defined by the operating profile.

5. The method of claim 1 wherein taking action on the one or more components within the host electronic system in response to the indication of out-of-profile operation comprises disabling a network interface in response to the indication of out-of-profile operation.

6. The method of claim 5 wherein disabling the network interface comprises logically disabling the network interface by writing a pre-selected value to a control register corresponding to the network interface to be logically disabled using a configuration operation.

7. The method of claim 6 wherein writing a pre-selected value to a control register corresponding to the network interface to be logically disabled using a configuration operation comprises writing the pre-selected value to a Peripheral Component Interconnect (PCI) Command register corresponding to the network interface.

8. The method of claim 1 wherein taking action on the one or more components within the host electronic system in response to the indication of out-of-profile operation comprises disabling a device coupled with a host system bus in response to the indication of out-of-profile operation.

9. The method of claim 8 wherein disabling the device coupled with the host system bus comprises logically disabling the device by writing a pre-selected value to a control register corresponding to the device to be logically disabled using a configuration operation.

10. The method of claim 9 wherein writing a pre-selected value to a control register corresponding to the device to be logically disabled using a configuration operation comprises writing the pre-selected value to a Peripheral Component Interconnect (PCI) Command register corresponding to the device.

11. The method of claim 1 wherein taking action on the one or more components within the host electronic system in response to the indication of out-of-profile operation comprises throttling network traffic.

12. The method of claim 1 wherein taking action on the one or more components within the host electronic system in response to the indication of out-of-profile operation comprises redirecting network traffic.

13. The method of claim 1 wherein taking action on the one or more components within the host electronic system in response to the indication of out-of-profile operation comprises sending an alert corresponding to the indication to a network administration device.

14. The method of claim 1 wherein the host electronic system comprises a computer system.

15. The method of claim 1 wherein the host electronic system comprises a network router.

16. The method of claim 1 wherein monitoring the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprises searching files of the host electronic system for predetermined indications corresponding to one or more predefined risk parameters.

17. The method of claim 1 further comprising:

receiving an updated operating profile from a remote device;

monitoring the host electronic system to determine whether the host electronic system is operating within the updated operating profile; and

generating the indication of out-of-profile operation when the host electronic system is not operating within the updated operating profile.

18. The method of claim 17 wherein receiving the updated operating profile from the remote device comprises receiving programming instructions from the remote device.

19. The method of claim 17 wherein receiving the updated operating profile from the remote device comprises receiving configuration data from the remote device.

20. The method of claim 1 wherein monitoring the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprises scanning a dynamic memory of the host electronic system to determine the presence and integrity of pre-selected security software components.

21. The method of claim 1 wherein monitoring the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprises determining whether the host electronic system is coupled with a network that complies with the predefined operating profile.

22. The method of claim 1 wherein monitoring the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprises determining whether the host electronic system has been booted from unauthorized media.

23. The method of claim 1 wherein monitoring the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprises determining whether a Basic Input/Output System (BIOS) of the host electronic system complies with the predefined operating profile.

24. An article comprising a computer-readable medium having stored thereon instructions that, when executed, cause one or more processors to:

monitor a host electronic system to determine whether the host electronic system is operating within a predefined operating profile;

generate an indication of out-of-profile operation when the host electronic system is not operating within the predefined operating profile; and

take action on one or more components within the host electronic system in response to the indication of out-of-profile operation.

25. The article of claim 24 wherein the instructions that cause the one or more processors to monitor the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprise instructions that, when executed, cause the one or more processors to monitor network traffic from the host electronic system to determine whether a quantity of network traffic is within a network traffic quantity profile as defined by the operating profile.

26. The article of claim 24 wherein the instructions that cause the one or more processors to monitor the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprise instructions that, when executed, cause the one or more processors to monitor network traffic from the host electronic system to determine whether a quantity of network traffic in a plurality of network traffic categories is within a network traffic quantity and traffic category profile as defined by the operating profile.

