Method, apparatus, signals and medium for enforcing compliance with a policy on a client computer

• US 20070250627A1
• Filed: 04/21/2006
• Published: 10/25/2007
• Est. Priority Date: 04/21/2006
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Wang, Wei, Huang, Tao, May, Robert
• Granted Patent: US 8,935,416 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06F 15/16 Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs coordinating program control therefor G06F9/52; in regulating and control system G05B
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2212/502 using adaptive policy
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method and system for enforcing compliance with a policy on a client computer in communication with a network is disclosed. The method involves receiving a data transmission from the client computer on the network. The data transmission includes status information associated with the client computer. The data transmission is permitted to continue when the status information meets a criterion.

Claims

1. A method for enforcing compliance with a policy on a client computer in communication with a network, the method comprising:

receiving a data transmission from the client computer on the network, said data transmission including status information associated with the client computer;

permitting said data transmission to continue when said status information meets a criterion.

2. The method of claim 1 further comprising preventing said data transmission from continuing when said data transmission does not include status information.

3. The method of claim 1 wherein permitting said data transmission to continue further comprises authenticating a user of the client computer before permitting said data transmission to continue.

4. The method of claim 1 further comprising causing an action to be taken when said status information does not meet said criterion.

5. The method of claim 4 wherein causing said action to be taken comprises causing an entry to be made in a log.

6. The method of claim 4 wherein causing said action to be taken comprises causing an alert to be issued.

7. The method of claim 6 wherein causing said alert to be issued comprises sending a message to an administrator of the network.

8. The method of claim 4 wherein causing said action to be taken comprises preventing said data transmission from continuing.

9. The method of claim 4 further comprising sending a message to the client computer indicating at least one of:

said data transmission has been prevented from continuing;

aspects of said criterion that are not met by said status information; and

a network resource location for downloading data for updating a configuration of the client computer.

10. The method of claim 9 wherein sending said message indicating said network resource location comprises sending a message indicating at least one of:

a location of a client security program image for installing client security program on the client computer;

a location of a file for updating anti-virus signatures associated with potential computer virus attacks; and

a location of a file for updating intrusion protection system (IPS) signatures associated with potential network intrusions.

11. The method of claim 9 wherein sending said message indicating aspects of said criterion that are not met by said status information comprises producing a message indicating at least one of:

a software license associated with client security program installed on the client computer is not valid; and

a configuration associated with said client security program fails to meet said criterion.

12. The method of claim 9 wherein said data transmission complies with a Hyper Text Transfer Protocol (HTTP) and wherein sending said message comprises sending a HTTP redirect response to the client computer redirecting the client computer to a web page.

13. The method of claim 12 wherein redirecting comprises redirecting the client computer to a web page comprising at least one link to a network resource location for downloading data for updating a configuration of the client computer.

14. The method of claim 1 wherein receiving said data transmission comprises receiving a data transmission from the client computer including data complying with one of a hyper text transfer protocol (HTTP), a simple mail transport protocol (SMTP), an internet message access protocol (IMAP), a post office protocol (POP), a telnet protocol, a domain name system (DNS) protocol, a voice over internet protocol (VoIP), a peer-to-peer (P2P) protocol, a dynamic host configuration protocol (DHCP), and a point-to-point (PPP) protocol.

15. The method of claim 1 wherein permitting said data transmission to continue comprises permitting said data transmission to continue when said status information meets a criterion set by an administrator of the network.

16. The method of claim 1 wherein permitting said data transmission to continue when said status information meets said criterion further comprises permitting subsequent data transmissions to continue until at least one of:

a first period of time expires; and

the client computer has not initiated any subsequent data transmissions for a second period of time.

17. The method of claim 1 wherein the network includes a first network and further comprising receiving said data transmission at a gateway node on said first network, said gateway node being in communication with a second network, and wherein permitting said data transmission to continue comprises permitting said data transmission to said second network when said status information meets said criterion.

18. The method of claim 17 wherein permitting said data transmission to continue comprises reading said status information and comparing at least some of said status information against at least one criterion in a table of criteria stored on said gateway node and permitting said data transmission to said second network when said at least some of said status information satisfies said at least one criterion.

19. The method of claim 1 wherein permitting said data transmission to continue when said status information meets said criterion further comprises generating a temporary policy for the client computer, said temporary policy including information identifying the client computer and wherein subsequent data transmissions from the client computer are permitted to continue without reading status information included in said subsequent data transmissions, while said temporary policy exists.

20. The method of claim 19 further comprising causing said temporary policy to expire when at least one of:

a first period of time expires; and

when the client computer has not initiated any subsequent data transmissions for a second period of time.

21. The method of claim 17 further comprising storing a client security program installation image on said gateway node, said installation image comprising codes for installing a client security program on the client computer.

22. A computer readable medium encoded with codes for directing a processor circuit to:

receive a data transmission from a client computer, said data transmission including status information associated with said client computer;

permit said data transmission to continue when said status information meets a criterion.

