MAC authentication bypass endpoint database access control

1. An information security system, comprising:

a switch comprising a plurality of ports configured to provide network connectivity for one or more endpoint devices to a network; and

a device operably coupled to the switch, comprising:

a memory operable to store:

a device information table comprising MAC addresses of previously authenticated endpoint devices; and

an identity group information table comprising:

a set of device type categories, wherein each device type category is linked with a set of flags that provide device information; and

an access control engine implemented by a processor, configured to:

receive device information for an endpoint device connected to a port of the switch, comprising:

a MAC address for the endpoint device; and

a device type for the endpoint device;

compare the MAC address for the endpoint device to MAC addresses in the device information table;

determine the MAC address for the endpoint device is not present in the device information table based on the comparison;

identify a device type category from the set of device type categories that corresponds with the device type for the endpoint device in response to the determination that the MAC address for the endpoint device is not present in the device information table;

identify one or more flags linked with the identified device type category, wherein the one or more flags comprise:

an infrastructure flag that indicates whether the device type for the endpoint device is an infrastructure device that provides network connectivity to other devices; and

an approval flag that indicates whether the device type for the endpoint device has been pre-approved for connecting to the network; and

set a port status for the port where the endpoint device is connected based on the identified one or more flags.

2. The system of claim 1 , wherein:

identifying the one or more flags comprises identifying the approval flag that indicates the device type of the endpoint device corresponds with an approved device; and

setting the port status for the port comprises setting the port to a pending state that blocks the endpoint device from accessing the network.

3. The system of claim 2 , wherein the access control engine is further configured to generate an entry in the device information table, wherein the entry comprises:

the MAC address for the endpoint device;

the device type for the endpoint device; and

an approval status that indicates the endpoint device is pending approval.

4. The system of claim 1 , wherein:

identifying the one or more flags comprises identifying an unauthorized flag that indicates the device type of the endpoint device corresponds with an unauthorized device;

setting the port status for the port comprises setting the port to a block state that blocks the endpoint device from accessing the network; and

the access control engine is further configured to generate an entry in the device information table, wherein the entry comprises:

the MAC address for the endpoint device;

the device type for the endpoint device; and

an approval status that indicates the endpoint device is an unauthorized device.

5. The system of claim 1 , wherein:

identifying the one or more flags comprises identifying the infrastructure flag that indicates the device type of the endpoint device corresponds with an infrastructure device; and

setting the port status for the port comprises setting the port to a block state that blocks the endpoint device from accessing the network.

6. The system of claim 5 , wherein:

identifying the one or more flags further comprises identifying the approval flag that indicates the device type of the endpoint device corresponds with an approved device; and

the access control engine is further configured to generate an entry in the device information table, wherein the entry comprises:

the MAC address for the endpoint device;

the device type for the endpoint device; and

an approval status that indicates the endpoint device is pending approval.

7. The system of claim 1 , wherein:

identifying the one or more flags comprises identifying the approval flag that indicates the device type of the endpoint device corresponds with a pending approval device; and

setting the port status for the port comprises setting the port to a pending state that blocks the endpoint device from accessing the network.

8. An access control method, comprising:

receiving, by an access control engine implemented by a processor, device information for an endpoint device connected to a port of the switch, comprising:

a MAC address for the endpoint device; and

a device type for the endpoint device;

comparing, by the access control engine, the MAC address for the endpoint device to MAC addresses in a device information table, wherein the device information table comprises MAC addresses of previously authenticated endpoint devices;

determining, by the access control engine, the MAC address for the endpoint device is not present in the device information table based on the comparison;

identifying, by the access control engine, a device type category from a set of device type categories identified in an identity group information table that corresponds with the device type for the endpoint device in response to the determination that the MAC address for the endpoint device is not present in the device information table, wherein the identity group information table comprises the set of device type categories that are each linked with a set of flags that provide device information;

identifying, by the access control engine, one or more flags linked with the identified device type category, wherein the one or more flags comprise:

an infrastructure flag that indicates whether the device type for the endpoint device is an infrastructure device that provides network connectivity to other devices; and

an approval flag that indicates whether the device type for the endpoint device has been pre-approved for connecting to the network; and

setting, by the access control engine, a port status for a port on a switch where the endpoint device is connected based on the identified one or more flags.

9. The method of claim 8 , wherein:

identifying the one or more flags comprises identifying the approval flag that indicates the device type of the endpoint device corresponds with an approved device; and

setting the port status for the port comprises setting the port to a pending state that blocks the endpoint device from accessing the network.

