The present invention relates to the field of data networks and, more specifically, to methods of protecting network systems from viruses and other malicious applications by enforcing security policies.
Although the universal increase in the implementation of the Internet and local intranets has resulted in many desirable results, such as the speed and breadth with which information is disseminated, it has also enabled many undesirable results. One of the most notable undesirable results associated with the implementation of such networks is the ease of the transmission of computer viruses, worms and other malicious applications. More specifically, before the advent of the Internet and local intranets, users rarely read or copied data onto their computers from unknown external sources. However, users today routinely receive data from unknown computers via e-mail or via download from the world-wide-web using, for example, a web browser. As such, any company or service provider providing network access is concerned with security. In particular, viruses and other malicious applications are a threat that needs to be contained. Most malicious applications exploit known security flaws in popular operating systems, in particular ones that are in widespread use, such as all versions of Microsoft Windows®. They first infect a vulnerable station, and then use this host to initiate communication with the purpose of spreading the infection and/or overloading a network.
Most currently available virus protection software packages focus on identifying and removing viruses from a system. The virus protection programs protect the computer by scanning e-mail and other files for know sections of a virus or worm. Whenever a file is identified as containing a known virus or worm, the user is alerted and the file can be removed or the virus within the file may be removed. Whenever a new virus is identified, new code is written to search for the identifiable features of the new virus. However, these software programs are ineffective against new viruses that have been created after the virus software program was created since the virus protection software will not know what the identifiable features of the new virus are and will thus not find it when it scans the files.
The present invention addresses various deficiencies in the prior art by providing a method, apparatus and system for enforcing the security policies of a network.
In one embodiment of the present invention a method of enforcing the security policies of a network includes determining if a client requesting access to the network is in compliance with a current version of the security policies required to gain access to the network, and if the requesting client is not in compliance with a current version of the security policies required to gain access to the network, denying the client access to the network and making accessible to the client a current version of the security policies. Clients having a current version of the security policies are added to a compliant client list and are subsequently granted access to the network. Upon the update of the security policies, all of the listed clients are removed from the list of compliant clients and are required to download the current, updated version of the security policies before being granted access to the network.
In an alternate embodiment of the present invention, an access gateway for enforcing the security policies of a network on a client requesting access to the network includes a memory for storing information, such as a list of compliant clients, and program instructions and a processor for executing the instructions. The access gateway is adapted to perform the steps of a method of the present invention and, particularly in one embodiment, to perform the steps of determining if a client requesting access to the network is in compliance with a current version of the security policies of the network, and if the client is not in compliance with a current version of the security policies, denying the client access to the network and making accessible to the client a current version of the security policies.
In one embodiment of the present invention, the access gateway maintains a copy of the most current version of the security policies in its memory and makes the security policies available for download by a client having an outdated version of the security policies. In an alternate embodiment of the present invention, the access gateway directs the client to a remote server for downloading a most current version of the security policies of the network. Alternatively, the access gateway directs the client to a predetermined web-site for downloading a most current version of the security policies of the network.
The teachings of the present invention can be readily understood by considering the following detailed description in conjunction with the accompanying drawings, in which:
To facilitate understanding, identical reference numerals have been used, where possible, to designate identical elements that are common to the figures.
Although various embodiments of the present invention are being depicted herein with respect to an IP network, the specific embodiments of the present invention should not be treated as limiting the scope of the invention. It will be appreciated by one skilled in the art and informed by the teachings of the present invention, that the concepts of the present invention may be applied in substantially any network for enforcing security policies.
Although the access gateway 130 of
In the IP network 100 of
The security policies of the present invention may be expressed in substantially any format and specifically in various known formats, such as passive formats (e.g., documents in a memory of a client) or active formats (e.g., script) such that they are capable of being examined by the access gateway 130. For example, in various embodiments of the present invention, security policies are expressed in a scripting language (e.g., JavaScript, VBScript, etc.) which is executed on the client 110. Using a scripting language, reference may be made to the state of the local machine, for example the Windows registry, a version of the operating system installed, installed patches and software, versions of applications installed, services running, network ports open for receiving packets, general configuration and settings, and users logged into the system, to determine if a client is in conformance with the latest security policies.
Referring back to
In various embodiments of the present invention, the latest client software is maintained in a memory of the access gateway 130. As such, if the client 110 does not contain the latest security policies, the access gateway 130 makes available the latest client software and associated security policies to the client 110 for downloading. Once the client 110 has complied with the requirements and downloaded the latest version of the client software, which includes at minimum the latest security policies, the access gateway 130 examines the now compliant client 110 and adds the client 110 to a list of compliant clients maintained in, for example, a memory of the access gateway 130. In alternate embodiments of the present invention, instead of having to examine a client that has downloaded a latest version of client software and associated security policies to add the client to a compliant client list, the access gateway 130 may instead receive a message from, for example, the downloading client or from a source of the client software and associated security policies (i.e., in this embodiment a memory of the access gateway 130, in alternate embodiments described below a remote server or web-site) confirming that the client 110 has downloaded the latest version of the client software to trigger the access gateway 130 to add the client 110 to the list of compliant clients maintained in the access gateway 130. Having been added to the compliant client list, subsequent requests by the client 110 (or other compliant clients) for access to the IP network branch 120 will be granted by the access gateway 130. Although in the embodiment of the invention described above a client software and associated security policies were maintained in a memory of the access gateway 130, in alternate embodiments of the present invention required client software and associated security policies may be stored in a memory outside of the access gateway 130.
