# US 10,484,380 B2 · Untrusted network device identification and removal for access control and information security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,380 B2 - Document ID: US10484380B2 - Status: Granted - Kind: B2 - Application number: 15/633,363 - Filed: 2017-06-26 - Published: 2018-12-27 - Granted: 2019-11-19 - Earliest claimed: 2017-06-26 - Assignees: Bank of America Corporation - Applicants: Bank of America Corporation - Inventors: Rahul Isola; Anthony P. Grossi - Web page: https://patentgrep.com/patent/US10484380B2 ## CPC - H04L 63/101: {Access control lists [ACL]} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/102: {Entity profiles} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04W 12/08: Access security - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A system that includes a switch, a network authentication server (NAS), and a threat management server. The NAS sends a device identifier for an endpoint device to the threat management server in response to the endpoint device connecting to a port on the switch. The threat management server identifies the endpoint device for removal in response to receiving the device identifier. The threat management server determines the number of times the endpoint device has failed authentication exceeds a first threshold value within a first time period. The threat management server blocks the endpoint device from accessing the network via the port on the switch in response to identifying the endpoint device for removal. ## Claims ### Claim 1 An information security system comprising: a switch configured to provide network connectivity for one or more endpoint devices to a network; a network authentication server operably coupled to the switch and configured to: determine an endpoint device is failing authentication in response to the endpoint device connecting to a port on the switch; receive a device identifier for the endpoint device from the switch; and send the device identifier for the endpoint device to a threat management server in response to the endpoint device failing authentication; and the threat management server operably coupled to the switch and the network authentication server comprising: a memory configured to store: a device log file comprising: a first set of device identifiers for endpoint devices that have failed authentication with the network authentication server; and a second set of device identifiers for endpoint devices that have previously passed authentication with the network authentication server; and a threat management engine implemented by a processor configured to: identify the endpoint device for removal in response to receiving the device identifier, comprising: comparing the device identifier to the second set of device identifiers for endpoint devices that have previously passed authentication with the network authentication server; determining the device identifier is present in the second set of device identifiers; determining a number of times that the endpoint device has failed authentication in response to determining that the device identifier is present in the second set of device identifiers; and determining that the number of times the endpoint device has failed authentication exceeds a first threshold value within a first time period; and block the endpoint device from accessing the network via the port on the switch in response to identifying the endpoint device for removal. ### Claim 2 (depends on 1) The system of claim 1, wherein: the memory is configured to store a port lease log file identifying endpoint devices with a lease for ports on the switch; and identifying the endpoint device for removal further comprises determining the endpoint device does not have a lease for the port on the switch. ### Claim 3 (depends on 1) The system of claim 1, wherein: blocking the endpoint device from accessing the network comprises sending a blackhole command to the switch identifying the endpoint device; and the switch is configured to transform the destination of traffic associated with the endpoint device to a null destination in response to receiving the blackhole command. ### Claim 4 (depends on 1) The system of claim 1, wherein: blocking the endpoint device from accessing the network comprises sending a blackhole command to the switch identifying the endpoint device; and the switch is configured to discard traffic associated with the endpoint device in response to receiving the blackhole command. ### Claim 5 (depends on 1) The system of claim 1, wherein: blocking the endpoint device from accessing the network comprises sending a disable command to the switch identifying the endpoint device; and the switch is configured to disable the port the endpoint device is connected to in response to receiving the disable command. ### Claim 6 (depends on 1) The system of claim 1, wherein: the threat management engine is configured to add the endpoint device to a blacklist identifying endpoint devices that are prohibited from accessing the network in response blocking the endpoint device from accessing the network; and adding the endpoint device to the blacklist triggers the network authentication server to automatically fail authentication for the endpoint device when the endpoint device connects to the switch. ### Claim 7 A device configured to implement threat management server, comprising: a memory configured to store: a device log file comprising: a first set of device identifiers for endpoint devices that have failed authentication with a network authentication server; and a second set of device identifiers for endpoint devices that have previously passed authentication with the network