Systems and methods of controlling network access

• US 8,112,788 B2
• Filed: 06/10/2011
• Issued: 02/07/2012
• Est. Priority Date: 09/24/2003
• Status: Expired due to Fees

• Current Assignee: InfoExpress, Inc.
• Original Assignee: InfoExpress, Inc.
• Inventors: Lum, Stacey C., Lee, Yuhshiow Alice
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US13/157,310
• Publication Number:
  US 20110231916A1
• Time in Patent Office: 242 Days
• Field of Search: 726 1- 4, 726 11- 12, 726/15, 713/150, 713/153, 713/155, 713/168, 713/170, 380/270, 709224-225, 709228-229
• US Class Current: 726/2
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A new approach to network security includes manipulating an access point such that an initial communication from an external device is passed to a restricted subset of a computing network including a gatekeeper. The gatekeeper is configured to enforce a security policy against the external device before granting access to a less-restricted subset of the computing network. If requirements of the security policy are satisfied, then the gatekeeper reconfigures the access point such that further communication from the external device may be received by elements of the less-restricted subset. Enforcement of the security policy optionally includes performing a security audit of the external device.

Claims

1. A method for network access control, the method comprising:

receiving authentication information and device information from a device seeking network access using an extensible authentication protocol (EAP);

executing an extensible authentication protocol module (EAPM) stored in memory, wherein execution of the EAPM by a processor authenticates the device seeking network access, wherein authentication of the device is based on at least an evaluation of the received authentication information;

directing the received device information to a gatekeeper for approval; and

executing an extensible authentication server layer (ESL) stored in memory, wherein execution of the ESL by a processor configures an access point responsive to gatekeeper approval of the authenticated device seeking network access.

2. The method of claim 1, wherein the device seeking network access sends the authentication information and the device information in response to an audit request.

3. The method of claim 2, further comprising:

formulating the audit request; and

sending the audit request to the device seeking network access.

4. The method of claim 2, wherein approval of the device seeking network access comprises is based on evaluating the device information received from the device.

5. A non-transitory computer-readable storage medium, having embodied thereon a program, the program being executable by a processor to perform a method for network access control, the method comprising:

receiving authentication information and device information from a device seeking network access using an extensible authentication protocol (EAP);

authenticating the device seeking network access, wherein authentication of the device is based on at least an evaluation of the received authentication information;

directing the received device information to a gatekeeper for approval; and

configuring an access point responsive to gatekeeper approval of the authenticated device seeking network access.