23. The computer readable medium of claim 22 wherein said codes are encoded on one of a Compact Disk Read-only Memory (CD ROM) and a computer readable signal.

24. An apparatus for enforcing compliance with a policy on a client computer in communication with a network, the apparatus comprising:

means for receiving a data transmission from the client computer, said data transmission including status information associated with the client computer;

means for permitting said data transmission to continue when said status information meets a criterion.

25. A method implemented on a client computer for enforcing compliance with a policy, the method comprising:

causing a data transmission from the client computer on a first network to include status information associated with said client computer, said data transmission being destined for a second network, said status information for permitting said data transmission to continue on said second network when said status information meets a criterion, said second network being in communication with said first network.

26. The method of claim 25 further comprising performing a status enquiry on the client computer to determine said status information associated with the client computer.

27. The method of claim 26 wherein performing said status enquiry comprises determining at least one of:

whether a client security program is running on the client computer;

version information associated with said client security program installed on the client computer;

license information associated with said client security program installed on the client computer;

configuration information associated with said client security program installed on the client computer;

version information associated with an anti-virus signature database stored on the client computer;

version information associated with an intrusion protection system (IPS) signature database stored on the client computer;

firewall zone configuration information associated with the client computer; and

information associated with other software installed on the client computer.

28. The method of claim 27 wherein determining said configuration information comprises reading configuration data from a configuration file associated with said client security program installed on the client computer and further comprising generating a hash of said configuration data, said hash being included in said status information.

29. The method of claim 25 wherein causing said data transmission to include status information comprises causing said data transmission to include a data record comprising an identifier field identifying the client computer and at least one field including status information associated with said client computer.

30. The method of claim 29 wherein causing said data transmission to include said data record further comprises causing said data transmission to include a data record comprising at least one of:

a length field for holding length information identifying a length of said data record; and

a checksum field for holding checksum information associated with said data record.

31. The method of claim 29 wherein causing said data transmission to include said data record comprises causing said data transmission to include a binary coded data record.

32. The method of claim 31 wherein causing said data transmission to include a binary coded data record comprises causing said data transmission to include a data record comprising American Standard Code for Information Interchange (ASCII) characters representing said binary coded data record.

33. The method of claim 29 further comprising encrypting said data record.

34. The method of claim 25 wherein causing said data transmission to include status information comprises monitoring programs running on the client computer and intercepting data transmissions initiated by said programs and including in said data transmissions at least one data record including status information associated with the client computer.

35. A computer readable medium encoded with codes for directing a processor circuit to:

cause a data transmission from a client computer on a first network to include status information associated with said client computer, said data transmission being destined for a second network, said status information for permitting said data transmission to continue on said second network when said status information meets a criterion, said second network being in communication with said first network.

36. The computer readable medium of claim 35 wherein said codes are encoded on one of a Compact Disk Read-only Memory (CD ROM) and a computer readable signal.

37. A gateway node apparatus for enforcing a policy on a client computer, the gateway node apparatus and the client computer being in communication with a first network, the gateway node apparatus comprising:

an interface operable to receive a data transmission from the client computer, said data transmission including status information associated with the client computer;

a processor circuit; and

at least one computer readable medium encoded with codes for directing said processor circuit to permit said data transmission to continue when said status information meets a criterion.

38. The apparatus of claim 37 wherein said computer readable medium further comprises codes for directing the processor circuit to prevent said data transmission from continuing when said data transmission does not include status information.

39. The apparatus of claim 37 wherein said computer readable medium further comprises codes for directing the processor circuit to authenticate a user of the client computer before permitting said data transmission to continue.

40. The apparatus of claim 37 wherein said computer readable medium further comprises codes for directing the processor circuit to cause an action to be taken when said status information does not meet said criterion.

41. The apparatus of claim 40 wherein said computer readable medium further comprises codes for directing the processor circuit to cause an entry to be made in a log.

42. The apparatus of claim 40 wherein said computer readable medium further comprises codes for directing the processor circuit to cause an alert to be issued.

43. The apparatus of claim 42 wherein said alert comprises a message sent to an administrator of the network.

44. The apparatus of claim 40 wherein said computer readable medium further comprises codes for directing the processor circuit to prevent said data transmission from continuing.

45. The apparatus of claim 40 wherein said computer readable medium further comprises codes for directing the processor circuit to send a message to the client computer indicating at least one of:

said data transmission has been prevented from continuing;

aspects of said criterion that are not met by said status information; and

a network resource location for downloading data for updating a configuration of the client computer.

46. The apparatus of claim 45 wherein said message indicating said network resource location comprises information indicating at least one of:

a location of a client security program image for installing a client security program on said client computer;

a location of a file for updating anti-virus signatures associated with potential computer virus attacks; and

a location of a file for updating intrusion protection system (IPS) signatures associated with potential network intrusions.

47. The apparatus of claim 45 wherein said message indicating aspects of said criterion that are not met by said status information comprises information indicating at least one of:

a software license associated with said client security program installed on the client computer is not valid; and

a configuration associated with said client security program fails to meet said criterion.

