Method and device for determining network device status
View Patent ↗Disclosed is a method of transparently detecting authentication status of endpoint devices in a network. This method may be used for differentiating guest or rogue endpoints from enterprise endpoints.
1. A method for determining network security status of a specific computational device connected to a data network, said method comprising:
monitoring, by a network monitoring device communicatively coupled to the data network, authentication attempt related data traffic between the specific computational device and an authentication server communicatively coupled to the data network;
wherein monitoring consists of sniffing data traffic to which the monitoring device is not a party;
updating, by the network monitoring device, at least one record associated with the specific computational device within a device status data table, based on the monitored authentication attempt related data traffic; and
factoring the at least one record associated with the specific computational device within the device status data table when determining access to network computational resources for the specific computational device.
2. The method according to claim 1 , wherein the record is updated, by the network monitoring device, to indicate that the specific computational device is a guest or a rogue device when authentication response related data traffic from the authentication server indicates a login failure.
3. The method according to claim 1 , wherein the record is updated, by the network monitoring device, to indicate that the specific computational device is a non-guest device when authentication response related data traffic from the authentication server indicates a successful login.
4. A network monitoring device for determining network security status of a specific computational device connected to a data network, said monitoring device comprising:
a network monitoring module including hardware, the network monitoring module being communicatively coupled to the data network and configured to:
(1) monitor authentication attempt related data traffic between the specific computational device and an authentication server communicatively coupled to the data network; wherein monitoring consists of sniffing data traffic to which the monitoring device is not a party; and
(2) update at least one record associated with the specific computational device within a device status data table, based on the monitored authentication attempt related data traffic;
wherein, the at least one record associated with the specific computational device within the device status data table is considered when determining access to network resources for the specific computational device.
5. The device according to claim 4 , wherein the record is updated to indicate that the specific computational device is a guest or a rogue device when authentication response related data traffic from the authentication server indicates a login failure.
6. The device according to claim 4 , wherein the record is updated to indicate that the specific computational device is a non-guest device when authentication response related data traffic from the authentication server indicates a successful login.