Implementing a host security service by delegating enforcement to a network device

1. A method for applying a host security service to a network, the network including a host device and a network device, the method comprising:

receiving, by the network device, a request for additional security-based filtering from a host device upon detection of a security threat, the request including filtering parameters determined based on the nature of the detected security threat at the host device;

determining, by the network device, whether one or more of the filtering parameters conflict with an initial filtering configuration at the network device;

if a subset of the filtering parameters conflict with the initial filtering configuration, denying the request for the conflicting subset and continuing to process the request for non-conflicting filtering parameters; and

applying, by the network device, the non-conflicting filtering parameters to traffic through the network device.

2. The method of claim 1 , further comprising:

detecting a filtering condition; and

generating an off-load request including one or more filtering parameters that restrict traffic between the network device and a second network device in the network; and

transmitting the off-load request to the second network device.

3. The method of claim 1 , wherein the request for security-based filtering includes an access control list and wherein the request for security-based filtering is generated by the host device upon detection of a security threat.

4. The method of claim 1 , further comprising:

denying the request for security-based filtering if the filtering parameters conflict with the initial filtering configuration; and

transmitting a message indicating the request for security-based filtering is denied.

5. The method of claim 1 , wherein determining whether the filtering parameters conflict with an initial filtering configuration comprises:

determining that the one or more of the filtering parameters are not more restrictive than the initial filtering configuration.

6. The method of claim 1 , further comprising:

upon determining that one or more of the filtering parameters do not conflict, determining whether resources of the network device are available to apply the one or more filtering parameters to traffic through the network device.

7. The method of claim 1 , wherein the host device is coupled to an edge port of the network device.

8. A network device for use in a network, the network including a host device and the network device, the network device comprising: an edge port device configured to receive a request for additional security-based filtering from a host device upon detection of a security threat, the request including filtering parameters determined based on the nature of the detected security threat at the host device; a security engine coupled to the edge port device, wherein the security engine is configured to determine whether one or more of the filtering parameters conflict with an initial filtering configuration at the network device; if a subset of the filtering parameters conflict with the initial filtering configuration, denying the request for the conflicting subset and continuing to process the request for non-conflicting filtering parameters; and

a switch controller coupled to the security engine, wherein the switch controller is configured to filter network packets according to the non-conflicting filtering parameters.

9. The device of claim 8 , wherein the security engine is further configured to: detect a filtering condition; and generate an off-load request including one or more filtering parameters that restrict traffic between the network device and a second network device in the network; and transmit the off-load request to the second network device.

10. The device of claim 8 , wherein the request for security-based filtering includes an access control list, and wherein the request for security-based filtering is generated by the host device upon detection of a security threat.

11. The device of claim 8 , wherein the security engine is further configured to: deny the request for security-based filtering if the filtering parameters conflict with the initial filtering configuration; and transmit a message indicating the request for security-based filtering is denied.

12. The device of claim 8 , wherein the security engine is further configured to determine that the one or more of the filtering parameters are not more restrictive than the initial filtering configuration.

13. The device of claim 8 , wherein the security engine is further configured to determine whether resources of the network device are available to apply the one or more filtering parameters to traffic through the network device, upon determining that one or more of the filtering parameters do not conflict.

14. A method for applying a host security service to a network, the network including a host device and a network device, the method comprising:

detecting, by the host device, a security threat;

determining, by the host device, one or more additional filtering parameters that restrict traffic between the host device and the network device;

generating, by the host device, a request for security-based filtering including the one or more additional filtering parameters; and

transmitting, by the host device the request to the network device;

determining, by the network device, whether the one or more additional filtering parameters conflict with an initial filtering configuration at the network device;

if a subset of the filtering parameters conflict with the initial filtering configuration, denying the request for the conflicting subset and continuing to process the request for non-conflicting filtering parameters;

applying, by the network device, the non-conflicting filtering parameters to traffic through the network device.

15. The method of claim 14 , wherein the request includes an access control list.

16. The method of claim 1 , wherein the host device is a personal computer and the network device is a switch.

17. The device of claim 8 , wherein the host device is a personal computer and the network device is a switch.

18. The method of claim 14 , wherein the host device is a personal computer and the network device is a switch.