Switch port leasing for access control and information security
A system that includes a switch, a network authentication server (NAS), and a threat management server. The threat management server receives a port lease request for the endpoint device identifying a port and the endpoint device. The threat management server determines whether the endpoint device has previously failed authentication with the NAS. In response to determining the endpoint device has not previously failed authentication, the threat management server selects a first port lease duration when a device identifier for the endpoint device is present in the port lease. The threat management server selected a second port lease duration that is a shorter amount of time than the first port lease duration when the device identifier for the endpoint device is not present in the port lease request. The threat management server activates a port lease for the selected port lease duration.
1. A system comprising:
a switch configured to provide network connectivity to one or more endpoint devices to a network;
a network authentication server operably coupled to the switch and configured to:
determine an endpoint device connected to a port on the switch is failing authentication;
send a device identifier for the endpoint device to a threat management server in response to determining the endpoint device is failing authentication; and
the threat management server operably coupled to the switch and the network authentication server comprising:
a memory configured to store:
a device log file identifying endpoint devices that have failed authentication with the network authentication server; and
a threat management engine implemented by a processor configured to:
receive a port lease request identifying the port and the endpoint device;
determine the endpoint device has not previously failed authentication with the network authentication server in response to receiving the port lease request;
select a port lease duration based at least in part on information provided in the port lease request in response to determining the endpoint device has not previously failed authentication with the network authentication server, comprising:
selecting a first port lease duration when the device identifier is present in the port lease request;
selecting a second port lease duration when the device identifier is not present in the port least request, wherein the second port lease duration is a shorter period of time than the first port lease duration;
activate a port lease on the switch for the endpoint device, wherein the port lease is active for the selected port lease duration.
2. The system of claim 1 , wherein activating the port lease comprises adding the endpoint device to a port lease log file identifying endpoint devices with a lease for a port on the switch.
3. The system of claim 1 , wherein the threat management engine is configured to determine the endpoint device is not present in a black list prior to activating the port lease.
4. The system of claim 1 , wherein:
the port lease request identifies a device type; and
the threat management engine is configured to:
send an information request to the switch requesting a device type for the endpoint device;
receive the device type for the endpoint device in response to sending the information request;
compare the device type for the endpoint device to the device type in the port lease request; and
determine the device type for the endpoint device and the device type in the port lease request are the same prior to activating the port lease.
5. The system of claim 1 , wherein:
the port lease is port independent when the first port lease duration is selected; and
the port lease is machine independent when the second port lease duration is selected.
6. The system of claim 1 , wherein:
the port lease request identifies a vendor identifier; and
the threat management engine is configured to:
send an information request to the switch requesting a vendor identifier for the endpoint device;
receive the vendor identifier for the endpoint device in response to sending the information request;
compare the vendor identifier for the endpoint device to the vendor identifier in the port lease request; and
determine the vendor identifier for the endpoint device and the vendor identifier in the port lease request are the same prior to activating the port lease.
7. The system of claim 1 , wherein:
the threat management engine is configured to:
determine the port lease request comprises the device identifier;
send an information request to the switch requesting a device identifier for the endpoint device in response to determining the port lease request comprises the device identifier;
receive the device identifier for the endpoint device in response to sending the information request;
compare the device identifier for the endpoint device to the device identifier in the port lease request; and
determine the device identifier for the endpoint device and the device identifier in the port lease request are the same prior to activating the port lease.
8. A threat management server comprising:
a memory configured to store:
a device log file identifying endpoint devices that have failed authentication with a network authentication server; and
a threat management engine implemented by a processor configured to:
receive a port lease request identifying the port and an endpoint device;
determine the endpoint device has not previously failed authentication with the network authentication server in response to receiving the port lease request;
select a port lease duration based at least in part on information provided in the port lease request in response to determining the endpoint device has not previously failed authentication with the network authentication server, comprising:
selecting a first port lease duration when the device identifier is present in the port lease request;
selecting a second port lease duration when the device identifier is not present in the port least request, wherein the second port lease duration is a shorter period of time than the first port lease duration;
activate a port lease on the switch for the endpoint device, wherein the port lease is active for the selected port lease duration.
