QUARANTINE TOOL

• US 20110219103A1
• Filed: 07/30/2010
• Published: 09/08/2011
• Est. Priority Date: 03/02/2010
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Treadwell, William Scott, Kaye, Kenneth, Shnowske, Daniel P.
• Granted Patent: US 8,874,706 B2
• Time in Patent Office: Days
• US Class Current: 709/222
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Described herein are apparatuses, methods, and computer program products for quarantining an out of compliance client device from other client devices on a network. Quarantining the out of compliance client device prevents the out of compliance device from corrupting other client devices on the network. For example, in operation, embodiments of the present invention involve: (1) receiving identification and location information for an out of compliance client device; (2) running a tool that utilizes the identification and location information to access the out of compliance device; (3) using the tool to modify the out of compliance device such that the out of compliance client device broadcasts a request for configuration information to which a network server is programmed to respond with configuration information associated with an isolated network; and (4) using the tool to cause the out of compliance client device to logout of the network. When the device logs back into the network, the network server responds by directing the device to the isolated network.

Claims

1. A system for quarantining an out of compliance client device from other client devices on an operating network, the system comprising;

a memory device;

a communication device; and

a first processing device operatively coupled to the memory device and the communication device, wherein the first processing device is configured to execute computer-readable program code associated with a quarantine tool to access the out of compliance client device via the operating network,

wherein the quarantine tool comprises computer readable program code configured when performed by said first processing device to cause said first processing device to;

cause the out of compliance client device to broadcast a request for configuration information associated with an isolated network; and

cause the out of compliance client device to logout of the operating network.

2. The system of claim 1, wherein the quarantine tool comprises computer readable program code that when performed by said first processing device causes said first processing device to cause the out of compliance client device to logout of the operating network by restarting a network interface of the client device.

3. The system of claim 1, wherein the quarantine tool comprises computer readable program code that when performed by said first processing device causes said first processing device to cause the out of compliance client device to broadcast the request for configuration information associated with an isolated network is further configured to cause the out of compliance client device to thereafter receive configuration information associated with the isolated network from a network server configured to respond to the broadcast request.

4. The system of claim 1, wherein the quarantine tool comprises computer readable program code that when performed by said first processing device causes said first processing device to cause a modification in the out of compliance client device by adding or changing a Class ID to or in the network interface of the out of compliance client device such that the out of compliance client device broadcasts a request for configuration information, wherein the broadcasted request includes the Class ID, and whereby the out of compliance device thereafter receives an IP address from a pool of IP addresses associated with the isolated network from a network server configured to respond to the broadcast request.

5. The system of claim 1, further comprising a second processing device configured to execute computer-readable program code associated with a compliance tool to bring the out of compliance client device into compliance via an isolated network,

wherein the compliance tool comprises computer readable program code configured when performed by said second processing device to cause said processing device to:

determine that an out of compliance client device is now a compliant client device;

cause the compliant client device to broadcast a request for configuration information to connect to the operating network; and

cause the compliant client device to logout of the isolated network.

6. The system of claim 5, wherein the compliance tool comprises computer readable program code that when performed by said second processing device causes said second processing device to:

add the out of compliance client device to a log of out of compliance devices when the out of compliance client device cannot be made compliant.

7. The system of claim 6, wherein the compliance tool comprises computer readable program code that when performed by said second processing device causes said second processing device to:

access the log of out of compliance client devices;

retrieve identification information for each out of compliance client device listed in the log of out of compliance devices and that are quarantined from the operating network;

utilize the identification information to access each out of compliance client device listed in the log of out of compliance devices;

identify one or more client devices listed in the log of out of compliance devices that has been changed into the compliant client device;

cause the compliant client device to broadcast a request for configuration information associated with the operating network; and

log the compliant client device out of the isolated network.

8. The system of claim 5, wherein the compliance tool is a compliance agent, wherein at least portions thereof are installed on the out of compliance client device.

9. The system of claim 8, wherein the compliance agent comprises computer readable program code that when performed by said second processing device causes said second processing device to:

evaluate the out of compliance client device to determine if it has been brought into compliance.

10. The system of claim 8, wherein the compliance agent comprises computer readable program code that when performed by said second processing device causes said second processing device to:

uninstall the compliance agent once the out of compliance client device has been made compliant.

11. The system of claim 5, wherein the compliance agent comprises computer readable program code that when performed by said second processing device causes said second processing device to cause the compliant client device to broadcast the request for configuration information associated with the operating network is further configured to cause the compliant client device to thereafter receive configuration information associated with the operating network from a network server configured to respond to the broadcast request.

