Systems and methods of controlling network access

• US 7,523,484 B2
• Filed: 09/24/2004
• Issued: 04/21/2009
• Est. Priority Date: 09/24/2003
• Status: Active Grant

• Current Assignee: InfoExpress, Inc.
• Original Assignee: InfoExpress, Inc.
• Inventors: Lum, Stacey C., Lee, Yuhshiow Alice
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US10/949,179
• Publication Number:
  US 20050063400A1
• Time in Patent Office: 1,670 Days
• Field of Search: 726 1- 4, 726/12, 726/15, 726 23- 24, 713/150, 713/153, 713/168, 709/225, 709228-229
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A new approach to network security includes manipulating an access point such that an initial communication from an external device is passed to a restricted subset of a computing network including a gatekeeper. The gatekeeper is configured to enforce a security policy against the external device before granting access to a less-restricted subset of the computing network. If requirements of the security policy are satisfied, then the gatekeeper reconfigures the access point such that further communication from the external device may be received by elements of the less-restricted subset. Enforcement of the security policy optionally includes performing a security audit of the external device.

Claims

1. A network gatekeeper comprising:

at least one security policy including requirements that must be satisfied before an access device is granted access to a less-restricted subset of a protected network;

a policy auditor configured to audit the access device using the at least one security policy, in response to a request to access the less-restricted subset of the protected network, the request being sent from the access device to the gatekeeper via a communication device; and

an access control configured to reconfigure the communication device such that data sent from the access device is received by the less-restricted subset of the protected network rather than merely a restricted subset of the protected network, if the audit results in a determination that the access device meets the requirements of the at least one security policy, the restricted subset of the protected network including the gatekeeper.

2. The network gatekeeper of claim 1, wherein the network gatekeeper is communicatively coupled with a router configured to limit access to only the restricted subset using an access control list.

3. The network gatekeeper of claim 1, wherein the network gatekeeper is further configured to update the access device using an update module.

4. The network gatekeeper of claim 1, wherein the network gatekeeper is further configured to obtain system data from the access device.

5. The network gatekeeper of claim 4, wherein the network gatekeeper is further configured to use the system data to determine if the access device meets requirements of a security policy, and to issue commands responsive to this determination, the commands being configured to grant access to the less-restricted subset.

6. The network gatekeeper of claim 4, wherein the system data includes antivirus software version data.

7. The network gatekeeper of claim 1, wherein the network gatekeeper is further configured to read an administrator specified configuration of a communication port from the communication device, to store the read administrator specified configuration in a port configuration table, and to issue commands configured to prevent access to the less-restricted subset of the protected network via the communication port.

8. The network gatekeeper of claim 7, wherein the network gatekeeper is further configured to use the stored administrator specified configuration when issuing commands configured to grant access to the less-restricted subset.

9. The network gatekeeper of claim 1, wherein the network gatekeeper is further configured to select from a hierarchical set of security policies, the hierarchical set configured to provide access to different parts of the less-restricted subset of the protected network.

10. The network gatekeeper of claim 1, wherein the restricted subset of the protected network includes elements configured to communicate with the access device having a questionable security status, and the less-restricted subset of the protected network includes those elements of the protected network not included in the restricted subset.

11. The network gatekeeper of claim 1, wherein the at least one security policy is responsive to an identity of the access device.

12. The network gatekeeper of claim 1, wherein the at least one security policy is selected by the policy auditor responsive to a part of the less-restricted subset of the protected network to which access is requested.

13. The network gatekeeper of claim 1, wherein the audit is responsive to antivirus software executing on the access device.

14. The network gatekeeper of claim 1, wherein the audit is responsive to an operating system, a version of the operating system, or patches applied to the operating system, executing on the access device.

15. The network gatekeeper of claim 1, wherein the policy auditor is configured to request data from an agent on the access device.

16. The network gatekeeper of claim 1, wherein the communication device includes a wireless access point.

17. The network gatekeeper of claim 1, wherein the communication device includes a wireless access point configured to support an 802.1x standard.

18. The network gatekeeper of claim 1, wherein the communication device includes a network switch.

19. The network gatekeeper of claim 1, wherein the communication device includes a router.

20. The network gatekeeper of claim 1, wherein the reconfiguration of the communication device includes reconfiguring a port on the communication device such that data received at the port is passed on to elements of both the less-restricted subset of the protected network and the restricted subset of the protected network.

21. The network gatekeeper of claim 20, wherein reconfiguring the port includes returning the port to an administrator specified setting.

22. The network gatekeeper of claim 20, wherein reconfiguring the port includes sending one or more commands from the gatekeeper to the communication device.

23. The network gatekeeper of claim 1, wherein the network gatekeeper is further configured to authenticate a user of the access device.

24. The network gatekeeper of claim 1, wherein the network gatekeeper is configured to update the access device if requirements of the security policy are not satisfied.

25. The network gatekeeper of claim 1, wherein the communication device includes a remote access virtual private network.

