System and methods for providing network quarantine using IPsec

• US 20060085850A1
• Filed: 02/14/2005
• Published: 04/20/2006
• Est. Priority Date: 10/14/2004
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Swander, Brian D., Johansson, Jesper M., Mayfield, Paul G., Murthy, Karthik N., Black, Christopher J.
• Application Number:
  US11/056,276
• Publication Number:
  US 20060085850A1
• Time in Patent Office: Days
• US Class Current: 726/14
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system and method for ensuring that machines having invalid or corrupt states are restricted from accessing host resources are provided. A quarantine agent (QA) located on a client machine acquires statements of health from a plurality of quarantine policy clients. The QA packages the statements and provides the package to a quarantine enforcement client (QEC). The QEC sends the package to a quarantine Health Certificate Server (HCS) with a request for a health certificate. If the client provided valid statements of health, the HCS grants the client health certificate that may be used in IPsec session negotiation.

Claims

1. A method for a host to provide selective network isolation in a network using IP Security Protocol (IPsec), comprising:

receiving a Internet Key Exchange (IKE) packet including a client health certificate from a client;

validating the client health certificate;

sending to the client a host health certificate if the client health certificate is valid; and

denying the client access to the host if the client health certificate is invalid.

2. The method of claim 1, wherein a health certificate indicates that an owner of the certificate conforms to the security policies of the network.

3. The method of claim 1, further comprising communicating with the client through IPsec communication if the client health certificate is valid.

4. The method of claim 1, wherein the health certificate is an X509 certificate.

5. The method of claim 1, wherein the health certificate is a Kerberos ticket.

6. The method of claim 1, wherein the health certificate is a WS-Security token.

7. A computer-readable medium having stored thereon computer-executable instructions for performing the method of claim 1.

8. A method for a host to acquire a health certificate, comprising:

sending at least one statement of health to a health certificate server;

receiving at least one statement of health response from a health certificate server; and

if the at least one statement of health is validated by the health certificate server, receiving a health certificate and configuring the host to implement an IPsec policy that requires a client health certificate from a client before granting the client access to the host.

9. The method of claim 8, wherein if the at least one statement of health is not validated, the at least one statement of health response indicates the host does not conform to network security policies.

10. The method of claim 8, wherein the health certificate is an X509 certificate.

11. The method of claim 8, wherein the health certificate is a Kerberos ticket.

12. The method of claim 8, wherein the health certificate is a WS-Security token.

13. A computer-readable medium having stored thereon computer-executable instructions for performing the method of claim 8.

14. A computer network implementing a network isolation model, comprising:

a first group of computers wherein each computer possesses a health certificate and communicates only with computers that also possess a valid health certificate;

a second group of computers wherein each computer possesses a health certificate and communicates with all other computers in the network; and

a third group of computers wherein each computer does not possess a health certificate and communicates with all other computers in the network.

15. The network of claim 14, wherein communication among computers in the first group and between computers of the first group and computers of the second group is accomplished using IPsec.

16. The network of claim 14, the health certificate is an X509 certificate.

17. The network of claim 14, wherein the health certificate is a Kerberos ticket.

18. The network of claim 14, wherein the health certificate is a WS-Security token.

19. The network of claim 14, wherein the health certificate indicates that an owner of the certificate conforms to established security policies of the network.

20. The network of claim 14, wherein computers in the first group can initiate communication with computers in the third group but computers in the third group cannot initiate communication with computers in the first group.