authentication server; and a threat management engine implemented by a processor configured to: receive a device identifier for an endpoint device indicating the endpoint device is failing authentication on a port of a switch; identify the endpoint device for removal in response to receiving the device identifier, wherein identifying the endpoint device for removal comprises: comparing the device identifier to the second set of device identifiers for endpoint devices that have previously passed authentication with the network authentication server; determining that the device identifier is present in the second set of device identifiers; determining a number of times that the endpoint device has failed authentication in response to determining that the device identifier is present in the second set of device identifiers; and determining that the number of times the endpoint device has failed authentication exceeds a first threshold value within a first time period; and block the endpoint device from accessing a network via the port on the switch in response to identifying the endpoint device for removal. ### Claim 8 (depends on 7) The device of claim 7, wherein: the memory is configured to store a port lease log file identifying endpoint devices with a lease for ports on the switch; and identifying the endpoint device for removal further comprises determining the endpoint device does not have a lease for the port on the switch. ### Claim 9 (depends on 7) The device of claim 7, wherein: blocking the endpoint device from accessing the network comprises sending a blackhole command to a switch identifying the endpoint device; and the blackhole command triggers the switch to transform the destination of traffic associated with the endpoint device to a null destination in response to receiving the blackhole command. ### Claim 10 (depends on 7) The device of claim 7, wherein: blocking the endpoint device from accessing the network comprises sending a blackhole command to a switch identifying the endpoint device; and the blackhole command triggers the switch to discard traffic associated with the endpoint device in response to receiving the blackhole command. ### Claim 11 (depends on 7) The device of claim 7, wherein: blocking the endpoint device from accessing the network comprises sending a disable command to a switch identifying the endpoint device; and the disable command triggers the switch to disable the port the endpoint device is connected to in response to receiving the disable command. ### Claim 12 (depends on 7) The device of claim 7, wherein: the threat management engine is configured to add the device to a blacklist identifying endpoint devices that are prohibited from accessing the network in response blocking the device from accessing the network; and adding the endpoint device to the blacklist triggers the network authentication server to automatically fail authentication for the endpoint device when the endpoint device connects to the switch. ### Claim 13 An information security method comprising: identifying, by a threat management server, an endpoint device for removal comprising: receiving a device identifier for the endpoint device indicating the endpoint device is failing authentication on a port of a switch; comparing the device identifier to a set of device identifiers for endpoint devices that have previously passes authentication with a network authentication server; determining the device identifier is present in the set of device identifiers; determining a number of times that the endpoint device has failed authentication in response to determining that the device identifier is present in the set of device identifiers; determining that the number of times the endpoint device has failed authentication exceeds a first threshold value within a first time period; and blocking, by the threat management server, the endpoint device from accessing a network via the port of the switch in response to determining that the number of times the endpoint device has failed authentication exceeds the first threshold value within the first time period. ### Claim 14 (depends on 13) The method of claim 13, wherein: blocking the endpoint device from accessing the network comprises sending a blackhole command to a switch identifying the endpoint device; and the blackhole command triggers the switch to transform the destination of traffic associated with the endpoint device to a null destination in response to receiving the blackhole command. ### Claim 15 (depends on 13) The method of claim 13, wherein: blocking the endpoint device from accessing the network comprises sending a blackhole command to a switch identifying the endpoint device; and the blackhole command triggers the switch to discard traffic associated with the endpoint device in response to receiving the blackhole command. ### Claim 16 (depends on 13) The method of claim 13, wherein: blocking the endpoint device from accessing the network comprises sending a disable command to a switch identifying the endpoint device; and the disable command triggers the switch to disable the port the endpoint device is connected to in response to receiving the disable command. ### Claim 17 (depends on 13) The method of claim 13, further comprising adding, by the threat management server, the endpoint device to a blacklist identifying endpoint devices that are prohibited from accessing the network in response blocking the endpoint device from accessing the network, wherein adding the endpoint device to the blacklist triggers the network authentication server to automatically fail authentication for the endpoint device when the endpoint device connects to the switch.