10. The method of claim 9 , further comprising generating, by the access control engine, an entry in the device information table, wherein the entry comprises:

the MAC address for the endpoint device;

the device type for the endpoint device; and

an approval status that indicates the endpoint device is pending approval.

11. The method of claim 8 , wherein:

identifying the one or more flags comprises identifying an unauthorized flag that indicates the device type of the endpoint device corresponds with an unauthorized device;

setting the port status for the port comprises setting the port to a block state that blocks the endpoint device from accessing the network; and

further comprising generating, by the access control engine, an entry in the device information table, wherein the entry comprises:

the MAC address for the endpoint device;

the device type for the endpoint device; and

an approval status that indicates the endpoint device is an unauthorized device.

12. The method of claim 8 , wherein:

identifying the one or more flags comprises identifying the infrastructure flag that indicates the device type of the endpoint device corresponds with an infrastructure device; and

setting the port status for the port comprises setting the port to a block state that blocks the endpoint device from accessing the network.

13. The method of claim 12 , wherein:

identifying the one or more flags further comprises identifying the approval flag that indicates the device type of the endpoint device corresponds with an approved device; and

further comprising generating, by the access control engine, an entry in the device information table, wherein the entry comprises:

the MAC address for the endpoint device;

the device type for the endpoint device; and

an approval status that indicates the endpoint device is pending approval.

14. The method of claim 8 , wherein:

identifying the one or more flags comprises identifying the approval flag that indicates the device type of the endpoint device corresponds with a pending approval device; and

setting the port status for the port comprises setting the port to a pending state that blocks the endpoint device from accessing the network.

15. An information security device, comprising:

a memory operable to store:

a device information table comprising MAC addresses of previously authenticated endpoint devices; and

an identity group information table comprising:

a set of device type categories, wherein each device type category is linked with a set of flags that provide device information; and

an access control engine implemented by a processor, configured to:

receive device information for an endpoint device connected to a port of the switch, comprising:

a MAC address for the endpoint device; and

a device type for the endpoint device;

compare the MAC address for the endpoint device to MAC addresses in the device information table;

determine the MAC address for the endpoint device is not present in the device information table based on the comparison;

identify a device type category from the set of device type categories corresponding with the device type for the endpoint device in response to the determination that the MAC address for the endpoint device is not present in the device information table;

identify one or more flags linked with the identified device type, wherein the one or more flags comprise:

an infrastructure flag that indicates whether the device type for an endpoint device is an infrastructure device that provides network connectivity to other devices; and

an approval flag that indicates whether the device type for the endpoint device has been pre-approved for connecting to the network; and

set a port status for a port on a switch where the endpoint device is connected based on the identified one or more flags.

16. The device of claim 15 , wherein:

identifying the one or more flags comprises identifying the approval flag that indicates the device type of the endpoint device corresponds with an approved device;

setting the port status for the port comprises setting the port to a pending state that blocks the endpoint device from accessing the network; and

the access control engine is further configured to generate an entry in the device information table, wherein the entry comprises:

the MAC address for the endpoint device;

the device type for the endpoint device; and

an approval status that indicates the endpoint device is pending approval.

17. The device of claim 15 , wherein:

identifying the one or more flags comprises identifying an unauthorized flag that indicates the device type of the endpoint device corresponds with an unauthorized device;

setting the port status for the port comprises setting the port to a block state that blocks the endpoint device from accessing the network; and

the access control engine is further configured to generate an entry in the device information table, wherein the entry comprises:

the MAC address for the endpoint device;

the device type for the endpoint device; and

an approval status that indicates the endpoint device is an unauthorized device.

18. The device of claim 15 , wherein:

identifying the one or more flags comprises identifying the infrastructure flag that indicates the device type of the endpoint device corresponds with an infrastructure device; and

setting the port status for the port comprises setting the port to a block state that blocks the endpoint device from accessing the network.

19. The device of claim 18 , wherein:

identifying the one or more flags further comprises identifying approval flag that indicates the device type of the endpoint device corresponds with an approved device; and

the access control engine is further configured to generate an entry in the device information table, wherein the entry comprises:

the MAC address for the endpoint device;

the device type for the endpoint device; and

an approval status that indicates the endpoint device is pending approval.

20. The device of claim 15 , wherein:

identifying the one or more flags comprises identifying the approval flag that indicates the device type of the endpoint device corresponds with a pending approval device; and

setting the port status for the port comprises setting the port to a pending state that blocks the endpoint device from accessing the network.