Network based virus control
View Patent ↗The present application relates to virus control in a network. An illustrative embodiment provides a network including a plurality of processing devices and at least one virus control server configured to quarantine a selected processing device from the network by assigning the selected processing device to a unique quarantine sub-network upon the occurrence of a first quarantine event such that all network traffic to and from the selected device must pass through the virus control server.
1. A virus control server for use in a network including a plurality of processing devices; said virus control server being configured to quarantine a selected processing device from the network by assigning the selected processing device to a quarantine sub network upon the occurrence of a first quarantine event such that all network traffic to and from a selected device assigned to the quarantine sub network is routed through the virus control server for regulation by the server, wherein the first quarantine event includes detecting a virus on the selected device; and wherein the virus control server is further configured to conduct a virus scan on the selected device.
2. The virus control server of claim 1 which is further configured to assign a security policy to the selected device for regulating network traffic between the selected device and one or more devices outside the selected device's quarantine sub network.
3. The virus control server of claim 1 wherein on the occurrence of a first quarantine event the virus control server is configured to assign an IP address and sub network to quarantine the device.
4. The virus control server of claim 3 wherein the virus control server uses DHCP to assign an IP address to the selected device.
5. The virus control server of claim 1 wherein on the occurrence of a second quarantine event the virus control server is configured to release the selected device from its quarantine sub network such that at least some network traffic to and from the selected device bypasses the virus control server.
6. The virus control server of claim 5 wherein the virus control server is configured to reassign an IP address and sub network of the selected device to release the selected device from quarantine.
7. The virus control server of claim 5 wherein the virus control server is configured to release quarantine a selected device upon the occurrence of at least one of the following second quarantine events:
the elapsing of a predetermined quarantine period;
receipt of verification that the selected device is free of viruses.
8. The virus control server of claim 5 wherein the virus control server is configured to communicate with a virus control agent of the selected device to determine the occurrence of a second quarantine event.
9. The virus control server of claim 1 wherein the virus control server is configured to communicate with a virus control agent of the selected device to determine the occurrence of a first quarantine event.
10. This virus control server of claim 5 wherein the virus control server is further configured to place the selected device into a group quarantine sub network, such that network traffic between the selected and a device outside the group quarantine sub network passes through the virus control server, and at least some network traffic between the selected device and a device within the group quarantine sub network bypasses the virus control server, upon the occurrence of a third quarantine event.
11. The virus control server of claim 10 wherein the third quarantine event is selected from one of the following events:
the detection, by the virus control server, of a device type corresponding to the selected device;
the detection, by the virus control server, of an operating system type of the selected device;
the detection, by the virus control server, that the selected device does not have a virus control agent of a predetermined type.
12. A network including a plurality of processing devices and at least one virus control server configured to quarantine a selected processing device from the network by assigning the selected processing device to a unique quarantine sub network upon the occurrence of a first quarantine event such that all network traffic to and from the selected device assigned to the quarantine sub network is routed through the virus control server for regulation by the server, wherein the first quarantine event includes detecting a virus on the selected device; and wherein the virus control server is further configured to conduct a virus scan on the selected device.
13. The network of claim 12 wherein the virus control server is further configured to assign a security policy to the selected device for regulating network traffic between the selected device and devices outside the selected device's quarantine sub network.
14. The network of claim 12 wherein each processing device is connected to the network via an access port, and wherein, on the occurrence of a first quarantine event the virus control server is configured to assign a network address and access port to the selected device to define the device's unique quarantine sub network.
15. The network of claim 14 wherein on the occurrence of a second quarantine event the virus control server is configured to release the selected device from its quarantine sub network such that at least some network traffic to and from the selected device bypasses the virus control server.
16. The network of claim 15 wherein the virus control server is configured to reassign the network address and access port of the selected device to release the selected device from said quarantine sub network.
17. The network of claim 15 wherein the virus control server is configured to release quarantine a selected device upon the occurrence of at least one of the following second quarantine events:
the elapsing of a predetermined quarantine period;
receipt of verification that the selected device is free of viruses.