12. The system of claim 5, wherein the compliance agent comprises computer readable program code that when performed by said second processing device causes said second processing device to cause a modification in the compliant client device by removing or changing a Class ID from or on the network interface of the compliant client device such that the compliant client device broadcasts a request for configuration information, wherein the broadcasted request either does not include the Class ID or includes the changed Class ID, and whereby the compliant client device thereafter receives an IP address from a pool of IP addresses associated with the operating network from a network server configured to respond to the broadcast request.

13. The system of claim 5, wherein the compliance tool comprises computer readable program code that when performed by said second processing device causes said second processing device to cause said second processing device to cause the client device that has been brought into compliance to logout of the isolated network by restarting a network interface of the client device.

14. The system of claim 5, wherein the compliance tool comprises computer readable program code that when performed by said second processing device causes said second processing device to:

receive notification that the out of compliance client device is out of compliance when the out of compliance client device accesses the isolated network.

15. The system of claim 5, wherein the compliance tool comprises computer readable program code that when performed by said second processing device causes said second processing device to:

receive identification and location information for the out of compliance client device; and

wherein the second processing device configured to execute computer-readable program code to utilize a compliance tool comprises utilizing the identification and location information to access the out of compliance client device.

16. The system of claim 1, the compliance tool comprises computer readable program code that when performed by said second processing device causes said second processing device to:

tag the out of compliance client device as a rogue device if the quarantine tool is unable to access the out of compliance client device.

17. The system of claim 5, wherein said first and second processing devices are embodied by the same processing device.

18. The system of claim 8, further comprising a third processing device configured to execute computer-readable program code associated with the compliance agent that is at least partially installed on the out of compliance client device, wherein the third processing device is configured to execute the portions of the compliance agent that are installed on the out of compliance client device.

33. The method of claim 1, wherein the processor is more than one processor.

19. A method for quarantining an out of compliance client device from other client devices on an operating network, the method comprising:

causing the out of compliance client device to broadcast a request for configuration information associated with an isolated network, through the use of a processor; and

causing the out of compliance client device to logout of the operating network, through the use of the processor.

20. The method of claim 19, wherein causing the out of compliance client device to logout of the operating network comprises restarting a network interface of the client device.

21. The method of claim 19, further comprising

causing the out of compliance client device to receive configuration information associated with the isolated network from a network server configured to respond to the broadcast request, through the use of the processor.

22. The method of claim 19, further comprising:

causing a modification in the out of compliance client device by adding or changing a Class ID to or in the network interface of the out of compliance client device such that the out of compliance client device broadcasts a request for configuration information, through the use of the processor, wherein the broadcasted request includes the Class ID, and whereby the out of compliance device thereafter receives an IP address from a pool of IP addresses associated with the isolated network from a network server configured to respond to the broadcast request.

23. The method of claim 19, further comprising:

determining that an out of compliance client device is now a compliant client device, through the use of the processor;

causing the compliant client device to broadcast a request for configuration information to connect to the operating network, through the use of the processor; and

causing the compliant client device to logout of the isolated network, through the use of the processor.

24. The method of claim 23, further comprising:

adding the out of compliance client device to a log of out of compliance devices when the out of compliance client device cannot be made compliant, through the use of the processor.

25. The method of claim 24, further comprising:

accessing the log of out of compliance client devices, through the use of the processor;

retrieving identification information for each out of compliance client device listed in the log of out of compliance devices and that are quarantined from the operating network, through the use of the processor;

utilizing the identification information to access each out of compliance client device listed in the log of out of compliance devices, through the use of the processor;

identifying one or more client devices listed in the log of out of compliance devices that has been changed into the compliant client device, through the use of the processor;

causing the compliant client device to broadcast a request for configuration information associated with the operating network, through the use of the processor; and

logging the compliant client device out of the isolated network, through the use of the processor.

26. The method of claim 23, further comprising:

evaluating the out of compliance client device to determine if it has been brought into compliance, through the use of the processor.

27. The method of claim 23, further comprising:

causing the compliant client device to receive configuration information associated with the operating network from a network server configured to respond to the broadcast request, through the use of the processor.

28. The method of claim 23, further comprising:

causing a modification in the compliant client device by removing or changing a Class ID from or on the network interface of the compliant client device such that the compliant client device broadcasts a request for configuration information, through the use of a processor, wherein the broadcasted request either does not include the Class ID or includes the changed Class ID, and whereby the compliant client device thereafter receives an IP address from a pool of IP addresses associated with the operating network from a network server configured to respond to the broadcast request.