48. The apparatus of claim 45 wherein said data transmission complies with a Hyper Text Transfer Protocol (HTTP) and wherein said message comprises a HTTP redirect response sent to the client computer redirecting the client computer to a web page.

49. The apparatus of claim 48 wherein said web page comprises at least one link to a network resource location for downloading data for updating a configuration of the client computer.

50. The apparatus of claim 37 wherein said data transmission comprises data complying with one of a hyper text transfer protocol (HTTP), a simple mail transport protocol (SMTP), an internet message access protocol (IMAP), a post office protocol (POP), a telnet protocol, a domain name system (DNS) protocol, a voice over internet protocol (VoIP), a peer-to-peer (P2P) protocol, a dynamic host configuration protocol (DHCP), and a point-to-point (PPP) protocol.

51. The apparatus of claim 37 wherein said criterion comprises at least one criterion set by an administrator of the network.

52. The apparatus of claim 37 wherein the network comprises a first network, said apparatus further comprising a second interface in communication with a second network, said data transmission comprising a data transmission destined for said second network, said computer readable medium further comprising codes for directing the processor circuit to permit said data transmission to said second network when said status information meets said criterion.

53. The apparatus of claim 52 further comprising a table of criteria stored in a memory on said apparatus and wherein said computer readable medium further comprises codes for directing the processor circuit to read said status information and compare at least some of said status information with at least one criterion in said table of criteria and to permit said data transmission to said second network when said at least some of said status information satisfies said at least one criterion.

54. The apparatus of claim 52 wherein said computer readable medium further comprises codes for directing the processor circuit to generate a temporary policy for the client computer, said temporary policy including information identifying the client computer and wherein subsequent data transmissions from the client computer are permitted to continue without reading status information included in said subsequent data transmissions, while said temporary policy exists.

55. The apparatus of claim 54 wherein said temporary policy further comprises time information, said time information facilitating a determination of a period of time since said temporary policy was created.

56. The apparatus of claim 54 wherein said computer readable medium further comprises codes for directing the processor circuit to cause said temporary policy to expire when at least one of:

a first period of time expires; and

when the client computer has not initiated any subsequent data transmissions for a second period of time.

57. The apparatus of claim 52 further comprising a client security program installation image stored in memory on said apparatus, said installation image comprising codes for installing a client security program on the client computer.

58. A client computer apparatus for enforcing compliance with a policy, the apparatus comprising:

a processor circuit;

an interface operably configured to permit the client computer to communicate with a first network;

a computer readable medium encoded with codes for directing the processor circuit to cause a data transmission from the client computer on the first network to include status information associated with said client computer, said data transmission being destined for a second network, said status information for permitting said data transmission to continue on said second network when said status information meets a criterion, said second network being in communication with said first network.

59. The apparatus of claim 58 wherein said computer readable medium further comprises codes for directing the processor circuit to perform a status enquiry on the client computer to determine said status information associated with the client computer.

60. The apparatus of claim 59 wherein said status information comprises at least one of:

an indication of whether a client security program is running on the client computer;

version information associated with said client security program installed on the client computer;

license information associated with said client security program installed on the client computer;

configuration information associated with said client security program installed on the client computer;

version information associated with an anti-virus signature database stored on the client computer;

version information associated with an intrusion protection system (IPS) signature database stored on the client computer;

firewall zone configuration information associated with the client computer; and

information associated with other software installed on the client computer.

61. The apparatus of claim 60 wherein said configuration information associated with said client security program comprises information stored in a configuration file, said computer readable medium further comprising codes for directing the processor circuit to read configuration data from said configuration file and to generate a hash of said configuration data, said hash being included in said status information.

62. The apparatus of claim 58 wherein said status information comprises a data record comprising an identifier field identifying the client computer and at least one field including status information associated with said client computer.

63. The apparatus of claim 62 wherein said data record further comprises at least one of:

a length field for holding length information identifying a length of said data record; and

a checksum field for holding checksum information associated with said data record.

64. The apparatus of claim 62 wherein said data record comprises a binary coded data record.

65. The apparatus of claim 64 wherein said binary coded data record comprises a base64 binary coded data record.

66. The apparatus of claim 62 wherein said data record comprises an encrypted data record.

67. The apparatus of claim 58 wherein said computer readable medium further comprises codes for directing the processor circuit to intercept a data transmission initiated by a program running on the client computer and to insert in the data transmission, at least one data record including status information associated with the client computer.

68. A system for enforcing compliance with a policy, the system comprising:

a client computer in communication with a first network, said client computer comprising;

a first processor circuit;

an interface operably configured to permit said client computer to communicate with said first network;

a computer readable medium encoded with codes for directing the first processor circuit to cause a data transmission from said client computer on said first network to include status information associated with said client computer, said data transmission being destined for a second network;

a gateway node in communication with said first network and said second network, said gateway node comprising;

an interface operable to receive said data transmission from said client computer on said first network;

a second processor circuit; and

at least one computer readable medium encoded with codes for directing said second processor circuit to permit said data transmission to continue on said second network when said status information meets a criterion.