API TRANSLATION FOR NETWORK ACCESS CONTROL (NAC) AGENT

• US 20090158302A1
• Filed: 12/13/2007
• Published: 06/18/2009
• Est. Priority Date: 12/13/2007
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: Fiberlink Communications Corporation (International Business Machines Corporation)
• Inventors: Nicodemus, Blair, Herchek, Thomas
• Application Number:
  US11/955,995
• Publication Number:
  US 20090158302A1
• Time in Patent Office: Days
• US Class Current: 719/328
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

An application programming interface (API) translation agent and method for converting a message from one application configured according to a first API to a message configured according to a second API so that the first application, which is configured to communicate only in accordance with the first API, can communicate with a second application, which is configured to communicate only in accordance with the second API. The first and second applications can include a security application and a network access control (NAC) agent installed on an end point computing device, and the API translation agent can be used by the NAC agent to obtain information regarding a security status of the end point computing device, the information being used to determine whether the end point computing device is in compliance with the security policies of a network.

Claims

1. A method for providing information regarding a first software application configured in accordance with a first application programming interface (API) to a second software application configured in accordance with a second application programming interface (API), comprising:

receiving a first message from said first software application in a first application interface emulator module, said first message being configured in accordance with said first API;

receiving said first message in a translation and routing module;

registering said first software application for communication with said second software application in accordance with said second software application;

converting said first message into a second message in accordance with said second API;

receiving said second message in a second application interface module, said second message being configured in accordance with said second API; and

receiving said second message in said second software application to effect communication from said first software application to said second software application.

2. The method according to claim 1, wherein each of said first software application, said emulator module, said translation and routing module, said interface module, and said second software application resides on an end point computing device.

3. The method according to claim 2, wherein said first message provides information regarding a security posture of said end point computing device, said information being used to determine whether said end point computing device is in compliance with a security policy of a network.

4. The method according to claim 3, wherein said second software application comprises a network access control agent configured to control access of said end point computing device to said network, said network access control agent further being configured to communicate only in accordance with said second API.

5. The method according to claim 2, wherein said first software application comprises a firewall application and said first message includes information regarding a status of firewall residing on said end point computing device.

6. The method according to claim 2, wherein said first software application comprises an antivirus application and said first message includes information regarding a status of said antivirus application.

7. The method according to claim 2, wherein said first software application comprises an application required by a policy of a computer network to be present on said end point computing device, said policy of said computer network further requiring a predetermined state of said first application, and said first message includes information used in determining a compliance of said end point computing device with said policy.

8. The method according to claim 1, further comprising initializing said first application interface emulator module, said translation and routing module, and said second application interface module upon start-up of said end point computing device.

9. A method for facilitating communication between a first application configured according to a first application programming interface (API) and a second application configured according to a second application programming interface (API), comprising:

receiving a first message from said first application in a first module operatively connected to said first application, said first message being configured in accordance with said first API;

receiving said first message in a second module, said second module converting said first message into a second message, said second message being configured in accordance with said second API, said second module registering said first application to said second application in accordance with a protocol of said second application;

receiving said second message in a third module operatively connected to said second application; and

receiving said second message in said second application to effect communication between said first application and said second application.

10. The method according to claim 9, wherein said second application comprises a network access control agent configured to control access of an end point computing device to a network, said network access control agent further being configured to communicate only in accordance with said second API.

11. The method according to claim 9, wherein said first application comprises a firewall application and said first message includes information regarding a status of a firewall residing on said computing device.

12. The method according to claim 9, wherein said first application comprises an antivirus application and said first message includes information regarding a status of said antivirus application.

13. The method according to claim 9, wherein said first application comprises an application required by a policy of a computer network to be present on said end point computing device, said policy of said computer network further requiring a predetermined state of said first application, and said first message includes information used in determining a compliance of said end point computing device with said policy.

14. A method for facilitating the collection of information regarding a first application by a second application, said first application being configured to communicate in accordance with a first application programming interface (API) and said second application being configured to communicate in accordance with a second application programming interface (API), comprising:

receiving an inquiry from said second application regarding a status of said first application in a second application interface module, said inquiry being configured in accordance with said second API;

receiving said inquiry in a translation and routing module, said translation and routing module converting said inquiry into a translated inquiry, said translated inquiry being configured in accordance with said first API;

receiving said translated inquiry in a first application interface emulator module in accordance with said first API;

receiving said translated inquiry in said first application in accordance with said first API;

receiving a message from said first application in response to said translated inquiry in said first application interface emulator module, said message being configured in accordance with said first API;

receiving said message in said translation and routing module, said translation and routing module converting said message into a translated message, said translated message being configured in accordance with said second API;

receiving said translated message in said second application interface module in accordance with said second API; and

receiving said translated message in said second application in accordance with said second API, said translated message providing requested information regarding said first application to said second application.

15. The method according to claim 14, wherein:

said first software application comprises a security application and said second software application comprises a network access control application, said first and second applications residing on an end point computing device, said first inquiry including a request for information regarding a security posture of said end point computing device; and

wherein said first message includes the requested information regarding said security posture of said end point computing device.

16. A method for facilitating the collection of information regarding a first software application by a second software application, said first software application being configured in accordance with a first API and said second software application being configured in accordance with a second API, comprising:

receiving, from said second application, an inquiry regarding a status of said first application, said inquiry being configured in accordance with said second API;

converting said inquiry into a translated inquiry, said translated inquiry being configured in accordance with said first API;

receiving, from said first application, a message in response to said translated inquiry, said message being configured in accordance with said first API; and

converting said message into a translated message, said translated message being configured in accordance with said second API, wherein said second message includes information regarding said status of said first application.