In various embodiments of the present invention, the latest version of a client software and associated security policies are loaded into the memory of the access gateway 130 by a user. In such embodiments, when a user inputs an updated client software and associated security policies, the access gateway 130 clears the list of compliant clients and requires each new client requesting access to the IP network branch 120 to download the new client software and security policies as previously described.
In alternate embodiments of the present invention, the access gateway 130 may instead access a remote location such as a remote server or an Internet site (not shown) for attaining a copy of a latest client software and security policies. More specifically, in such embodiments, a remote server or Internet site are adapted to maintain the latest version of a client software, which contains the latest version of security policies required to gain access to the IP network branch 120. In such embodiments, the access gateway 130 may obtain the latest version of the client software and security policies in the form of an ActiveX component, which communicates with the access gateway 130 using, for example, a proprietary channel.
In such embodiments of the present invention, if client software and associated security policies are updated on the remote server or on the Internet site, the access gateway 130 is informed of the update, by for example the remote server or the Internet site or by a user updating the client software and associated security policies, and the access gateway 130 downloads a copy of the latest client software and security policies to a memory of the access gateway 130. In response to the update, the access gateway 130 also clears the list of compliant clients and requires each new client requesting access to the IP network branch 120 to download the new client software and security policies. Alternatively, in such embodiments of the present invention, the access gateway 130 may periodically (i.e., according to a predetermined time interval) monitor the remote server or Internet site for updates to the client software and security policies to ensure that it maintains a copy of the latest version of the client software and security policies for downloading by a client requesting access to an IP network branch 120.
In alternate embodiments of the present invention and referring back to
In such embodiments, downloadable versions of the latest version of the client software and security policies are made available to the client 110 via the remote server or the Internet site. Once the client 110 has complied with the requirements and downloaded the latest version of the client software, which includes at minimum the latest security policies, the access gateway 130 examines the now compliant client 110 and adds the client 110 to a list of compliant clients maintained, for example, in a memory of the access gateway 130. As such, subsequent requests by the client 110 (or other compliant clients) for access to the IP network branch 120 will be granted by the access gateway 130. However and as previously described, in alternate embodiments of the present invention, instead of having to examine a client that has downloaded a latest version of client software and associated security policies to add the client to a compliant client list, the access gateway 130 may instead receive a message confirming that the client 110 has downloaded the latest version of the client software to trigger the access gateway 130 to add the client 110 to the list of compliant clients maintained in the access gateway 130.
As in the previously described embodiments of the present invention, in embodiments of the present invention as described in the directly preceding example, the access gateway is informed of updates to the client software and the security policies via any of the methods described above (i.e., by periodically checking the remote server or the Internet site or by receiving an indication from the remote server or the Internet site). As such, if a client software and associated security policies are updated in the remote server or on the Internet site, the access gateway 130 clears the list of compliant clients and requires each new client requesting access to the IP network branch 120 to download the new client software and security policies.
At step 304, the access gateway determines if the client is in compliance with the latest security policies by, for example, referring to a list of compliant clients. If the access gateway recognizes the requesting client as a client that has already received an updated version of the current security policies, then the method 300 proceeds to step 306. If the access gateway does not recognize the requesting client as a client that has already received an updated version of the current security policies, then the method 300 proceeds to step 308.
At step 306, the access gateway grants the client access to the IP network branch. The method 300 is then exited.
At step 308, the access gateway requires the client to download a current version of the security policies and makes available to the client a current version of a client software and associated security policies. The method 300 then proceeds to step 310.
At step 310, the client downloads the current version of the client software and as such a current version of the security policies and a message is sent to the access gateway to cause the access gateway to record the client as a client that contains a current version of the security policies. Upon downloading of the current version of the client software and as such a current version of the security policies, the client retransmits the previously transmitted request for access to the IP network branch and access to the IP network branch is granted by the access gateway. The method 300 then proceeds to step 312.
At step 312, the access gateway periodically checks a source of the client software and as such the security policies to determine if the current client software and associated security policies have been updated. If the security policies have been updated, the method 300 proceeds to step 314. If the security policies have not been updated, the access gateway continues to periodically check a source of the client software and associated security policies to determine if the current security policies have been updated until another request for access to the network from a client is received by the access gateway. The method 300 then returns to step 302.
In an alternate step 312, the access gateway is informed that the current security policies have been updated. The method 300 then proceeds to step 314.
At step 314, the access gateway clears all previously recorded compliant clients from a list of clients that have current security policies. The method 300 is then exited.
Although various embodiments of the present invention were described above with reference to
While the forgoing is directed to various embodiments of the present invention, other and further embodiments of the invention may be devised without departing from the basic scope thereof. As such, the appropriate scope of the invention is to be determined according to the claims, which follow.