API TRANSLATION FOR NETWORK ACCESS CONTROL (NAC) AGENT

• US 20090158407A1
• Filed: 12/13/2007
• Published: 06/18/2009
• Est. Priority Date: 12/13/2007
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: Fiberlink Communications Corporation (International Business Machines Corporation)
• Inventors: Nicodemus, Blair, Herchek, Thomas
• Application Number:
  US11/955,992
• Publication Number:
  US 20090158407A1
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/32 Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level

Abstract

An application programming interface (API) translation agent and method for converting a message from one application configured according to a first API to a message configured according to a second API so that the first application, which is configured to communicate only in accordance with the first API, can communicate with a second application, which is configured to communicate only in accordance with the second API. The first and second applications can include a security application and a network access control (NAC) agent installed on an end point computing device, and the API translation agent can be used by the NAC agent to obtain information regarding a security status of the end point computing device, the information being used to determine whether the end point computing device is in compliance with the security policies of a network.

Claims

1. An application programming interface (API) translation agent for receiving and translating messages supported by a first API into messages supported by a second API, comprising:

a first application interface emulator module, said first application interface emulator module being operatively connected to a first application and being configured to receive a first message from said first application, said first application being configured to communicate in accordance with said first API and said first message being configured in accordance with said first API;

a translation and routing module operatively connected with said interface emulator module; and

a second application interface module, said second application interface module being operatively connected to said translation and routing module and being further operatively connected to a second application, said second application being configured to communicate in accordance with said second API;

wherein said translation and routing module receives said first message from said first application interface emulator module and converts said first message supported by said first API into a second message, said second message being configured in accordance with said second API;

wherein said translation and routing module registers said first application for communication with said second application in accordance with said second application; and

further wherein said second application interface module receives said second message from said translation and routing module and forwards said second message to said second application in accordance with said second API to effect communication from said first application to said second application.

2. The API translation agent of claim 1, wherein said first application, said API translation agent, and said second application reside on an end point computing device.

3. The API translation agent of claim 1, said translation and routing module being operatively connected to at least one translation table, wherein said communication from said first API to said second API is translated according to said translation table.

4. The API translation agent of claim 2, wherein said first message provides information regarding a security posture of said end point computing device, said information regarding said security posture being used in determining whether said end point computing device is in compliance with a security policy of a network.

5. The API translation agent of claim 4, wherein said second application comprises a network access control agent, said network access control agent being part of a network access control system associated with said network, said network access control agent further being configured to communicate with said first application only in accordance with said second API.

6. The API translation agent of claim 5, wherein said first application comprises a firewall application and said first message includes information regarding a status of a firewall residing on said end point computing device.

7. The API translation agent of claim 5, wherein said first application comprises an antivirus application and said first message includes information regarding a status of said antivirus application.

8. The API translation agent of claim 2, wherein said first application comprises an application required by a policy of a said network to be present on said end point computing device, said policy of said network further requiring a predetermined state of said first application, said first message including information used in determining a compliance of said end point computing device with said policy.

9. The API translation agent of claim 4, wherein said second application interface module is further configured to receive a first return message from said second application if said end point computing device is not in compliance with said security policy of said network, said first return message being configured in accordance with said second API;

wherein said translation and routing module is configured to receive said first return message and to convert said first return message into a second return message, said second return message being configured in accordance with said first API;

wherein said first application interface emulator module is configured to receive said second return message; and

wherein said first application receives said second return message from said first application interface emulator module, said first and second return messages including information of a non-compliance of said first application with said security policy of said network.

10. The API translation agent of claim 9, wherein said second return message includes information regarding remediation of said non-compliance of said first application with said security policy of said network.

11. The API translation agent of claim 1, wherein said first application interface emulator module, said translation and routing module, and said second application interface module are initialized upon start-up of the end point computing device.

12. The API translation agent of claim 2, wherein said first message from said first application is in response to a first inquiry from said second application, said first inquiry from said second application being configured in accordance with said second API, wherein said translation and routing module converts said first inquiry from said second application into a corresponding second inquiry, said second inquiry being configured in accordance with said first API such that said second application can obtain information from said first application.

13. The API translation agent of claim 12, wherein said second application comprises a network access control agent, said network access control agent being part of a network access control system associated with a network, and said first inquiry comprises an inquiry regarding a status of said first application on said end point computing device.

14. The API translation agent of claim 2, wherein said first application comprises a firewall application and said first message comprises information of a status of a firewall residing on said end point computing device.

15. The API translation agent of claim 2, wherein said first application comprises an antivirus application and said first message comprises information of a status of said antivirus application.

16. The API translation agent of claim 2, wherein said first application comprises an application required by a policy of a computer network to be present on said end point computing device, said policy of said computer network further requiring a predetermined state of said first application, and said first message includes information used in determining a compliance of said end point computing device with said policy.

