Method for network security using statistical object identification
Methods to enforce network policy based on identity authentication at a network endpoint device by offloading the authentication to a network attached authentication devices are disclosed. The authentication device may use Statistical Object Identification to perform the authentication. The present invention greatly reduces the resources needed by the network endpoint device to perform the authentication and eliminates the topological restrictions found in traditional network appliance based approaches.
1 . A method comprising the steps of:
providing a network endpoint device ( 10 ), a remote network device ( 11 ), an authentication device ( 18 ) and a network ( 20 );
providing at least one network interface ( 49 ) at said network endpoint device ( 10 );
receiving an IP packet ( 12 ) from said remote network device ( 11 ) by said network endpoint device ( 10 ) using said network interface ( 49 );
said IP packet ( 12 ) including a TCP header ( 14 );
said TCP header ( 14 ) including a TCP SYN bit ( 16 );
conveying said IP packet ( 12 ) to said authentication device ( 18 ) via said network ( 20 );
determining the identity ( 22 ) of said IP packet ( 12 ) at said authentication device ( 18 );
selecting a policy rule ( 26 );
matching said identity ( 22 ) from a first table of policy rules ( 27 );
applying said policy rule ( 26 ) to said IP packet ( 12 ).
2 . A method as recited in claim 1 , in which
conveying context information to said authentication device ( 18 ) along with said IP packet ( 12 ).
3 . A method as recited in claim 1 , in which
conveying said network interface ( 49 ) information to said authentication device ( 18 ) along with said IP packet ( 12 ).
4 . A method as recited in claim 1 , in which
said authentication device ( 18 ) can be used by a plurality of said network endpoint devices ( 10 ) concurrently.
5 . A method as recited in claim 1 , in which
said network endpoint device ( 10 ) does not save context information regarding said IP packet ( 12 );
6 . A method as recited in claim 1 , further comprising the steps of
providing an authenticated session table ( 30 ) and a TCP/IP protocol stack ( 32 ) at said network endpoint device ( 10 );
conveying said IP packet ( 12 ) from said authentication device ( 18 ) to said network endpoint device ( 10 ) via said network ( 20 );
creating a session descriptor ( 28 ) in said authenticated session table ( 30 ); and
conveying said IP packet ( 12 ) to said TCP/IP protocol stack ( 32 ).
7 . A method as recited in claim 6 , further comprising the steps of:
conveying context information and said network interface ( 49 ) information to said network endpoint device ( 10 ) by said authentication device ( 18 ) with said IP packet ( 12 ); and
storing said context information and said network interface information ( 49 ) in said session descriptor ( 28 ).
8 . A method as recited in claim 6 , further comprising the steps of:
conveying authentication processing information to said network endpoint device ( 10 ) with said IP packet ( 12 ); and
storing said authentication processing information in said session descriptor ( 28 ).
9 . A method as recited in claim 1 , further comprising the steps of
conveying a policy rule ( 26 ) to said network endpoint device ( 10 ) from said authentication device ( 18 ) via said network ( 20 ); and
adding said policy rule ( 26 ) to a second table of policy rules ( 36 ) by said network endpoint device ( 10 ).
10 . A method as recited in claim 9 , in which
expiring said policy rule ( 26 ) after a period of time.
11 . A method as recited in claim 9 , in which
said step of adding said policy rule ( 26 ) to said second table of policy rules ( 36 ) is performed by a peer authentication management application ( 44 ).
12 . A method as recited in claim 1 , in which
said authentication device ( 18 ) uses transport access control to perform authentication.
13 . A method as recited in claim 1 , in which
said authentication device ( 18 ) uses statistical object identification to perform authentication.
14 . A method as recited in claim 1 , in which
said authentication device ( 18 ) does not share with said network endpoint device ( 10 ) cryptographic keys necessary to perform said authentication.
15 . A method as recited in claim 1 , in which said step of receiving of said IP packet ( 12 ) by said network endpoint device ( 10 ) further includes the steps of:
selecting a matching policy rule ( 26 ) that matches some portion of said IP packet ( 12 ) from a second table of policy rules ( 36 ); and
applying said policy rule ( 26 ) to said IP packet ( 12 ).
16 . A method as recited in claim 1 , in which said step of receiving of said IP packet ( 12 ) by said network endpoint device ( 10 ) further includes the steps of:
selecting a policy rule ( 26 ) that matches said network interface ( 49 ) information from a second table of policy rules ( 36 ); and
applying said policy rule ( 26 ) to said IP packet ( 12 ).
