Method, apparatus and network architecture for enforcing security policies using an isolated subnet
View Patent ↗A method for enforcing security policies required to gain access to a network includes determining if a client desiring a connection to the network is in conformance with a current version of the security policies, and if a client is not in conformance with a current version of the security policies, denying the client access to the network and directing the client to an isolated sub-network for accessing a current version of the security policies. In one embodiment of the present invention an address server isolates non-conforming clients from the network and the network resources by directing non-conforming clients to an isolated sub-network. The isolated sub-network further directs the non-conforming clients to, for example, a local server or web-site for accessing a current version of the security policies.
1. A computer program product embodied in a non-transitory computer readable storage medium, the computer program product comprising computer instructions which, when executed by a processor, cause the processor to perform a method for enforcing security policies of a network, the method comprising:
determining if a client desiring a connection to the network is in conformance with a current version of said security policies, wherein said security policies are expressed in an active format adapted to execute on a client and conformance is determined by examining a token sent by the client; and
if a client is not in conformance with the current version of said security policies, restricting client access to said network of a plurality of virtual local area networks (VLANs), by using an extensible authentication protocol (EAP) to authenticate the client as a valid user of only a subset of available virtual local area networks (VLANs) within the network.
2. The computer program product of claim 1 , wherein upon downloading the current version of said security policies, a client generates the token.
3. The computer program product of claim 1 , wherein conforming clients are issued an address to connect to said network.
4. The computer program product of claim 1 , wherein a non-conforming client is directed to said network of a plurality of virtual local area networks by being issued a predetermined address adapted to direct said client to said network of a plurality of virtual local area networks.
5. The computer program product of claim 1 , wherein a non-conforming client is directed to said isolated sub-network by calling a specific number adapted to direct said client onto a predetermined isolated dial-in server.
6. The computer program product of claim 1 , wherein a non-conforming client is directed to said isolated sub-network by a virtual local area network (VLAN) id adapted to direct said client onto a predetermined isolated VLAN.
7. The computer program product of claim 1 , wherein a non-conforming client is directed to said isolated sub-network by a virtual private network (VPN) server address adapted to direct said client onto a predetermined isolated VPN server.
8. The computer program product of claim 7 , wherein said isolated VPN server further implements a set of filtering rules such that only predetermined restricted servers are able to be reached by said non-conforming client.
9. The computer program product of claim 7 , wherein said isolated VPN server comprises a separate physical Ethernet card and said non-conforming client is directed to an Ethernet interface of said Ethernet card.
10. The computer program product of claim 1 , wherein said isolated sub-network isolates a non-conforming client from all network resources.
11. The computer program product of claim 1 , wherein said isolated sub-network directs a non-conforming client to a local server for accessing a current version of said security policies.
12. The computer program product of claim 1 , wherein said isolated sub-network directs a non-conforming client to a web server which directs said non-conforming client to a predetermined web-site for accessing a current version of said security policies.
13. An apparatus for enforcing security policies of a network upon a client requesting a connection to said network, said apparatus comprising a memory for storing information and program instructions and a processor for executing said instructions, said apparatus adapted to perform the steps of:
determining if a client desiring a connection to the network is in conformance with a current version of said security policies, wherein said security policies are expressed in an active format adapted to execute on a client and conformance is determined by examining a token sent by the client; and
if a client is not in conformance with the current version of said security policies, restricting client access to said network of a plurality of virtual local area networks (VLANs), by using an extensible authentication protocol (EAP) to authenticate the client as a valid user of only a subset of available virtual local area networks (VLANs) within the network.
14. The apparatus of claim 13 , wherein said apparatus comprises an address server.
15. The apparatus of claim 13 , wherein said apparatus directs a non-conforming client to said network of a plurality of virtual local area networks by issuing said client a predetermined address adapted to direct said client to said network of a plurality of virtual local area networks.
16. The apparatus of claim 13 , wherein said isolated network makes accessible to non-conforming clients a current version of said security policies.
17. The apparatus of claim 13 , wherein said apparatus issues a conforming client an address for connection with said network.
18. A network architecture for enforcing security policies of a network upon a client requesting a connection to said network, said network architecture comprising:
at least one client adapted to execute, among other applications, security policies that are expressed in an active language;
an isolated sub-network for making accessible to non-conforming clients a current version of said security policies and isolating said non-conforming clients for network resources; and
said network, including;
an address server for controlling the access of said at least one client to said network; and
wherein said address server is adapted to perform the steps of:
determining if a client desiring a connection to said network is in conformance with the current version of said security policies wherein conformance is determined by examining a token sent by the client; and
if a client is not in conformance with the current version of said security policies, restricting client access to said network of a plurality of virtual local area networks (VLANs), by using an extensible authentication protocol (EAP) to authenticate the client as a valid user of only a subset of available virtual local area networks (VLANs) within the network.