17. The API translation agent of claim 1, further comprising:

a plurality of first application interface emulator modules, each of said plurality of first application interface emulator modules being configured to receive a first message from one of a plurality of first applications, each of said first applications communicating according to a first API specific to said each of said first applications;

wherein said translation and routing module receives said plurality of first messages from said plurality of first application interface emulator modules, each of said plurality of first messages being configured in accordance with a different first API;

wherein said translation and routing module registers each of said first applications for communication with said second application in accordance with said second application; and

wherein said translation and routing module converts said plurality of first messages into a corresponding plurality of second messages, each of said second messages being configured in accordance with said second API;

such that each of said first applications communicates with said second application in accordance with said second API.

18. A translation and routing module for an application programming interface (API) translation agent, comprising:

at least one mapping table, said mapping table comprising information regarding attributes of a first message in accordance with a first API and attributes of said second message in accordance with a second API, said attributes comprising;

a first attribute code in accordance with said first API and a second attribute code in accordance with said second API, each of said first and second attribute codes being specific to a vendor and an application of said vendor;

a first attribute length in accordance with said first API and a second attribute length in accordance with said second API; and

a first attribute type in accordance with said first API and a second attribute type in accordance with said second API;

wherein each of said first attribute code, first attribute length, and first attribute type are converted into said second attribute code, said second attribute length, and said second attribute type to effect a conversion of said first message configured in accordance with said first API to said second message configured in accordance with said second API;

wherein said translation and routing module is operatively connected to a first application interface module and is configured to receive said first message configured in accordance with said first API; and

further wherein said translation and routing module is operatively connected to a second application interface module and is configured to route said second message to said second application interface module to effect communication from said first application to said second application.

19. The API translation agent of claim 18, wherein said first application comprises a software application and said second application comprises a network access control agent, and further wherein said first application, said second application, and said API translation agent reside on an end point computing device.

20. The API translation agent of claim 18, wherein said first application comprises a network access control agent and said second application comprises a software application, and further wherein said first application, said second application, and said API translation agent reside on an end point computing device.

21. An application programming interface (API) translation agent for a network access control (NAC) system on an end point computing device, comprising:

a first NAC interface emulator component comprising at least one interface emulator module, said interface emulator module being configured to emulate a first API associated with a first NAC agent, said interface emulator module being further configured to receive a first message from a first application on said end point computing device, said message being configured in accordance with said first API;

an NAC protocol translation and routing component operatively connected to said first NAC interface emulator component, said translation and routing component comprising an NAC protocol translation and routing module operatively connected to at least one translation table, said translation table including instructions for converting said first message configured in accordance with said first API into a second message configured in accordance with a second API, said second API being associated with a second NAC agent, said second NAC agent being used to determine a status of said first application on said end point computing device;

said NAC protocol translation and routing module being configured to register said first application for communication with said second NAC agent in accordance with said second application;

said NAC protocol translation and routing module being further configured to receive said first message from said first NAC interface emulator component and convert said first message into said second message in accordance with said instructions in said translation table; and

an NAC inspection interface component operatively connected to said NAC protocol translation and routing component, said NAC inspection interface component being configured to receive said second message from said NAC protocol translation and routing component and being further configured to send said second message to said second NAC agent to effect communication between said first application and said second NAC agent.

22. The API translation agent of claim 21, wherein said first message provides information regarding a security posture of said end point computing device and said information is evaluated in determining whether said end point computing device is in compliance with a security policy of a network.

23. The API translation agent of claim 22, wherein said first application comprises a firewall application and said first message includes information regarding a status of a firewall residing on said end point computing device.

24. The API translation agent of claim 22, wherein said first application comprises an antivirus application and said first message includes information regarding a status of said antivirus application.

25. The API translation agent of claim 21, wherein said first application comprises an application required by a policy of a computer network to be present on said end point computing device, said policy of said computer network further requiring a predetermined state of said first application, and said first message includes information used in determining a compliance of said end point computing device with said policy.

26. The API translation agent of claim 21, wherein said NAC interface component, said NAC protocol translation and routing component, and said NAC inspection interface component are initialized upon start-up of said end point computing device.

27. The API translation agent of claim 21, wherein said first message from said first application is in response to a first inquiry from said NAC agent, said first inquiry from said NAC agent being configured in accordance with said second API;

wherein said NAC translation and routing module converts said first inquiry into a corresponding second inquiry configured in accordance with said first API such that said NAC agent can obtain information from said first application.

28. The API translation agent of claim 21, wherein said information from said first application includes information regarding a security status of said end point computing device.

29. The API translation agent of claim 28, wherein said first application comprises a firewall application and said information from said first application comprises a status of a firewall residing on said end point computing device.

30. The API translation agent of claim 28, wherein said application includes an antivirus application and said information from said application includes information regarding a status of said antivirus application.