Granted Patent B1

US 8,095,961 · App. 11/828,846 · Granted Jan 10, 2012

Abstract

Claims (45)

1. A method for quarantining a node from other nodes in a network, the method comprising:

scanning a node to obtain a health posture of the node by determining if the node is compliant with one or more requirements;

obtaining a current policy in accordance with the obtained health posture of the node;

removing a previous policy; and

if the node is determined to be non-compliant:

selecting a key that is unique to the non-compliant node and not selecting a unique key if the node is compliant;

applying the current policy that applies a security protocol;

denying communications with other nodes within a network that do not include the selected unique key; and

allowing communications with other nodes in an exclusion list by not applying the security protocol.

2. The method of claim 1 , wherein the current policy is an unhealthy Internet Protocol Security (IPSec) policy.

3. The method of claim 1 , wherein the current policy comprises authentication information.

4. The method of claim 3 , wherein the authentication information comprises a pre-shared key based authentication.

5. The method of claim 1 , wherein the unique key is selected at random.

6. The method of claim 1 , wherein the unique key is a value unique to the node.

7. The method of claim 6 , wherein the unique key is the unique identification of the node.

8. The method of claim 1 , further comprising removing certificates and private keys from a protocol stack within the node.

9. The method of claim 1 , further comprising applying a second current policy that is different from the current policy if the node is determined to be compliant.

10. The method of claim 9 , further comprising allowing communications with other nodes within a network that include the second current policy.

11. The method of claim 9 , further comprising allowing communications with other nodes that are included within an exclusion list within the second current policy.

12. A computer system that is configured to be quarantined from other computer systems in a network, the computer system comprising:

a processor;

memory in electronic communication with the processor;

instructions stored in the memory, the instructions being executable to:

scan the computer system to obtain a health posture of the computer system by determining if the computer system is compliant with one or more requirements;

obtain a current policy in accordance with the obtained health posture of the computer system;

remove a previous policy; and

if the computer system is determined to be non-compliant:

select a key that is unique to the non-compliant computer system and not selecting a unique key if the computer system is compliant;

apply the current policy that applies a security protocol;

deny communications with other nodes within a network that do not include the selected unique key; and

allow communications with other nodes in an exclusion list by not applying the security protocol.

13. The computer system of claim 12 , wherein the current policy is an unhealthy Internet Protocol Security (IPSec) policy.

14. The computer system of claim 12 , wherein the current policy comprises authentication information.

15. The computer system of claim 14 , wherein the authentication information comprises a pre-shared key based authentication.

16. The computer system of claim 12 , wherein the unique key is selected at random.

17. The computer system of claim 12 , wherein the unique key is a value unique to the computer system.

18. A computer-readable medium comprising executable instructions for quarantining a node from other nodes in a network, the instructions being executable to:

scan the computer system to obtain a health posture of the computer system by determining if the computer system is compliant with one or more requirements;

obtain a current policy in accordance with the obtained health posture of the computer system;

remove a previous policy; and

if the computer system is determined to be non-compliant:

select a key that is unique to the non-compliant computer system and not selecting a unique key if the computer system is compliant;

apply the current policy that applies a security protocol;

deny communications with other nodes within a network that do not include the selected unique key; and

allow communications with other nodes in an exclusion list by not applying the security protocol.

Assignments (29)