27. The article of claim 24 wherein the instructions that cause the one or more processors to monitor the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprise instructions that when executed, cause the one or more processors to monitor network traffic from the host electronic system to determine whether one or more destinations of network traffic are within a network traffic destination profile as defined by the operating profile.

28. The article of claim 24 wherein the instructions that cause the one or more processors to disable one or more components within the host electronic system in response to the indication of out-of-profile operation comprise instructions that, when executed, cause the one or more processors to disable a network interface in response to the indication of out-of-profile operation.

29. The article of claim 28 wherein the instructions that cause the one or more processors to disable the network interface comprise instructions that, when executed, cause the one or more processors to logically disable the network interface by writing a pre-selected value to a control register corresponding to the network interface to be logically disabled using a configuration operation.

30. The article of claim 29 wherein the instructions that cause the one or more processors to write a pre-selected value to a control register corresponding to the network interface to be logically disabled using a configuration operation comprise instructions that, when executed, cause the one or more processors to write the pre-selected value to a Peripheral Component Interconnect (PCI) Command register corresponding to the network interface.

31. The article of claim 24 wherein the instructions that cause the one or more processors to disable one or more components within the host electronic system in response to the indication of out-of-profile operation comprise instructions that, when executed, cause the one or more processors to disable a device coupled with a host system bus in response to the indication of out-of-profile operation.

32. The article of claim 31 wherein the instructions that cause the one or more processors to disable the device coupled with the host system bus comprise instructions that, when executed, cause the one or more processors to logically disable the device by writing a pre-selected value to a control register corresponding to the device to be logically disabled using a configuration operation.

33. The article of claim 32 wherein the instructions that cause the one or more processors to write a pre-selected value to a control register corresponding to the device to be logically disabled using a configuration operation comprise instructions that, when executed, cause the one or more processors to write the pre-selected value to a Peripheral Component Interconnect (PCI) Command register corresponding to the device.

34. The article of claim 24 wherein the instructions that cause the one or more processors to take action on the one or more components within the host electronic system in response to the indication of out-of-profile operation comprise instructions that, when executed cause the one or more processors to throttle network traffic.

35. The article of claim 24 wherein the instructions that cause the one or more processors to take action on the one or more components within the host electronic system in response to the indication of out-of-profile operation comprise instructions that cause the one or more processors to redirect network traffic.

36. The article of claim 24 wherein the instructions that cause the one or more processors to take action on the one or more components within the host electronic system in response to the indication of out-of-profile operation comprise instructions that, when executed, cause the one or more processors to send an alert corresponding to the indication to a network administration device.

37. The article of claim 24 wherein the host electronic system comprises a computer system.

38. The article of claim 24 wherein the host electronic system comprises a network router.

39. The article of claim 24 wherein the instructions that cause the one or more processors to monitor the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprise instructions that, when executed, cause the one or more processors to search files of the host electronic system for predetermined indications corresponding to one or more predefined risk parameters.

40. The article of claim 24 further comprising instructions that, when executed, cause the one or more processors to:

receive an updated operating profile from a remote device;

monitor the host electronic system to determine whether the host electronic system is operating within the updated operating profile; and

generate the indication of out-of-profile operation when the host electronic system is not operating within the updated operating profile.

41. The article of claim 40 wherein the instructions that cause the one or more processors to receive the updated operating profile from the remote device comprise instructions that, when executed, cause the one or more processors to receive further instructions from the remote device.

42. The article of claim 40 wherein the instructions that cause the one or more processors to receive the updated operating profile from the remote device comprise instructions that, when executed, cause the one or more processors to receive configuration data from the remote device.

43. The article of claim 24 wherein the instructions that cause the one or more processors to monitor the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprise instructions that cause the one or more processors to scan a dynamic memory of the host electronic system to determine the presence and integrity of pre-selected security software components.

44. The article of claim 24 wherein the instructions that cause the one or more processors to monitor the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprise instructions that, when executed, cause the one or more processors to determine whether the host electronic system is coupled with a network that complies with the predefined operating profile.