26. The network gatekeeper of claim 1, wherein the restricted subset of the protected network is characterized by an access control list.

27. A method of granting access to a protected network, the method comprising:

receiving a request for access to a less-restricted subset of the protected network from an access device, the request being received through a communication port of an access point, the communication port configured for communicating between the access device and a restricted subset of the protected network, the restricted subset including a gatekeeper;

applying a security policy to the access device, responsive to the request;

reconfiguring the communication port for communicating data between the access device and the less-restricted subset of the protected network without passing the data through the gatekeeper, if requirements of the security policy are satisfied;

reading an administrator specified configuration of the communication port from the access point; and

storing the read administrator specified configuration.

28. A method of granting access to a protected network, the method comprising:

receiving a request for access to a less-restricted subset of the protected network from an access device, the request being received through a communication port of an access point, the communication port configured for communicating between the access device and a restricted subset of the protected network, the restricted subset including a gatekeeper;

applying a security policy to the access device, responsive to the request;

reconfiguring the communication port for communicating data between the access device and the less-restricted subset of the protected network without passing the data through the gatekeeper, if requirements of the security policy are satisfied; and

communicating between the gatekeeper and an agent executing on the access device to monitor security status of the access device after reconfiguring the communication port for communicating between the access device and the less-restricted subset.

29. The method of claim 28, further including authenticating a user of the access device.

30. The method of claim 29, further including obtaining system data from the access device, and wherein applying the security policy includes using the system data to determine if the access device satisfies the requirements of the security policy.

31. The method of claim 30, wherein the system data includes antivirus software version data.

32. The method of claim 28, further including configuring the communication port such that requests for access to the less-restricted subset are communicated to the gatekeeper.

33. The method of claim 28, wherein the access point is a network switch.

34. The method of claim 28, wherein the access point is a wireless access point.

35. The method of claim 28, wherein the access point is a remote access virtual private network.

36. The method of claim 28, wherein the gatekeeper is accessible to elements of the less-restricted subset of the protected network.

37. The method of claim 28, wherein the restricted subset of the protected network is characterized by an access control list.

38. The method of claim 28, further including updating the access device if requirements of the security policy are not satisfied.

39. The method of claim 28, wherein the security policy includes an audit of the access device.

40. A method of granting access to a protected network, the method comprising:

receiving a request for access to a less-restricted subset of the protected network from an access device, the request being received through a communication port of an access point, the communication port configured for communicating between the access device and a restricted subset of the protected network, the restricted subset including a gatekeeper;

applying a security policy to the access device, responsive to the request;

reconfiguring the communication port for communicating data between the access device and the less-restricted subset of the protected network without passing the data through the gatekeeper, if requirements of the security policy are satisfied; and

selecting the security policy from among a plurality of security policies, the selecting being responsive to an identity of elements within the less-restricted subset of the protected network to which access is requested.

41. A method of granting access to a protected network, the method comprising:

receiving a request for access to a less-restricted subset of the protected network from an access device, the request being received through a communication port of an access point, the communication port configured for communicating between the access device and a restricted subset of the protected network, the restricted subset including a gatekeeper;

applying a security policy to the access device, responsive to the request;

reconfiguring the communication port for communicating data between the access device and the less-restricted subset of the protected network without passing the data through the gatekeeper, if requirements of the security policy are satisfied; and

updating the access device if requirements of the security policy are not satisfied.

42. The method of claim 41, wherein the security policy includes an audit of the access device.

43. The method of claim 41, further including communicating between the gatekeeper and an agent executing on the access device to obtain system data from the access device, and wherein applying the security policy includes using the system data to determine if the access device satisfies the requirements of the security policy.

44. The method of claim 43, wherein the system data includes information regarding devices connected to the access device.

45. The method of claim 43, wherein the system data includes information regarding computing code executing on the access device.

46. The method of claim 41, further including selecting the security policy from among a plurality of security policies.

47. The method of claim 46, wherein selecting the security policy is responsive to an identity of the access device or an identity of a user of the access device.

48. The method of claim 41, wherein the access point is a network switch.

49. The method of claim 41, wherein the access point is a wireless access point.

50. The method of claim 41, wherein the access point is a remote access virtual private network.

51. The method of claim 41, wherein the gatekeeper is accessible to elements of the less-restricted subset of the protected network.

52. The method of claim 41, wherein the restricted subset of the protected network is characterized by an access control list.

53. The method of claim 41, further including authenticating a user of the access device.

54. The method of claim 53, further including obtaining system data from the access device, and wherein applying the security policy includes using the system data to determine if the access device satisfies the requirements of the security policy.

55. The method of claim 54, wherein the system data includes antivirus software version data.

56. A method of granting access to a protected network, the method comprising:

receiving a request for access to a less-restricted subset of the protected network from an access device, the request being received through a communication port of an access point, the communication port configured for communicating between the access device and a restricted subset of the protected network, the restricted subset including a gatekeeper and being characterized by an access control list, the access to the restricted subset of the protected network being responsive to a VLAN configured to communicate with the protected network subject to the access control list;

applying a security policy to the access device, responsive to the request; and

reconfiguring the communication port for communicating data between the access device and the less-restricted subset of the protected network without passing the data through the gatekeeper, if requirements of the security policy are satisfied.

