Method and system for dynamic security using authentication servers
Disclosed is a method and system for network access control, including an authentication proxy that authenticates different access-points, retrieves data from security databases and from Network Monitoring Systems, processing said data according to a dynamic security policy and using said processing outcome to determine the access level which will be granted to an access point in the network.
1. A data network access security system for regulating access via access points to resources on a data network, said system comprising:
a network security and monitoring system (NSMS) comprising processing circuitry communicatively coupled to the network and configured to monitor access of end systems to the network via one or more access points, wherein an access point is any network device adapted to provide computational devices access to the network; and
a Dynamic Security Authentication Service Server (DSASS) comprising processing circuitry communicatively coupled to the network, the one or more access points, said NSMS and an authentication server external to said DSASS, said DSASS including:
a Dynamic Security Data & Policy Database (DSDPD), which DSDPD includes rules indicating network resource access provisions to be applied to a given device based on: (a) compliance of the given device with specific security policies; (b) security information received from said NSMS and (c) authentication information received from the authentication server
an access policy module adapted to:
(1) receive authentication credentials of a user, from an access point through which the user is attempting to connect to network resources using a first device,
(2) cause the access point to initially grant the first device quarantined access to the network based on (i) data received from the authentication server in relation to the authentication credentials and (ii) compliance data associated with the first device received from said DSDPD;
(3) after the first device has been granted quarantined access, facilitate further compliance testing of the first device via the quarantined access;
(4) determine access to network resources to be granted to the first device based on results of the further compliance testing and the data received from: (i) the authentication server external to said DSASS and (ii) said DSDPD; and
(5) cause the access point to grant the first device the determined access to the network resources.
2. The system according to claim 1 , wherein the access policy module is adapted to receive messages using RADIUS protocol, DIAMETER protocol or TACACS+ protocol.
3. The system according to claim 2 , wherein the access points are selected from the group consisting of: switch, a VPN, a WAP, and a Dial-Up service.
4. The system according to claim 1 , wherein said network security and monitoring system comprises an intrusion prevention system or an intrusion detection system.
5. The system according to claim 1 , wherein the authentication server is selected from the group consisting of: a Remote Authentication Dial in Service (RADIUS) server, a TACACS+ server and a DIAMETER server.
6. The system according to claim 1 , wherein said network security and monitoring system comprises a Network Access Control system.
7. The system according to claim 6 , wherein said DSASS is a Dynamic Security Authentication Service Proxy Server.
8. The system according to claim 1 , wherein said network security and monitoring system is selected from the group consisting of: an intrusion prevention system (IPS) and a Network Access Control (NAC) policy enforcement system.
9. The system according to claim 1 , wherein said quarantined access to the network includes allowing network access to the quarantined device while blocking all access from the quarantined device.
10. A method for regulating access via access points to resources on a data network, said method comprising:
receiving authentication credentials from an access point through which a device is attempting to connect to network resources;
retrieving data from an authentication server;
retrieving data from a Dynamic Security Data & Policy Database (DSDPD), which DSDPD includes rules indicating network resource access provisions to be applied to a given device based on: (1) compliance of the given device with specific security policies and (2) security information said DSDPD retrieves from a network security and monitoring system (NSMS) comprising processing circuitry communicatively coupled to the network and configured to monitor access of end systems to the network via one or more access points;
performing a first processing of the retrieved data from the authentication server and the DSDPD, wherein said first processing is computed according to a dynamic security policy; and
sending a response to the network access point granting the first device quarantined access to the network, based on the processing of the retrieved data;
performing further compliance testing of the first device via the quarantined access;
re-determining access to network resources to be granted to the first device based on results of the further compliance testing and a second processing of the retrieved data from the authentication server and the DSDPD.
11. The method according to claim 10 , further comprising receiving messages using RADIUS protocol, DIAMETER protocol or TACACS+ protocol.
12. The method according to claim 10 , wherein the access point is selected from the group consisting of: a switch, a VPN, a wireless access point, a dial up service.
13. The method according to claim 10 , wherein said network security and monitoring system comprises an intrusion prevention system or an intrusion detection system.
14. The method according to claim 10 , wherein the authentication server is selected from the group consisting of: a Remote Authentication Dial in Service (RADIUS) server, a TACACS+ server and a DIAMETER server.
15. The method according to claim 10 , wherein said network security and monitoring system comprises a Network Access Control (NAC) system.
16. The method according to claim 10 , wherein said network security and monitoring system is selected from the group consisting of: an intrusion prevention system (IPS) and a Network Access Control (NAC) policy enforcement system.
17. The method according to claim 10 , wherein said granting quarantined access to the network includes allowing network access to the quarantined device while blocking all access from the quarantined device.
18. A data network access security system for regulating access via access points to resources on a data network, said system comprising:
a network security and monitoring system (NSMS) comprising processing circuitry communicatively coupled to the network and configured to monitor access of end systems to the network via one or more access points; and
a Dynamic Security Authentication Service Server (DSASS) comprising processing circuitry communicatively coupled to the network, the one or more access points, said NSMS and an authentication server external to said DSASS, said DSASS including:
a Dynamic Security Data & Policy Database (DSDPD), which DSDPD includes rules indicating network resource access provisions to be applied to a given device based on: (a) compliance of the given device with specific security policies; (b) security information received from said NSMS and (c) authentication information received from the authentication server external to said DSASS;
an access policy module adapted to:
(1) receive authentication credentials of a user, from an access point through which the user is attempting to connect to network resources using a first device,
(2) cause the access point to initially grant the first device quarantined access to the network based on data received from: (i) the authentication server external to said DSASS and (ii) said DSDPD;
(3) after the first device has been granted quarantined access, facilitate compliance testing of the first device via the quarantined access;
(4) determine access to network resources to be granted to the first device based on results of the compliance testing and the data received from: (i) the authentication server external to said DSASS and (ii) said DSDPD; and
(5) cause the access point to grant the first device the determined access to the network resources.
19. The system according to claim 18 , wherein said quarantined access to the network includes allowing network access to the quarantined device while blocking all access from the quarantined device.
20. The system according to claim 18 , wherein said DSASS is a Dynamic Security Authentication Service Proxy Server.