Persistent device identifier driven compromised device quarantine

A non-transitory, machine-readable medium having stored thereon program code to:

• collect device identifiers of devices based on the devices connecting to a network;
• maintain mappings of the device identifiers to corresponding network addresses of the devices that connect to the network, wherein the program code to maintain mappings comprises program code to update the mappings to indicate changes in assignments of network addresses to devices;
• set state indicators of whether devices are compromised or not compromised in association with the device identifiers in the mappings;
• propagate, to security devices of the network, changes in mappings based on changes in the network address assignments;
• and
• propagate, from a control plane to a data plane, changes in state indicators and changes in assignments of network addresses.

An apparatus comprising:

• a processor;
• a data plane;
• and
• a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
• determine a plurality of identifiers of a first device connecting to a network via the apparatus, wherein the plurality of identifiers at least includes a first transient identifier that can change across network connections and a first persistent identifier that persists across network connections;
• based on a determination that the first persistent identifier is indicated in a first structure in a control plane, determine whether the first device is indicated as compromised in the first structure and whether the first persistent identifier for the first device is associated in the first structure with a different transient identifier;
• and
• based on a determination that the first persistent identifier is associated with a different transient identifier for the first device in the first structure and that the first device is indicated as compromised in the first structure, update a second structure in the data plane with the first transient identifier, wherein the data plane enforces quarantine of packets with the second structure.