Network security system using statistical object identification
Apparatus to enforce network policy based on identity authentication at a network endpoint device by offloading the authentication to a network attached authentication devices is disclosed. The authentication device may use Statistical Object Identification to perform the authentication. The present disclosure greatly reduces the resources needed by the network endpoint device to perform the authentication and eliminates the topological restrictions found in traditional network appliance based approaches.
1. An apparatus for authenticating an identity of network traffic using a network endpoint device ( 10 ), the network endpoint device ( 10 ) having a hardware processor, comprising:
said network endpoint device ( 10 ),
said network endpoint device ( 10 ) including a TCP/IP protocol stack ( 32 ) and an authenticated session table ( 30 ),
said network endpoint device ( 10 ) also for receiving an IP packet ( 12 ),
said IP packet ( 12 ) including a TCP header ( 14 ),
said TCP header ( 14 ) not including a TCP SYN bit ( 16 ),
said authenticated session table ( 30 ) for matching said IP packet ( 12 ) to a session descriptor ( 28 ),
said network endpoint device ( 10 ) also for conveying said IP packet ( 12 ) to said TCP/IP protocol stack ( 32 ); and
an authentication device ( 18 ),
said authentication device ( 18 ) including a network interface ( 49 ) and a peering service ( 24 ),
said peering service ( 24 ) including an identity recognizer ( 25 ) and a first table of policy rules ( 27 ),
said authentication device ( 18 ) for performing authentication,
said authentication device ( 18 ) for creating information to be conveyed to said network endpoint device ( 10 ) and stored in said session descriptor ( 28 ),
said authentication device ( 18 ) using statistical object identification to perform authentication,
said statistical object identification process requiring an exact match of said statistical object being evaluated,
an accumulated statistical object produced by said statistical object identification process,
said statistical object identification process calculating a probability of guessing said accumulated statistical object, and
said statistical object identification process requiring said calculated probability to exceed a threshold.
2. The apparatus as recited in claim 1 , further comprising:
said authentication device ( 18 ) using transport access control to perform authentication.
3. The apparatus as recited in claim 1 , wherein
said network endpoint device ( 10 ) is adapted to receive said IP packet ( 12 ), to select a matching policy rule ( 26 ) that matches some portion of said IP packet ( 12 ) from a second table of policy rules ( 36 ), and to apply said policy rule ( 26 ) to said IP packet ( 12 ).
4. The apparatus as recited in claim 1 , wherein
said network endpoint device ( 10 ) is adapted to receive said IP packet ( 12 ), to select a policy rule ( 26 ) that matches said network interface ( 49 ) information from a second table of policy rules ( 36 ), and to apply said policy rule ( 26 ) to said IP packet ( 12 ).