Network management and administration

• US 20060248186A1
• Filed: 04/25/2006
• Published: 11/02/2006
• Est. Priority Date: 04/27/2005
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Smith, Richard James
• Granted Patent: US 8,161,558 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Method and arrangements are provided for use in managing a network having one more user computing entities and one or more administrative computing entities. One method includes monitoring network traffic from a user computing entity; detecting a client request sent from the user computing entity, and scanning the user computing entity for vulnerabilities.

Claims

1. A method of managing a network having one more user computing entities and one or more administrative computing entities, the method comprising:

monitoring, at the administrative computing entity, network traffic from a user computing entity;

detecting a client request, sent from the user computing entity, and addressed to a third party computing entity; and

upon detection of the client request, scanning the user computing entity for vulnerabilities.

5. A method according to claim 1 wherein the further computing entity is a transparent proxy.

6. A method according to claim 1, further comprising:

on detection of the client request from the user computing entity, determining, on the basis of a policy, whether to scan the user computing entity.

7. A method according to claim 6 wherein scanning the user computing entity is performed to establish vulnerabilities to attach via one or more specified protocols.

8. A method according to claim 7 wherein scanning of the user computing entity is performed to establish vulnerability to the one or more protocols at different levels in a hierarchy.

9. A method according to claim 1 further comprising:

upon detection of a client request, blocking traffic between the user computing entity and the third party computing entity.

10. A method according to claim 1, further comprising:

upon detection of a client request, performing a scan by injecting code adapted to scan the user computing entity into traffic transmitted to the user computing entity from the third party computer entity.

2. A method according to claim 2, wherein the administrative entity monitors traffic remotely, via a further computing entity.

3. A method according to claim 2 wherein the further computing entity is a router.

4. A method according to claim 3 wherein the router relays traffic to the administrative computing entity.

11. An administrative computer entity connected to a user computing entity, and being adapted to:

monitor, at the administrative computing entity, network traffic from the user computing entity;

detect a client request, sent from the user computing entity, and addressed to a third party computing entity; and

upon detection of the client request, scan the client computing entity for vulnerabilities.

12. An administrative computer entity according to claim 11 further adapted to implement a policy which determines, upon detection of the client request, whether the user computing entity is scanned.

13. An administrative computer entity according to claim 12, wherein the policy provides that the scan takes place if the user computing entity has not been scanned since an occurrence of a specified event.

14. An administrative computer entity according to claim 13, wherein the specified event includes a passing of a predetermined interval of time since a previous scan.

15. An administrative entity according to claim 13 wherein the specified event includes a performance of a scan to remedy a specified vulnerability.

16. An administrative entity according to claim 11 adapted, upon detection of the client request, to block traffic between the user computing entity and the third party computing entity.

17. An administrative entity according to claim 11 adapted, upon detection of the client request, to inject code for scanning the user computing entity into traffic passing from the third party computer to the user computing entity.