45. The article of claim 24 wherein the instructions that cause the one or more processors to monitor the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprise instructions that, when executed, cause the one or more processors to determine whether the host electronic system has been booted from unauthorized media.

46. The article of claim 24 wherein the instructions that cause the one or more processors to monitor the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprise instructions that, when executed, cause the one or more processors to determine whether a Basic Input/Output System (BIOS) of the host electronic system complies with the predefined operating profile.

47. A system comprising:

dynamic random access memory (DRAM);

one or more processors coupled with the DRAM; and

a computer-readable medium having stored thereon instructions that, when executed, cause the one or more processors to monitor a host electronic system to determine whether the host electronic system is operating within a predefined operating profile, generate an indication of out-of-profile operation when the host electronic system is not operating within the predefined operating profile, and disable one or more components within the host electronic system in response to the indication of out-of-profile operation.

48. The system of claim 47 wherein the instructions that cause the one or more processors to monitor the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprise instructions that, when executed, cause the one or more processors to monitor network traffic from the host electronic system to determine whether a quantity of network traffic is within a network traffic quantity profile as defined by the operating profile.

49. The system of claim 47 wherein the instructions that cause the one or more processors to monitor the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprise instructions that, when executed, cause the one or more processors to monitor network traffic from the host electronic system to determine whether a quantity of network traffic in a plurality of network traffic categories is within a network traffic quantity and traffic category profile as defined by the operating profile.

50. The system of claim 47 wherein the instructions that cause the one or more processors to monitor the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprise instructions that when executed, cause the one or more processors to monitor network traffic from the host electronic system to determine whether one or more destinations of network traffic are within a network traffic destination profile as defined by the operating profile.

51. The system of claim 47 wherein the instructions that cause the one or more processors to disable one or more components within the host electronic system in response to the indication of out-of-profile operation comprise instructions that, when executed, cause the one or more processors to disable a network interface in response to the indication of out-of-profile operation.

52. The system of claim 47 wherein the instructions that cause the one or more processors to disable the network interface comprise instructions that, when executed, cause the one or more processors to logically disable the network interface by writing a pre-selected value to a control register corresponding to the network interface to be logically disabled using a configuration operation.

53. The system of claim 52 wherein the instructions that cause the one or more processors to write a pre-selected value to a control register corresponding to the network interface to be logically disabled using a configuration operation comprise instructions that, when executed, cause the one or more processors to write the pre-selected value to a Peripheral Component Interconnect (PCI) Command register corresponding to the network interface.

54. The system of claim 47 wherein the instructions that cause the one or more processors to disable one or more components within the host electronic system in response to the indication of out-of-profile operation comprise instructions that, when executed, cause the one or more processors to disable a device coupled with a host system bus in response to the indication of out-of-profile operation.

55. The system of claim 54 wherein the instructions that cause the one or more processors to disable the device coupled with the host system bus comprise instructions that, when executed, cause the one or more processors to logically disable the device by writing a pre-selected value to a control register corresponding to the device to be logically disabled using a configuration operation.

56. The system of claim 55 wherein the instructions that cause the one or more processors to write a pre-selected value to a control register corresponding to the device to be logically disabled using a configuration operation comprise instructions that, when executed, cause the one or more processors to write the pre-selected value to a Peripheral Component Interconnect (PCI) Command register corresponding to the device.

57. The system of claim 47 wherein the instructions that cause the one or more processors to monitor the host electronic system to determine whether the host electronic system is operating within the predefined operating profile comprise instructions that, when executed, cause the one or more processors to search files of the host electronic system for predetermined indications corresponding to one or more predefined risk parameters.

58. The system of claim 47, wherein the computer-readable medium further comprising instructions that, when executed, cause the one or more processors to receive an updated operating profile from a remote device, monitor the host electronic system to determine whether the host electronic system is operating within the updated operating profile, and generate the indication of out-of-profile operation when the host electronic system is not operating within the updated operating profile.