Method and apparatus for adapting a communication network according to information provided by a trusted client

• US 20080282080A1
• Filed: 05/12/2008
• Published: 11/13/2008
• Est. Priority Date: 05/11/2007
• Status: Abandoned Application

• Current Assignee: Avaya Incorporated
• Original Assignee: Nortel Networks Limited (Nortel Networks Corporation)
• Inventors: Hyndman, Arn, Sauriol, Nicholas
• Application Number:
  US12/152,086
• Publication Number:
  US 20080282080A1
• Time in Patent Office: Days
• US Class Current: 713/150
• CPC Class Codes: H04L 41/0863 by rolling back to previous configuration versions
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Hosts connecting to the network implement an adaptive networks client that monitors other applications on the host and provides information to an adaptive networks server to provide information about traffic being generated by the host. The client may also capture information about the user, host, access type, and other information of interest. The information provided by the adaptive network client may allow the network to adapt to the user, the device, the application, and the protocol being used. Users and applications can be authenticated and trusted. From a network standpoint, having a trusted client associated with the host allows the same benefits as deep packet inspection, regardless of whether the traffic is encrypted, and without requiring the network elements to actually perform deep packet inspection. The administrator may also centrally apply policy to control which applications are allowed to run on the hosts.

Claims

1. A method of adapting a communication network based on information obtained by a trusted client resident on a host, the method comprising the steps of:

obtaining, by an adaptive networks server, information from the trusted client resident on the host about applications running on the host; and

applying policy by the adaptive networks server to the network to adjust the network for the applications running on the host by adjusting quality of service, network security, load balancing, or routing on the network for the applications.

2. The method of claim 1, wherein the information includes at least an identification of the applications running on the host and signatures of the applications.

3. The method of claim 2, wherein the information associated with each application includes an identification of the application name, the application path, a signature of the application, and dynamic link library list associated with the application.

4. The method of claim 1, wherein the information is obtained via a secure connection between the adaptive networks server and the trusted client.

5. The method of claim 1, wherein the adaptive networks server further receives identifying information associated with a user of the application, and authenticates the user using the identifying information associated with the user of the application.

6. The method of claim 1, further comprising the step of validating the trusted client resident on the host to determine whether the trusted client has been compromised.

7. The method of claim 6, wherein the step of applying policy by the adaptive networks server comprises limiting access to the network where the trusted client has been compromised.

8. The method of claim 7, wherein the step of applying policy by the adaptive networks server comprises enabling an administrator to determine which applications are to be allowed to run on the host.

9. The method of claim 8, wherein the step of applying policy comprises enabling the administrator to selectively allow or disallow a new application when it is instantiated in a first host, and then using the decision to selectively allow or disallow the new application as it is instantiated in other hosts on the network.

10. The method of claim 9, wherein the administrator may also specify a quality of service and other parameters for the application when it is instantiated in the first host.

11. A network, comprising:

an adaptive networks server; and

a plurality of hosts implementing adaptive networks clients, the adaptive networks clients providing information to the adaptive networks server about applications running on their respective hosts;

wherein the adaptive networks server is able to validate the trusted adaptive networks clients to determine if one or more of the adaptive networks clients has been compromised, and wherein the adaptive networks server will restrict network access to any client not implementing an adaptive networks client or implementing a compromised adaptive networks client.

12. The network of claim 11, wherein the network is a corporate network, and wherein the adaptive networks server will only allow access to the Internet over the corporate network to any host not implementing an adaptive networks client or implementing a compromised adaptive networks client.

13. The network of claim 11, wherein the network is a corporate network, and wherein the adaptive networks server will deny access to the corporate network to any host not implementing an adaptive networks client or implementing a compromised adaptive networks client.

14. The network of claim 11, wherein the network is a corporate network, and wherein the adaptive networks server will notify the administrator of the attempted access to the corporate network by any host not implementing an adaptive networks client or implementing a compromised adaptive networks client, to enable the administrator to selectively allow or disallow access to the host.

15. The network of claim 11, wherein the adaptive networks server is configured to adjust one or more parameters of the network to affect policy on the network associated with particular hosts and particular applications.

16. The network of claim 11, further comprising a plurality of network elements configured to handle data traffic on the network, and wherein the adaptive networks server is configured to adjust the network elements for data traffic from particular hosts or for data traffic from particular applications implemented on the hosts.

17. The network of claim 11, wherein the adaptive networks clients monitor applications for network access attempts, and provide information about the applications that are attempting to access the network to enable the adaptive networks server to determine policy to be applied for communications on the network associated with those applications.

18. The network of claim 11, wherein the adaptive networks clients provide information associated with the applications to the adaptive networks server so that the adaptive networks server is able to determine the applications that are generating data to be transmitted on the network from particular hosts without requiring a network element on the network to perform deep packet inspection.

19. The network of claim 11, wherein the network further comprises a plurality of network elements to handle traffic on the network, and wherein at least one of the network elements is able to apply filters to traffic generated by the hosts to selectively allow traffic from particular applications running on those hosts according to instructions provided by the adaptive networks server.

20. The network of claim 19, wherein at least one of the adaptive networks clients includes an Application Programming Interface (API) that will allow the adaptive networks client to be queried by an application running on the host as to an operational state of the network.

21. The network of claim 11, wherein the adaptive networks client is implemented on a proxy device that connects to the host via a USB port.

22. A method of applying network policy to encrypted network traffic generated by a host on a network, the method comprising the steps of:

receiving information from a trusted client instantiated on the host, the trusted client being configured to monitor applications instantiated on the host and to provide information about applications that are seeking access to the network and hence likely to generate network traffic;

determining policy associated with the applications;

receiving encrypted network traffic generated by the host on the network; and

applying the policy associated with the application that is likely to have generated the network traffic without unencrypting the network traffic to determine the type of network traffic.