Method and apparatus for monitoring computer network security enforcement

• US 20060010492A9
• Filed: 06/10/2002
• Published: 01/12/2006
• Est. Priority Date: 07/30/2001
• Status: Active Grant

• Current Assignee: Channel IP BV
• Original Assignee: Axcelerant, Inc. (Pareteum Corp.)
• Inventors: Heintz, Robert Gordon, Christy, Jeffrey A.
• Granted Patent: US 8,001,594 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Methods and systems are disclosed for monitoring activity of a user on a network component, such as an end user computer, in a virtual private network for adherence to a security enforcement provision or policy utilized in the virtual private network. A method of determining whether a security provision in a computer network has been violated is described. It is determined whether the network component has violated, modified or circumvented a security enforcement provision of the computer network. If the detection is affirmative, the network component, such as an end user system, is modified in a manner in which the computer network operates at a level appropriate to the degree of the violation, modification, or circumvention of the security enforcement provision. If instructed to do so, a third party operating the virtual private network is notified of the violation and access to the network by the network component is restricted or terminated. A security enforcement distributed system consists of an agent module on the end user computer and a collector module for receiving data from the agent on a security server computer coupled to a data repository. Also on the security serer are a policy inspector for checking compliance with a security provision and a notifier and access control module for informing the network operator of a violation and restricting access by the end user system to the security server.

Claims

1. A method of monitoring abidance of a network component by a security enforcement provision utilized in a computer network, the method comprising:

detecting whether the network component has one of violated, modified or circumvented the security enforcement provision of the computer network; and

if the detection is positive, acting on the network component in a manner in which the computer network operates at a level appropriate to the degree of the violation, modification, or circumvention of the security enforcement provision.

2. A method of monitoring abidance of a network component by a security enforcement provision utilized in a computer network, the method comprising:

detecting whether the network component has one of violated, modified or circumvented the security enforcement provision of the computer network;

detecting whether an enforcement provision monitoring module has been one of violated, modified or circumvented; and

if either detection is positive, acting on the network component in a manner in which the computer network operates at a level appropriate to the degree of the violation, modification, or circumvention of the security enforcement provision.

3. A method as recited in claim 2 further comprising storing security enforcement data within the enforcement provision monitoring module whereby operating system and related files of the network component do not contain security enforcement related data.

4. A method as recited in claim 2 further comprising relegating the enforcement provision monitoring module to a background process on the network component.

5. A method as recited in claim 2 further comprising initializing a secure connection between the enforcement provision monitoring module and a security server computer over a public network.

6. A method as recited in claim 5 further comprising closing the secure connection after a profile record has been transmitted.

7. A method as recited in claim 5 further comprising invoking a collector module on the security server computer to collect data from the enforcement provision monitoring module.

8. A method as recited in claim 5 further comprising instructing the enforcement provision monitoring module when to send a next profile record to the security server computer.

9. A method of monitoring abidance of a network component by a security enforcement provision utilized in a computer network, the method comprising:

detecting whether the network component has one of violated, modified or circumvented the security enforcement provision of the computer network by comparing a profile record of the network component to a rule set defining a security policy;

detecting whether an enforcement provision monitoring module on the network component has been one of violated, modified or circumvented;

if either detection is positive, acting on the network component in a manner in which the network operates at a level appropriate to the degree of the violation, modification, or circumvention of the security enforcement provision; and

notifying an operator of the computer network of the positive detection.

10. A method as recited in claim 9 further comprising:

receiving from the network component the profile record at a security data repository under control of a security monitoring service provider;

validating a user associated with the network component;

checking for a class rule set associated with the network component; and

generating a host identifier transmitted to the network component.

11. A method as recited in claim 9 further comprising:

determining whether the enforcement provision monitoring module has been executing continually since boot up of the network component;

retrieving one or more rule sets corresponding to the profile record; and

applying the one or more rule sets to the profile record.

12. A method as recited in claim 9 further comprising detecting whether a network perimeter security device has been violated, modified, or circumvented.

13. A method as recited in claim 12 wherein the network perimeter security device is a managed service unit or a software firewall.

14. A method of monitoring abidance of a network component by a security enforcement provision utilized in a computer network, the method comprising:

gathering network component data related to the network component and storing the data in a profile record;

detecting whether the network component has one of violated, modified or circumvented the security enforcement provision of the network by comparing the profile record to a rule set defining a security policy;

detecting whether an enforcement provision monitoring module has been one of violated, modified or circumvented;

if either detection is positive, acting on the component in a manner in which the network operates at a level appropriate to the degree of the violation, modification, or circumvention of the security enforcement provision; and

notifying an operator of the network of the positive detection.

15. A system for monitoring abidance by a network security provision present in a network, the system comprising:

an agent module residing on an end user system;

a security server containing a plurality of components for collecting and inspecting data;

a security database containing end user system data and security rule data, wherein the security server and the security database are in communication; and

a notification module on the security server capable of notifying a third party of a security violation.

16. A system for monitoring abidance by a network security provision present in a network, the system comprising:

an agent module residing on an end user system;

a security server containing a plurality of components for collecting and inspecting data;

a security database containing end user system data and security rule data, wherein the security server and the security database are in communication; and

a virtual private network through which data is transmitted between the end user system and the security server.

17. A system for monitoring security activity in a computer network comprising:

an agent module having a data collection component and a server session control component;

a collector module having a session control listener and a preprocessor;

a policy inspector having a host information validation module and a new user set up module;

a notifier module having an exception log processor; and

an access control module for processing access control requests.