DYNAMIC INTERNET ADDRESS ASSIGNMENT BASED ON USER IDENTITY AND POLICY COMPLIANCE

• US 20110231534A1
• Filed: 05/31/2011
• Published: 09/22/2011
• Est. Priority Date: 02/22/2008
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Limited (Sophos Group Ltd.)
• Inventors: Mulh, Kenneth E., Manring, Bradley A.C.
• Granted Patent: US 8,146,137 B2
• Time in Patent Office: Days
• US Class Current: 709/221
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

In embodiments of the present invention, improved capabilities are described for a method presenting a client, providing client information and requesting an IP address from a DHCP server, where the DHCP server may formulate a first IP assignment and a first multiple DHCP options. A policy management facility may be associated with the interception of the first IP assignment and the first multiple DHCP options, which may result in the first IP assignment and the first multiple DHCP options not being sent to the client. The method may send client information to the policy management facility. The policy management facility may formulate a second multiple DHCP options and may send it to the DHCP server. The DHCP server may change first IP assignment and first multiple DHCP option to a second IP assignment and the second multiple DHCP options. The second IP assignment and the second multiple DHCP options may then be forwarded to the client.

Claims

1. A method, comprising:

presenting a client requesting an IP address from a DHCP server, wherein the client provides client information to the DHCP server, and wherein the client requesting is made in association with a security threat detected by a client security facility;

formulating a first IP assignment and a first plurality of DHCP options by the DHCP server;

intercepting the first IP assignment and the first plurality of DHCP options by a policy management facility, wherein intercepting stops the sending of the first IP assignment and the first plurality of DHCP options to the client;

sending client information to the policy management facility;

formulating a second plurality of DHCP options in association with the policy management facility, wherein the second plurality of DHCP options is sent from the policy management facility to the DHCP server;

changing the DHCP options in the DHCP server from the first IP assignment and first plurality of DHCP options to a second IP assignment and the second plurality of DHCP options; and

sending the second IP assignment and the second plurality of DHCP options from the DHCP server to the client, wherein the client applies the second IP assignment and the second plurality of DHCP options in association with the client security facility.

2. The method of claim 1 wherein the client requesting is made when the client initializes a network.

3. The method of claim 1wherein the client requesting is generated through a TCP/IP configured software resident on the client.

4. The method of claim 1 wherein the client information is a security vulnerability.

5. The method of claim 4 wherein the security vulnerability is associated with malware security vulnerability.

6. The method of claim 5 wherein the malware security vulnerability is from the client security facility detecting a malware threat.

7. The method of claim 5 wherein the malware security vulnerability is from the client security facility detecting suspicious behavior.

8. The method of claim 1 wherein the client information is a software vulnerability.

9. The method of claim 1 wherein the client information is a client configuration status.

10. The method of claim 9 wherein the client configuration status is associated with the policy management facility.

11. The method of claim 10 wherein the policy management facility reads the configuration status as an indication of policy compliance.

12. The method of claim 1 wherein the formulating the second plurality of DHCP options in association with the policy management facility is in association with a policy.

13. The method of claim 1 wherein the DHCP server implements a protocol used by the client to obtain parameters necessary for the client to operate on an internet protocol (IP) network.

14. The method of claim 13 wherein the client sends a broadcast query onto the IP network requesting the parameters from the DHCP server.

15. The method of claim 1 wherein the DHCP server provides for a dynamic allocation of IP addresses.

16. The method of claim 1 wherein the plurality of DHCP options are used to assign network configuration parameters.

17. The method of claim 16 wherein the network configuration parameter is associated with full network access.

18. The method of claim 16 wherein the network configuration parameter is associated with normal network access.

19. The method of claim 16 wherein the network configuration parameter is associated with restricted access.

20. The method of claim 16 wherein the network configuration parameter is associated with isolating the client.