18. The network of claim 12 wherein the selected device includes a virus control agent configured to communicate a virus control status to the virus control server.
19. The network of claim 12 wherein the selected device includes a virus control agent configured to enable the virus control server to access a file system of the device.
20. The network of claim 12 wherein the virus control server is configured to place the selected device into a group quarantine sub network, such that network traffic between the selected and a device outside the group quarantine sub network passes through the virus control server, and at least some network traffic between the selected device and a device within the group quarantine sub network bypasses the virus control server, upon the occurrence of a third quarantine event.
21. The network of claim 20 wherein, the third quarantine event is any one of the following events:
the detection, by the virus control server, of a device type corresponding to the selected device;
the detection, by the virus control server, of an operating system type of the selected device; and
the detection, by the virus control server, that the selected device does not have a virus control agent of a predetermined type.
22. A method for controlling viruses in a network comprising:
detecting a first quarantine event relating to at least one selected device; and
quarantining the selected device within a unique quarantine sub network of the network; such that all network traffic to and from the selected device is communicated via a virus control server, wherein the first quarantine event includes detecting a virus on the selected device; and
wherein the virus control server is further configured to conduct a virus scan on the selected device.
23. The method of claim 22 wherein the method additionally includes: filtering at least selected network traffic to and from the selected device within the virus control server.
24. The method of claim 23 wherein the method additionally includes: selectively allowing communication between the selected device and the remainder of the network during quarantine of the selected device.
25. The method of claim 22 wherein the method additionally includes:
detecting a second quarantine event relating to the selected device; and
releasing the selected device from its unique quarantine sub network such that at least some network traffic to and from the selected device bypasses the virus control server.
26. The method of claim 25 wherein releasing the selected device from its unique quarantine sub network includes reassigning the network address and a sub network of the selected device to release the selected device from said quarantine sub network.
27. The method of claim 25 wherein the second quarantine event is selected from a list including:
the elapsing of a predetermined quarantine period;
receipt of verification that the selected device is free of viruses.
28. The method of claim 22 wherein the step of quarantining the selected device includes:
assigning a network address and sub network the selected device.
29. The method of claim 22 wherein the first quarantine event is selected from a list including:
a first connection of the selected device to the network;
a reconnection of the selected device to the network;
the detection of a virus on the selected device;
the identification of a virus to which the selected device may be vulnerable.
30. The method of claim 22 wherein third quarantine event is selected from the following:
detecting a type of the selected device;
detecting data representative of an operating system of the selected device; and
detecting data representative of one or more software programs residing on the selected device.
31. The method of claim 22 wherein the method additionally includes scanning at least a portion of a file system of the selected device for viruses.
32. A non-transitory computer program residing on a computer readable medium comprising a set of instructions configured to control the operation of a computing device which is part of a network of devices, to:
detect a first quarantine event relating to at least one selected device; and
quarantine the selected device within a unique quarantine sub network of the network; such that all network traffic to and from the selected device within the quarantine sub network is communicated via a virus control server, wherein the first quarantine event includes detecting a virus on the selected device; and
wherein the virus control server is further configured to conduct a virus scan on the selected device.
33. The computer program of claim 32 wherein the computing device is further caused to filter at least selected network traffic to and from the selected device.
34. The computer program of claim 32 wherein the computing device is further caused to selectively allow communication between the selected device and the remainder of the network during quarantine of the selected device.
35. The computer program of claim 32 wherein the computing device is further caused to:
detect a second quarantine event relating to the selected device; and
release the selected device from its unique quarantine sub network such that at least some network traffic to and from the selected device bypasses the computing device.
36. The computer program of claim 32 wherein the computing device is further caused to:
detect a third quarantine event relating to the selected device; and
reassign the selected device into a group quarantine sub network, such that network traffic between the selected and a device outside the group quarantine sub network passes through the computing device, and at least some network traffic between the selected device and a device within the group quarantine sub network bypasses the computing device, upon the occurrence of a third quarantine event.
37. The computer program of claim 32 wherein the computing device is further caused to scan at least a portion of a file system of the selected device for viruses.