Network access control including dynamic policy enforcement point
AssigneeInfoExpress, Inc.
InventorStacey Lum
Life of this patent
Estimating the term…
Abstract
Systems and methods of securing a computing network are described. Communication from unauthorized devices is prevented by defining one or more dynamic policy enforcement points (DPEPs) on a network segment and specifying one of these DPEPs as an active policy enforcement point (APEP). The APEP prevents communication from unauthorized devices by spoofing an ARP response. If an APEP becomes unavailable, another of the one or more DPEPs is automatically selected as a new APEP. Members of the one or more DPEPs may be non-dedicated devices configured as DPEPs by the addition of security software. The number of DPEPs and APEPs can automatically scale with the number of devices on the computing network.
Claims22
A DPEP comprising:
- a network interface configured to connect to a network segment including one or more other DPEPs;
- logic configured to detect a first device on the network segment;
- logic configured to determine if the first device has passed a security audit;
- logic configured to send an ARP message periodically if the first device has not passed the security audit, the ARP message including a MAC address of a PFC and configured to redirect communication between the first device and a second device on the network segment;
- and
- logic configured to determine if the DPEP or one of the one or more other DPEPs is a current APEP.
A DPEP comprising:
- a network interface configured to connect to a network segment including one or more other DPEPs;
- logic configured to detect a first device on the network segment;
- logic configured to determine if the first device has passed a security audit;
- and
- logic configured to send an ARP message to a second device on the network segment if the first device has not passed the security audit, the ARP message including a MAC address of a PFC and falsely identifying the MAC address of the PFC as the MAC address of the first device.
A DPEP comprising:
- a network interface configured to connect to a network segment including one or more other DPEPs;
- logic configured to detect an ARP request sent by a first device on the network segment and intended for a second device on the network segment;
- logic configured to determine if the first device has passed a security audit;
- and
- logic configured to send an ARP response to the first device in response to the ARP request if the first device has not passed the security audit, the ARP response including a MAC address of a PFC and falsely identifying the MAC address of the PFC as the MAC address of the second device on the network segment.
A method comprising:
- receiving at a first device an ARP request from a second device on a computing network, the ARP request being intended for a third device on the computing network, the first device being a general purpose computing device;
- determining if the second device is authorized to access the third device;
- if the second device is not authorized to access the third device, sending an ARP response from the first device to the second device, the ARP response being configured to falsely indicate to the second device that the first device is the third device such that further communication from the second device to the third device will be directed from the second device to the first device.
A method comprising:
- monitoring the presence of a first APEP on a computing network from one of a plurality of DPEPs;
- determining that the first APEP is no longer available;
- selecting one of the plurality of DPEPs to operate as a new APEP;
- and
- operating the selected one of the plurality of DPEPs as the new APEP.
Dependencies are inferred from the claim text.