NETWORK ACCESS CONTROL SYSTEM AND METHOD FOR DEVICES CONNECTING TO NETWORK USING REMOTE ACCESS CONTROL METHODS

• US 20090307753A1
• Filed: 06/10/2009
• Published: 12/10/2009
• Est. Priority Date: 06/10/2008
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Bradford Networks Incorporated (Fortinet Inc.)
• Inventors: Srinivasan, Seshakrishnan, Andrus, Frank D., Dupont, Eric P.
• Granted Patent: US 9,369,299 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 12/2872 Termination of subscriber connections
• CPC Class Codes: H04L 12/2876 Handling of subscriber policies group policies management H04L41/0893
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

A system and method for network access control (NAC) of remotely connected devices is disclosed. In embodiments, agents support role mapping and policy-based scanning. Embodiments automatically perform authentication, assessment, authorization, provisioning, and remediation. Capabilities include user authentication, role-based authorization, endpoint compliance, alarms and alerts, audit logs, location-based rules, and policy enforcement. Processes collect information about the user as well as the host being used from sources including, but not limited to, LDAP, the remote access device, and the agent. Once this data has been obtained, embodiments construct a comprehensive model of the host. This model is subsequently used to govern the actual host'"'"'s network access when it connects to the network. Passive monitoring includes vulnerability scanning to control access rights throughout the duration of the connection.

Claims

1. A system for out-of-band control of network access supporting multiple connections comprising:

a network;

at least one remote access device (RAD) communicatively coupled to said network; and

a Network Access Control Server (NACS) controlling said network access, wherein said network access control comprises;

identity management of said connections;

endpoint compliance of said connections; and

usage policy enforcement of said connections.

2. The system of claim 1, wherein said network access comprises agents whereby said agents collect identity and health information about user and said RAD.

3. The system of claim 1, wherein said network access comprises:

at least one of a Virtual Private Network (VPN) server, Remote Access Server (RAS), firewall, intrusion protection detection system, a switch, a router, an authentication authorization and accounting (AAA) directory server, Bootstrap Protocol (BOOTP), Dynamic Host Configuration Protocol (DHCP), and Domain Name System (DNS).

4. The system of claim 1, wherein said network access comprises a connection attempt comprising constructing a connection model from information about user and said RAD.

5. The system of claim 1, wherein said network access control is RAD agnostic and said connections comprise at least one network capable connecting user device.

6. The system of claim 1, wherein identity management comprises role management, wherein users are assigned roles corresponding to access control characteristics specific to each said RAD in said network.

7. The system of claim 1, wherein identity management comprises scan policy based on identity and location of connecting user and said RAD.

8. The system of claim 5, wherein said network access of said connecting user device is controlled by filters based on identity and location of connecting user and said RAD.

9. The system of claim 1, wherein network address of said RAD is unchanged as security condition of said RAD changes, whereby transition between restricted and unrestricted is automatic to said user.

10. The system of claim 1, wherein said usage policy enforcement comprises data recording whereby security threat analysis and regulatory compliance reports are generated, and at-risk device access comprises an automatic remediation option.

11. A method for secure network access of a user device to a network comprising the steps of:

receiving a connect attempt to said network from said user device;

authenticating connecting user to a network access control server (NACS) by a remote access device (RAD);

capturing RAD identification, location by said NACS;

restricting access to said network by said user device with a network access filter (NAF) configured on said RAD;

directing said client device to an agent by said RAD;

running said agent on said user device;

identifying client to said NACS by said agent;

modifying said NAF based on compliance;

monitoring post-connection of successful connections.

12. The method of claim 11, wherein said authenticating step comprises an authentication authorization and accounting (AAA) server.

13. The method of claim 11, wherein said NACS instructs said RAD to reject user and network connection is disallowed when authentication fails.

14. The method of claim 11, wherein said step of restricting access follows successful authentication.

15. The method of claim 14, wherein said step of running said agent comprises scanning by scan policy based on user and location.

16. The system of claim 14, wherein identity management comprises constructing a model of said connecting user device from data gathered by said agent.

17. The method of claim 14, wherein said step of modifying said NAF comprises maintaining said NAF whereby network access is restricted if results from said scanning fail compliance.

18. The method of claim 14, wherein said step of modifying said NAF comprises client remediation when results from said scanning fail compliance.

19. The method of claim 11, wherein said step of modifying said NAF comprises said NACS instructing said RAD to modify said NAF.

20. The method of claim 11, wherein said step of identifying client includes information about user and said user device.

21. The method of claim 11, wherein said step of monitoring post-connection of successful connections comprises continued access, designating client marked at-risk, disabling, or disconnecting based on results of said monitoring wherein said monitoring is passive.

22. A method for secure network access of a user device to a network comprising the steps of:

attempting to connect to said network from said user device;

authenticating connecting user to a network access control server (NACS) by a remote access device (RAD), wherein said authentication process is out of band, and not involved in ongoing network traffic flow, whereby data throughput and remote access scalability are unimpeded;

capturing RAD identification, location by said NACS, wherein role-mapping based on user identity and RAD provides identity-based network assignment;

restricting access to said network by said user device with a network access filter (NAF) configured on said RAD, wherein network access restrictions by filter are abstracted whereby a plurality of RAD filtering mechanisms are supported;

directing said client device to an agent by said RAD, wherein said agent is determined by said NACS;

running said agent on said user device, wherein said agent is selected from persistent and dissolvable agents;

identifying client to said NACS by said agent;

modifying said NAF based on compliance; and

monitoring post-connection of successful connections.