29. The method of claim 23, wherein causing the client device that has been brought into compliance to logout of the isolated network comprises restarting a network interface of the client device.

30. The method of claim 23, further comprising:

receiving notification that the out of compliance client device is out of compliance when the out of compliance client device accesses the isolated network, through the use of the processor.

31. The method of claim 23, further comprising:

receiving identification and location information for the out of compliance client device, through the use of the processor; and

utilizing the identification and location information to access the out of compliance client device, through the use of the processor.

32. The method of claim 19, further comprising:

tagging the out of compliance client device as a rogue device if out of compliance client device cannot be accessed, through the use of the processor.

34. A computer program product for a system for quarantining an out of compliance client device from other client devices on a network, the computer program product comprising at least one non-transitory computer-readable medium having computer-readable program code portions embodied therein, the computer-readable program code portions comprising:

an executable portion configured for causing the out of compliance client device to broadcast a request for configuration information associated with an isolated network; and

an executable portion configured for causing the out of compliance client device to logout of the operating network.

35. The computer program product of claim 34, wherein the executable portion configured for causing the out of compliance client device to logout of the operating network comprises restarting a network interface of the client device.

36. The computer program product of claim 34, further comprising

an executable portion configured for causing the out of compliance client device to receive configuration information associated with the isolated network from a network server configured to respond to the broadcast request.

37. The computer program product of claim 34, further comprising:

an executable portion configured for causing a modification in the out of compliance client device by adding or changing a Class ID to or in the network interface of the out of compliance client device such that the out of compliance client device broadcasts a request for configuration information, wherein the broadcasted request includes the Class ID, and whereby the out of compliance device thereafter receives an IP address from a pool of IP addresses associated with the isolated network from a network server configured to respond to the broadcast request.

38. The computer program product of claim 34, further comprising:

an executable portion configured for determining that an out of compliance client device is now a compliant client device, through the use of the processor;

an executable portion configured for causing the compliant client device to broadcast a request for configuration information to connect to the operating network, through the use of the processor; and

an executable portion configured for causing the compliant client device to logout of the isolated network, through the use of the processor.

39. The computer program product of claim 34, further comprising:

an executable portion configured for adding the out of compliance client device to a log of out of compliance devices when the out of compliance client device cannot be made compliant.

40. The computer program product of claim 39, further comprising:

an executable portion configured for accessing the log of out of compliance client devices;

an executable portion configured for retrieving identification information for each out of compliance client device listed in the log of out of compliance devices and that are quarantined from the operating network;

an executable portion configured for utilizing the identification information to access each out of compliance client device listed in the log of out of compliance devices;

an executable portion configured for identifying one or more client devices listed in the log of out of compliance devices that has been changed into the compliant client device;

an executable portion configured for causing the compliant client device to broadcast a request for configuration information associated with the operating network; and

an executable portion configured for logging the compliant client device out of the isolated network.

41. The computer program product of claim 38, further comprising:

an executable portion configured for evaluating the out of compliance client device to determine if it has been brought into compliance, through the use of the processor.

42. The computer program product of claim 38, further comprising:

an executable portion configured for causing the compliant client device to receive configuration information associated with the operating network from a network server configured to respond to the broadcast request.

43. The computer program product of claim 38, further comprising:

an executable portion configured for causing a modification in the compliant client device by removing or changing a Class ID from or on the network interface of the compliant client device such that the compliant client device broadcasts a request for configuration information, wherein the broadcasted request either does not include the Class ID or includes the changed Class ID, and whereby the compliant client device thereafter receives an IP address from a pool of IP addresses associated with the operating network from a network server configured to respond to the broadcast request.

44. The computer program product of claim 38, wherein the executable portion configured for causing the client device that has been brought into compliance to logout of the isolated network by restarting a network interface of the client device.

45. The computer program product of claim 38, further comprising:

an executable portion configured for receiving notification that the out of compliance client device is out of compliance when the out of compliance client device accesses the isolated network.

46. The computer program product of claim 38, further comprising:

an executable portion configured for receiving identification and location information for the out of compliance client device; and

an executable portion configured for utilizing the identification and location information to access the out of compliance client device.

47. The computer program product of claim 38, further comprising:

an executable portion configured for tagging the out of compliance client device as a rogue device if out of compliance client device cannot be accessed.