NETWORK POLICY CONTROLLER

• US 20120084830A1
• Filed: 09/22/2011
• Published: 04/05/2012
• Est. Priority Date: 10/01/2010
• Status: Abandoned Application

• Current Assignee: Mancala Networks
• Original Assignee: Mancala Networks
• Inventors: Dekok, Alan
• Application Number:
  US13/240,299
• Publication Number:
  US 20120084830A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

The invention concerns a network policy controller coupled to a computer network and including a communications interface (303) arranged to monitor network authorization requests relating to a plurality of network devices connected to said network; at least one memory (306) arranged to store past network authorization requests relating to each of said plurality of network devices; and a processor (302) arranged to verify, in response to a network authorization request relating to one of said network devices, the occurrence of at least one past network authorization request stored in said memory for said network device, and to perform an action based on said verification.

Claims

1. A network policy controller coupled to a computer network and comprising:

a communications interface arranged to monitor network authorization requests relating to a plurality of network devices connected to said network;

at least one memory arranged to store past network authorization requests relating to each of said plurality of network devices; and

a processor arranged to verify, in response to a network authorization request relating to one of said network devices, the occurrence of at least one past network authorization request stored in said memory for said network device, and to perform an action based on said verification.

2. The network policy controller of claim 1, wherein said action comprises, based on said verification, selectively restricting communications by said network device.

3. The network policy controller of claim 1, wherein said action comprises selectively performing, based on said verification, either:

transmitting an electronic message identifying said network device;

or

controlling at least one network switch to restrict access by said network device;

or

assigning a new network address to said network device;

or

any combination of the above.

4. The network policy controller of claim 1, wherein said at least one memory further stores a policy table defining rules associated with a plurality of types of network authorization requests associated with said network devices, said rules defining said actions to be performed based on the occurrence of said one or more past network authorization requests.

5. The network policy controller of claim 1, wherein said at least one memory further stores an event recording table that stores said past network authorization requests of said network devices, and a network status table storing a current status of each of said plurality of network devices, the entries of said network status table being a duplication of one or more entries of said event recording table.

6. The network policy controller of claim 1, wherein said communications interface is arranged to monitor network authorization requests at least relating to DHCP (Dynamic Host Configuration Protocol) and DNS (Domain Name System).

7. The network policy controller of claim 1, wherein said communications interface is arranged to monitor network authorization requests at least relating to ARP (Address Resolution Protocol), DHCP, DNS, RADIUS (Remote Authentication Dial-In User Service) and SNMP (Simple Network Management Protocol).

8. The network policy controller of claim 7, wherein said communications interface is arranged to monitor network authorization requests at least relating to one or more of SMTP (Simple Mail Transfer Protocol);

POP (Post Office Protocol);

IMAP (Internet Message Access Protocol);

MAPI (Message Application Programming Interface);

HTTP (Hypertext Transfer Protocol);

HTTPS (HTTP secure);

XMPP (Extensible Messaging and Presence Protocol);

NTP (Network Time Protocol) and TFTP (Trivial File Transfer Protocol).

9. The network policy controller of claim 1, wherein said action comprises controlling a switch to change the connection status of said network device.

10. The network policy controller of claim 1, wherein said network authorization request relating to one of said network devices is a request to be assigned a network address.

11. The network policy controller of claim 10, wherein said communications interface is arranged to monitor at least authentication and network address requests transmitted by said plurality of devices;

and wherein said processor is arranged to verify in said memory, in response to a new network address request from one of said devices, the presence of a past authentication request for said device, and to respond to said new request based on said verification.

12. The network policy controller of claim 11, wherein in response to said verification, said processor is arranged to respond to said request by selecting either a standard IP address or a quarantined IP address to be assigned to said network device.

13. The network policy controller of claim 1, wherein said at least one past network authorization request for said network device indicates a status change of the network authorization level of said device in the network.

14. A method of implementing a network policy in a computer network comprising:

monitoring, via a communications interface, network authorization requests relating to a plurality of network devices connected to said network;

storing in at least one memory past network authorization requests relating to each of said plurality of network devices;

verifying, in response to a network authorization request relating to one of said network devices, the occurrence of at least one past network authorization request stored in said memory for said network device; and

performing an action based on said verification.

15. The method of claim 14, wherein said monitoring step comprises monitoring at least authentication and network address requests transmitted by said plurality of devices;

and wherein said verification step comprises verifying in said memory, in response to a new network address request from one of said devices, the presence of a past authentication request for said device.

16. The method of claim 14, wherein said action comprises selecting either a standard IP address or a quarantined IP address to be assigned to said network device.

17. The method of claim 14, wherein said at least one past network authorization request for said network device indicates a status change of the network authorization level of said device in the network.