SYSTEMS AND METHODS OF CONTROLLING NETWORK ACCESS

• US 20110231915A1
• Filed: 06/10/2011
• Published: 09/22/2011
• Est. Priority Date: 09/24/2003
• Status: Active Grant

• Current Assignee: InfoExpress, Inc.
• Original Assignee: InfoExpress, Inc.
• Inventors: Lum, Stacey C., Alice Lee, Yuhshiow
• Granted Patent: US 8,117,645 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A new approach to network security includes manipulating an access point such that an initial communication from an external device is passed to a restricted subset of a computing network including a gatekeeper. The gatekeeper is configured to enforce a security policy against the external device before granting access to a less-restricted subset of the computing network. If requirements of the security policy are satisfied, then the gatekeeper reconfigures the access point such that further communication from the external device may be received by elements of the less-restricted subset. Enforcement of the security policy optionally includes performing a security audit of the external device.

Claims

1. A network access control system, comprising:

an authentication module stored in memory and executable by a processor to authenticate a device seeking network access based at least on authentication information received from the device;

a gatekeeper stored in memory and executable to;

formulate an audit request,

send the audit request to the device,

evaluate device information received from the device in response to the audit request, and

approve the device based on evaluation of the device information; and

an extensible authentication protocol (EAP) server layer (SL) stored in memory and executable to;

receive the authentication information from the device using an EAP encryption protocol, and

configure an access point in response to approval of the device by the gatekeeper.

2. The network access control system of claim 1, wherein the gatekeeper is hosted at the same computing device as the EAPM, ESL, and SF.

3. The network access control system of claim 2, wherein the computing device is an access point or router.

4. The network access control system of claim 1, wherein the gatekeeper is hosted at a computing device distinct from a computing device hosting the EAPM, ESL, and SF.

5. The network access control system of claim 1, wherein the SF is part of the ESL.

6. The network access control system of claim 1, wherein the EAPM includes a plurality of authentication modules configured to perform different authentication operations.