17 . A method as recited in claim 1 , further including the steps of:
providing a logging device ( 42 );
conveying log information ( 50 ) to said logging device ( 42 ) by said authentication device ( 18 ); and
including TCP/IP session information from said IP packet ( 12 ) and said network interface ( 49 ) said IP packet was received on in said log information ( 50 ).
18 . A method as recited in claim 1 , further including the steps of:
providing a logging device ( 42 );
conveying log information ( 50 ) to said logging device ( 42 ) by said authentication device ( 18 ); and
including said identity ( 22 ) from said IP packet ( 12 ) in said log information ( 50 ).
19 . A method as recited in claim 1 , further comprising the steps of:
providing a logging device ( 42 );
conveying log information ( 50 ) to said logging device ( 42 ) by said authentication device ( 18 ); and
including said policy rule ( 26 ) identity applied to said IP packet ( 12 ) in said log information ( 50 ).
20 . A method as recited in claim 1 , in which
said step of conveying of said IP packet ( 12 ) to said authentication device ( 18 ) is performed by a peer authentication management application ( 44 ).
21 . A method as recited in claim 15 , in which
said network endpoint device ( 10 ), upon receiving said IP Packet ( 12 ) from said remote network device ( 11 ), compares said IP packet ( 12 ) against entries in a second table of policy rules ( 36 );
failing to select a matching policy rule ( 26 ); and
continuing with said determination the identity ( 22 ).
22 . A method comprising the steps of:
providing a TCP/IP protocol stack ( 32 ) and an authenticated session table ( 30 ) at a network endpoint device ( 10 );
receiving an IP packet ( 12 ) by said network endpoint device ( 10 );
said IP packet ( 12 ) including a TCP header ( 14 );
said TCP header ( 14 ) not including a TCP SYN bit ( 16 );
matching said IP packet ( 12 ) to a session descriptor ( 28 ) in said authenticated session table ( 30 ); and
conveying said IP packet ( 12 ) to said TCP/IP protocol stack ( 32 ).
23 . A method as recited in claim 22 , in which
information in said session descriptor ( 28 ) in said authenticated session table ( 30 ) was created by an authentication device ( 18 ); and
said authentication device ( 18 ) using transport access control to perform authentication.
24 . A method as recited in claim 22 , in which
information in said session descriptor ( 28 ) in said authenticated session table ( 30 ) was created by an authentication device ( 18 ); and
said authentication device ( 18 ) using statistical object identification to perform authentication.
25 . A method as recited in claim 22 , in which said step of receiving of said IP packet ( 12 ) by said network endpoint device ( 10 ) further includes the steps of:
selecting a matching policy rule ( 26 ) that matches some portion of said IP packet ( 12 ) from a second table of policy rules ( 36 ); and
applying said policy rule ( 26 ) to said IP packet ( 12 ).
26 . A method as recited in claim 22 , in which said step of receiving of said IP packet ( 12 ) by said network endpoint device ( 10 ) further includes the steps of:
selecting a policy rule ( 26 ) that matches said network interface ( 49 ) information from a second table of policy rules ( 36 ); and
applying said policy rule ( 26 ) to said IP packet ( 12 ).
27 . A method comprising the steps of:
providing a peer authentication driver ( 46 ), a TCP/IP protocol stack ( 32 ), a network device driver ( 48 ), a network interface ( 49 ) and an authenticated session table ( 30 ) at a network endpoint device ( 10 );
said peer authentication driver ( 46 ) receiving an IP packet ( 12 ) from a TCP/IP protocol stack ( 32 );
locating a session descriptor ( 28 ) corresponding to said IP packet ( 12 ) in said authenticated session table ( 30 );
processing said IP packet ( 12 ) in accordance with said session descriptor ( 28 );
sending said IP packet ( 12 ) to said network device driver ( 48 ); and
sending said IP packet ( 12 ) to said network interface ( 49 ).
28 . A method as recited in claim 27 , in which
said session descriptor ( 28 ) in said authenticated session table ( 30 ) was created by an authentication device ( 18 ); and
said authentication device ( 18 ) using transport access control to perform authentication.
29 . A method as recited in claim 27 , in which
said session descriptor ( 28 ) in said authenticated session table ( 30 ) was created by an authentication device ( 18 ); and
said authentication device ( 18 ) using statistical object identification to perform authentication.