NETWORK DEVICE WITH TRANSPARENT HEARTBEAT PROCESSING

• US 20190312838A1
• Filed: 04/04/2018
• Published: 10/10/2019
• Est. Priority Date: 04/04/2018
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Limited (Sophos Group Ltd.)
• Inventors: Grimm, Moritz Daniel, Stutz, Daniel, Thomas, Andrew J., Ray, Kenneth D.
• Granted Patent: US 10,862,864 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 61/2503 Translation of Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Network devices within an enterprise are configured to pass out-of-band security information such as heartbeats, notifications of compromise, device identification information, and so forth between logical or physical network partitions such as subnets, routing domains, access points, and so forth. This technique can advantageously facilitate integrated management of endpoints across network boundaries that might otherwise interfere with the identification and management of specific devices.

Claims

1. A network device comprising:

a first network interface coupled to an enterprise network;

a second network interface coupled to a subnet of the enterprise network; and

a processor configured by computer executable code stored in a memory and executable by the processor to manage network communications between the enterprise network and endpoints coupled to the subnet, wherein the processor is configured to pass out-of-band information from one of the endpoints coupled to the subnet to a security infrastructure for the enterprise network, and to pass out-of-band security control information from the security infrastructure to one or more of the endpoints coupled to the subnet.

2. The network device of claim 1 wherein the network device includes at least one of a firewall, a switch, and a router.

3. The network device of claim 1 wherein the network device includes a network address translation device.

4. The network device of claim 1 wherein the processor is configured to translate network traffic between a first routing prefix for the enterprise network and a second routing prefix for the subnet of the enterprise network.

5. The network device of claim 1 wherein the out-of-band information from one of the endpoints includes a secure heartbeat.

6. The network device of claim 5 wherein the secure heartbeat is responsive to a query from a threat management facility.

7. The network device of claim 5 wherein the secure heartbeat includes security status information for the one of the endpoints.

8. The network device of claim 5 wherein the secure heartbeat includes network identification information for the one of the endpoints.

9. The network device of claim 1 wherein the out-of-band information from one of the endpoints includes local subnet identification information for identifying a location of the one of the endpoints outside the subnet.

10. The network device of claim 9 wherein the local subnet identification information includes a media access control address for the one of the endpoints.

11. The network device of claim 9 wherein the local subnet identification information includes a subnet internet protocol address for the one of the endpoints.

12. The network device of claim 9 wherein the local subnet identification information includes a five-tuple for the one of the endpoints including a source IP address, a destination IP address, a source port number, a destination port number, and an IP protocol number associated with a network connection.

13. The network device of claim 1 wherein the out-of-band information includes an SSH fingerprint for the one of the endpoints.

14. The network device of claim 1 wherein the out-of-band security control information includes an isolation command instructing one of the endpoints to stop communications with a second one of the endpoints coupled to the subnet.

15. The network device of claim 14 wherein the processor is configured to convert a network address for the second one of the endpoints into an internet protocol address for the second one of the endpoints on the subnet.

16. The network device of claim 14 wherein the processor is configured to convert a network address for the second one of the endpoints on the subnet into a media access control address for the second one of the endpoints on the subnet.

17. The network device of claim 1 wherein the out-of-band security control information includes a request for network identification information.

18. The network device of claim 1 wherein the out-of-band security control information includes a request for security status.

19. The network device of claim 1 wherein the security infrastructure includes a firewall for the enterprise network.

20. The network device of claim 1 wherein the security infrastructure includes a threat management facility for the enterprise network.