# US 8,752,132 B2 · Methods, apparatuses, and systems for the dynamic evaluation and delegation of network access control > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,752,132 B2 - Document ID: US8752132B2 - Status: Granted - Kind: B2 - Application number: 12/901,349 - Filed: 2010-10-08 - Published: 2013-10-17 - Granted: 2014-06-10 - Earliest claimed: 2005-06-29 - Assignees: Intel Corporation - Applicants: Ned M. Smith; Howard C. Herbert; Karanvir Grewal - Inventors: Ned M. Smith; Howard C. Herbert; Karanvir Grewal - Web page: https://patentgrep.com/patent/US8752132B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/105: {Multiple levels of security} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Embodiments of the inventions are generally directed to methods, apparatuses, and systems for the dynamic evaluation and delegation of network access control. In an embodiment, a platform includes a switch to control a network connection and an endpoint enforcement engine coupled with the switch. The endpoint enforcement engine may be capable of dynamically switching among a number of network access control modes responsive to an instruction received from the network connection. ## Claims ### Claim 1 An apparatus comprising: a processor including endpoint enforcement engine circuitry to dynamically switch among a plurality of network access control modes responsive, at least in part, to an instruction received from a network connection to a network, wherein the plurality of network access control modes includes: an access requester mode for operation of the endpoint enforcement engine circuitry to connect the apparatus to the network; and a policy enforcement point mode for operation of the endpoint enforcement engine circuitry to enforce an access policy on a network node coupled to the network. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the endpoint enforcement engine circuitry to dynamically switch among the plurality of network access control modes to expand or retract a boundary of the network. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the plurality of network access control modes further includes a policy decision point mode. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the instruction further comprises at least one of: one or more access control list rules to, at least in part, define a network access control mode; an outbreak containment rule; and an intrusion detection monitoring rule. ### Claim 5 (depends on 1) The apparatus of claim 1, the policy enforcement point mode for the endpoint enforcement engine circuitry to determine whether to grant a host process of the processor access to the network, including the endpoint enforcement engine circuitry to assess an integrity or a capability of the host process. ### Claim 6 (depends on 1) The apparatus of claim 1, wherein the instruction is received by the apparatus via a channel according to the IEEE 802.1x standard. ### Claim 7 A system comprising: a switch to control a network connection to a network; and a processor to couple to the switch, the processor including endpoint enforcement engine circuitry to dynamically switch among a plurality of network access control modes responsive, at least in part, to an instruction received from the network connection, wherein the plurality of network access control modes includes: an access requester mode for operation of the endpoint enforcement engine circuitry to connect the apparatus to the network; and a policy enforcement point mode for operation of the endpoint enforcement engine circuitry to enforce an access policy on a network node coupled to the network. ### Claim 8 (depends on 7) The system of claim 7, wherein the endpoint enforcement engine circuitry to dynamically switch among the plurality of network access control modes to expand or retract a boundary of the network. ### Claim 9 (depends on 7) The system of claim 7, wherein the plurality of network access control modes further includes a policy decision point mode. ### Claim 10 (depends on 7) The system of claim 7, wherein the instruction further comprises at least one of: one or more access control list rules to, at least in part, define a network access control mode; an outbreak containment rule; and an intrusion detection monitoring rule. ### Claim 11 (depends on 7) The system of claim 7, the policy enforcement point mode for the endpoint enforcement engine circuitry to determine whether to grant a host process of the processor access to the network, including the endpoint enforcement engine circuitry to assess an integrity or a capability of the host process. ### Claim 12 (depends on 7) The system of claim 7, wherein the instruction is received by the apparatus via a channel according to the IEEE 802.1x standard. ### Claim 13 A method at a first network node, the method comprising: receiving, at endpoint enforcement engine circuitry of a processor, an indication to change a network access control mode of the endpoint enforcement engine circuitry, wherein the indication is based, at least in part, on integrity measurement data derived from one or more network nodes; and dynamically switching the endpoint enforcement engine circuitry among a plurality of network access control modes responsive, at least in part, to the indication, wherein the plurality of network access control modes includes: an access requester mode for operation of the endpoint enforcement engine circuitry to connect the first network node to the network; and a policy enforcement point mode for operation of the endpoint enforcement engine circuitry to enforce an access policy on a network node coupled to the network. ### Claim 14 (depends on 13) The method of claim 13, wherein the endpoint enforcement engine circuitry to dynamically switch among the plurality of network access control modes to expand or retract a boundary of the network. ### Claim 15 (depends on 13) The method of claim 13, wherein the plurality of network access control modes further includes a policy decision point mode. ### Claim 16 (depends on 13) The method of claim 13, wherein the indication further comprises at least one of: one or more access control list rules to, at least in part, define a network access control mode; an outbreak containment rule; and an intrusion detection monitoring rule. ### Claim 17 (depends on 13) The method of claim 13, the policy enforcement point mode for the endpoint enforcement engine circuitry to determine whether to grant a host process of the processor access to the network, including the endpoint enforcement engine circuitry to assess an integrity or a capability of the host process. ### Claim 18 (depends on 13) The method of claim 13, wherein the indication is received by the apparatus via a channel according to the IEEE 802.1x standard.