Method and network for containing the spread of damage from a network element subject to compromise

A wide area computer network comprising, in combination:

• a) a plurality of local area networks;
• b) said local area networks being mutually addressable over a network infrastructure;
• c) each of said local area networks including a plurality of identifiable network elements, at least one of said network elements being subject to compromise;
• d) at least one local area network including a controller for servicing or denying a service request of at least one network element;
• e) at least one sensor for detecting and identifying at least one possibly compromised network element;
• f) at least one directory for storing identifications of possibly compromised network elements;
• and
• g) said network being arranged so that said at least one directory is addressable by said at least one sensor and accessible to said at least one controller whereby said at least one controller can deny a requested service to a requesting network element that is possibly compromised.

A local area computer network including at least one identifiable network element subject to compromise, said local area network comprising, in combination:

• a) a plurality of network elements;
• b) said network elements being mutually addressable over local area network interconnections;
• c) at least one controller for servicing or denying a service request of at least one network element;
• d) at least one sensor for detecting and identifying at least one possibly compromised network element;
• e) at least one directory for storing identifications of possibly compromised network elements;
• and
• f) said network being arranged so that said at least one directory is addressable by said at least one sensor and accessible to said at least one controller whereby said at least one controller can deny a requested service to a requesting network element that is possibly compromised.

A method for containing the spread of damage within a computer network of the type that includes at least one uniquely identifiable network element subject to compromise, said method comprising the steps of:

• a) sensing a possibly compromised network element;
• then
• b) storing the identification of said possibly compromised network element in a directory accessible to network elements that comprise choke points of said network;
• then
• c) referring to said directory for network element identifications when a service is requested of a network element comprising a choke point of said network;
• and then
• d) denying said requested service when the identification of said requesting network element is present in said directory.