Containment of network communication

• US 7,987,230 B2
• Filed: 07/20/2010
• Issued: 07/26/2011
• Est. Priority Date: 03/22/2004
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Sebes, E. John, Sharma, Rosen, Shah, Bakul
• Primary Examiner(s): Walsh; John B.
• Application Number:
  US12/839,856
• Publication Number:
  US 20100293225A1
• Time in Patent Office: 371 Days
• Field of Search: None
• US Class Current: 709/203
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Invention selectively enables usage of services and communication conduits in a computer network, wherein the enablement is contingent on usage conditions, resulting in containment of the spread of unauthorized activity within a networked computer system and limiting the scope of results when an element becomes part of a hostile execution environment. Instead of protecting individual networked elements from a potentially hostile execution environment, the elements'"'"' usage of the networked environment is restricted to the extent of selectively allowing usage of needed resources explicitly authorized for use by such elements.

Claims

1. A method, comprising:

evaluating a connection request initiated from a client in a computer network to establish a communication conduit between the client and a server;

identifying the communication conduit corresponding to the client and the server, and wherein a service is associated with the communication conduit;

identifying one or more usage conditions associated with the communication conduit, wherein the one or more usage conditions are defined to permit conditional use of the communication conduit; and

determining whether the one or more usage conditions permit the connection request to be sent to the server, wherein if at least one of the usage conditions is met, then the connection request is sent to the server.

2. The method of claim 1, wherein the identifying the communication conduit includes determining a first network address of the server, a second network address of the client, and a port number indicated by the connection request.

3. The method of claim 1, wherein a communication mapping includes the one or more usage conditions with at least one of the usage conditions being mapped to the communication conduit.

4. The method of claim 1, wherein a communication mapping includes the one or more usage conditions with at least one of the usage conditions being mapped to the service associated with the communication conduit.

5. The method of claim 1, further comprising:

sending a plurality of DHCP reply messages for binding an address of the server to an address of a containment host, the plurality of DHCP reply messages sent to the client by the containment host.

6. The method of claim 1, further comprising:

intercepting a service message initiated by the client on the communication conduit after the connection request is sent to the server; and

determining a request-type of the service message.

7. The method of claim 6, further comprising:

determining one or more service conditions defined for the request-type, wherein the one or more service conditions are defined to permit conditional use of the communication conduit by the client using the request-type; and

determining whether the one or more service conditions permit the service message to be sent to the server.

8. Logic encoded in one or more non-transitory media that includes code for execution and when executed by one or more processors is operable to perform operations comprising:

intercepting a connection request initiated from a client in a computer network to establish a communication conduit between the client and a server;

identifying the communication conduit corresponding to the client and the server, and wherein a service is associated with the communication conduit;

identifying one or more usage conditions associated with the communication conduit, wherein the one or more usage conditions are defined to permit conditional use of the communication conduit; and

determining whether the one or more usage conditions permit the connection request to be sent to the server, wherein if at least one of the usage conditions is met, then the connection request is sent to the server.

9. The logic of claim 8, wherein the identifying the communication conduit includes determining a first network address of the server, a second network address of the client, and a port number indicated by the connection request.

10. The logic of claim 8, wherein a communication mapping includes the one or more usage conditions with at least one of the usage conditions being mapped to the communication conduit.

11. The logic of claim 8, wherein a communication mapping includes the one or more usage conditions with at least one of the usage conditions being mapped to the service associated with the communication conduit.

12. The logic of claim 8, the one or more processors being operable to perform further operations comprising:

sending a plurality of DHCP reply messages for binding an address of the server to an address of a containment host, the plurality of DHCP reply messages sent to the client by the containment host.

13. The logic of claim 8, the one or more processors being operable to perform further operations comprising:

intercepting a service message initiated by the client on the communication conduit after the connection request is sent to the server; and

determining a request-type of the service message.

14. The logic of claim 13, the one or more processors being operable to perform further operations comprising:

determining one or more service conditions defined for the request-type, wherein the one or more service conditions are defined to permit conditional use of the communication conduit by the client using the request-type; and

determining whether the one or more service conditions permit the service message to be sent to the server.

15. An apparatus, comprising:

a communication proxy for intercepting a connection request from a client in a computer network to establish a communication conduit between the client and a server; and

one or more processors operable to execute instructions associated with the communication proxy, including;

identifying the communication conduit corresponding to the client, the server, and a service associated with the communication conduit;

identifying one or more usage conditions associated with the communication conduit, wherein the one or more usage conditions are defined to permit conditional use of the communication conduit by the client; and

determining whether the one or more usage conditions permit the connection request to be sent to the server, wherein if at least one of the usage conditions is met, then the connection request is sent to the server.

16. The apparatus of claim 15, wherein the identifying the communication conduit includes determining a first network address of the server, a second network address of the client, and a port number indicated by the connection request.

17. The apparatus of claim 15, further comprising:

a service proxy for intercepting a service message initiated from the client on the communication conduit after the connection request is sent to the server, the one or more processors being operable to execute instructions associated with the service proxy, including;

determining a request-type of the service message.

18. The apparatus of claim 17, the one or more processors being operable to perform further operations comprising:

determining one or more service conditions defined for the request-type, wherein the one or more service conditions are defined to permit conditional use of the communication conduit by the client using the request-type; and

determining whether the one or more service conditions permit the service message to be sent to the server.

19. The apparatus of claim 17, wherein the communication proxy and the service proxy both reside in a network element, the network element in a communication path between the client and the server.

20. The apparatus of claim 17, wherein the communication proxy and the service proxy reside on different hosts.