9. The device of claim 8 , wherein activating the port lease comprises adding the endpoint device to a port lease log file identifying endpoint devices with a lease for a port on the switch.
10. The device of claim 8 , wherein the threat management engine is configured to determine the endpoint device is not present in a black list prior to activating the port lease.
11. The device of claim 8 , wherein:
the port lease request identifies a device type; and
the threat management engine is configured to:
send an information request to the switch requesting a device type for the endpoint device;
receive the device type for the endpoint device in response to sending the information request;
compare the device type for the endpoint device to the device type in the port lease request; and
determine the device type for the endpoint device and the device type in the port lease request are the same prior to activating the port lease.
12. The device of claim 8 , wherein:
the port lease is port independent when the first port lease duration is selected; and
the port lease is machine independent when the second port lease duration is selected.
13. The device of claim 8 , wherein:
the port lease request identifies a vendor identifier; and
the threat management engine is configured to:
send an information request to the switch requesting a vendor identifier for the endpoint device;
receive the vendor identifier for the endpoint device in response to sending the information request;
compare the vendor identifier for the endpoint device to the vendor identifier in the port lease request; and
determine the vendor identifier for the endpoint device and the vendor identifier in the port lease request are the same prior to activating the port lease.
14. The device of claim 8 , wherein:
the threat management engine is configured to:
determine the port lease request comprises the device identifier;
send an information request to the switch requesting a device identifier for the endpoint device in response to determining the port lease request comprises the device identifier;
receive the device identifier for the endpoint device in response to sending the information request;
compare the device identifier for the endpoint device to the device identifier in the port lease request; and
determine the device identifier for the endpoint device and the device identifier in the port lease request are the same prior to activating the port lease.
15. A method comprising:
receiving, by a threat management server, a port lease request identifying a port of a switch and an endpoint device;
determining, by the threat management server, the endpoint device has not previously failed authentication with a network authentication server in response to receiving the port lease request, wherein the device log file identifying endpoint devices that have failed authentication with a network authentication server;
selecting, by the threat management server, a port lease duration based at least in part on information provided in the port lease request in response to determining the endpoint device has not previously failed authentication with the network authentication server, comprising:
selecting a first port lease duration when the device identifier is present in the port lease request;
selecting a second port lease duration when the device identifier is not present in the port least request, wherein the second port lease duration is a shorter period of time than the first port lease duration;
activating, by the threat management server, a port lease on the switch for the endpoint device, wherein the port lease is active for the selected port lease duration.
16. The method of claim 15 , further comprising determining, by the threat management server, the endpoint device is not present in a black list prior to activating the port lease.
17. The method of claim 15 , wherein activating the port lease comprises adding the endpoint device to a port lease log file identifying endpoint devices with a lease for a port on the switch.
18. The method of claim 15 , wherein:
the port lease request identifies a device type; and
further comprising:
sending, by the threat management server, an information request to the switch requesting a device type for the endpoint device;
receiving, by the threat management server, the device type for the endpoint device in response to sending the information request;
comparing, by the threat management server, the device type for the endpoint device to the device type in the port lease request; and
determining, by the threat management server, the device type for the endpoint device and the device type in the port lease request are the same prior to activating the port lease.
19. The method of claim 15 , wherein:
the port lease request identifies a vendor identifier; and
further comprising:
sending, by the threat management server, an information request to the switch requesting a vendor identifier for the endpoint device;
receiving, by the threat management server, the vendor identifier for the endpoint device in response to sending the information request;
comparing, by the threat management server, the vendor identifier for the endpoint device to the vendor identifier in the port lease request; and
determining, by the threat management server, the vendor identifier for the endpoint device and the vendor identifier in the port lease request are the same prior to activating the port lease.
20. The method of claim 15 , further comprising:
determining, by the threat management server, the port lease request comprises the device identifier;
sending, by the threat management server, an information request to the switch requesting a device identifier for the endpoint device in response to determining the port lease request comprises the device identifier;
receiving, by the threat management server, the device identifier for the endpoint device in response to sending the information request;
comparing, by the threat management server, the device identifier for the endpoint device to the device identifier in the port lease request; and
determining, by the threat management server, the device identifier for the endpoint device and the device identifier in the port lease request are the same prior to activating the port lease.