57. A method of granting access to a protected network, the method comprising:

receiving a first communication from an access device at a communication port, the communication port being configured to pass the first communication to a restricted subset of the protected network, the restricted subset including a gatekeeper configured to enforce a security policy for access to a less-restricted subset of the protected network;

receiving a command from the gatekeeper, the command being responsive to the received first communication and being configured to reconfigure the communication port to communicate data to the less-restricted subset of the protected network;

configuring the communication port to communicate data to the less-restricted subset of the protected network rather than merely the restricted subset of the protected network, responsive to the received command; and

receiving a second communication from the access device at the communication port, the communication port now being configured to pass the second communication to the less-restricted subset of the protected network.

58. The method of claim 57, wherein configuring the communication port includes associating the communication port with a VLAN.

59. The method of claim 57, wherein the communication port is limited to communicating with the restricted subset of the protected network by an access control list, when the first communication is received.

60. The method of claim 59, wherein the communication port is limited to communicating with elements of the protected network by another access control list, when the second communication is received.

61. The method of claim 59, wherein the communication port is coupled with a network switch.

62. The method of claim 59, wherein the communication port is coupled with a wireless access point.

63. The method of claim 59, wherein the communication port is coupled with a remote access virtual private network.

64. The method of claim 57, further including selecting the security policy from a plurality of security policies.

65. The method of claim 57, further including authenticating a user of the access device.

66. The method of claim 65, further including obtaining system data from the access device, and wherein applying the security policy includes using the system data to determine if the access device satisfies the requirements of the security policy.

67. The method of claim 66, wherein the system data includes antivirus software version data.

68. The method of claim 57, further including communicating between the gatekeeper and an agent executing on the access device to obtain system data from the access device, and wherein applying the security policy includes using the system data to determine if the access device satisfies the requirements of the security policy.

69. The method of claim 68, wherein the system data includes information regarding devices connected to the access device.

70. The method of claim 68, wherein the system data includes information regarding computing code executing on the access device.

71. The method of claim 57, further including communicating between the gatekeeper and an agent executing on the access device to monitor security status of the access device after reconfiguring the communication port for communicating between the access device and the less-restricted subset.

72. The method of claim 57, further including updating the access device if requirements of the security policy are not satisfied.

73. A computing network comprising:

elements configured to communicate with one or more access devices using at least a communication port of an access point, the elements including at least a gatekeeper;

means for dividing the elements of the computing network into a restricted subset and a less-restricted subset,

the restricted subset including one or more elements of the computing network configured to communicate with access devices having an unknown security status, and

the less-restricted subset including one or more elements of the computing network not included in the restricted subset;

means for receiving a request at the restricted subset, the request being to access the less-restricted subset;

means for enforcing a security policy in response to the request; and

means for granting access to the less-restricted subset via the communication port of the access point, responsive to the enforcement of the security policy, the access to the less-restricted subset including communication to the less-restricted subset not necessarily passing through the restricted subset.

74. The computing network of claim 73, wherein the communication port of the access point is limited to communicating with the restricted subset by an access control list when the request is received.

75. The computing network of claim 74, wherein the communication port of the access point is limited to communicating with the elements of the computing network by another access control list after access is granted to the less-restricted subset.

76. The computing network of claim 73, wherein the communication port of the access point is coupled with a network switch.

77. The computing network of claim 73, wherein the communication port of the access point is coupled with a wireless access point.

78. The computing network of claim 73, wherein the communication port of the access point is coupled with a remote access virtual private network.

79. The computing network of claim 73, wherein the means for granting access to the less-restricted subset includes means for authenticating a user of the one or more access devices.

80. The computing network of claim 79, wherein the means for granting access to the less-restricted subset includes means for obtaining system data from the one or more access devices, and wherein the means for enforcing the security policy includes means for using the system data to determine if the one or more access devices satisfies requirements of the security policy.

81. The computing network of claim 80, wherein the system data includes antivirus software version data.

82. A computer readable medium including computer code configured for controlling access to a computer network, the computer code comprising:

a code segment configured for receiving a request for access to a less-restricted subset of the protected network from an access device, the request being received through a communication port of an access point, the communication port configured for communicating between the access device and a restricted subset of the protected network, the restricted subset including a gatekeeper;

a code segment configured for applying a security policy to the access device, responsive to the request;

a code segment configured for reconfiguring the communication port for communicating data between the access device and the less-restricted subset of the protected network without passing the data through the gatekeeper, if requirements of the security policy are satisfied;

a code segment configured for reading an administrator specified configuration of the communication port from the access point; and

a code segment configured for storing the read administrator specified configuration.