Conditional policies

Patent metadata

Field	Value
Publication number	US-10129117-B2
Application number	US-201615045210-A
Country	US
Kind code	B2
Filing date	Feb 16, 2016
Priority date	Jun 5, 2015
Publication date	Nov 13, 2018
Grant date	Nov 13, 2018

Abstract

Conditional policies can be defined that change based on security measurements of network endpoints. In an example embodiment, a network traffic monitoring system can monitor network flows between the endpoints and quantify how secure those endpoints are based on analysis of the network flows and other data. A conditional policy may be created that establishes one or more first connectivity policies for handling a packet when a security measurement of an endpoint is a first value or first range values, and one or more second connectivity policies for handling the packet. The connectivity policies may include permitting connectivity, denying connectivity, redirecting the packet using a specific route, or other network action. When the network traffic monitoring system detects a change to the security measurement of the endpoint, one or more applicable policies can be determined and the system can update policy data for the network to enforce the policies.

First claim

The invention claimed is:

1. A method comprising:
detecting, via a computer having a processor configured to execute computer readable instructions, a change to a security measurement of an endpoint in a network from a first value to a second value, the security measurement of the endpoint represented by a number on a scale, a decimal number from 0-1, a binary result, or multiple values describing different security parameters;
determining, via the computer, one or more policies that are applicable to the endpoint based on the security measurement corresponding to the second value; and
updating, via the computer, policy data for the network to enforce the one or more policies with respect to the endpoint.

2. The method of claim 1 , wherein updating the policy data includes:
updating an endpoint group of the endpoint from a first endpoint group to a second endpoint group,
wherein the one or more policies are applicable to the second endpoint group and not applicable to the first endpoint group.

3. The method of claim 1 , wherein updating the policy data includes:
determining one or more first policies in a policy table that are applicable to the endpoint based on the security measurement corresponding to the first value; and
adding the one or more policies to the policy table,
wherein the one or more policies are prioritized over the one or more first policies based on the one or more policies corresponding to a level of specificity exceeding that of the one or more first policies.

4. The method of claim 1 , wherein updating the policy data includes:
determining one or more first policies in a policy table that are applicable to the endpoint based on the security measurement corresponding to the first value; adding the one or more policies to the policy table of the network; and removing the one or more first policies from the policy table.

5. The method of claim 1 , further comprising:
remediating the endpoint based on network traffic flow between the endpoint and a second endpoint, wherein the one or more policies include a policy that allows the network traffic flow.

6. The method of claim 5 , further comprising:
detecting a second change to the security measurement of the endpoint from the second value to the first value or a third value;
determining one or more second policies that are applicable to the endpoint based on the security measurement corresponding to the first value or the third value; and
updating policy data of the network to enforce the one or more second policies with respect to the endpoint.

7. The method of claim 1 , wherein the one or more policies are whitelist rules, and updating the policy data includes:
determining one or more second policies that are applicable to the endpoint based on the security measurement corresponding to the first value;
removing the one or more second policies from a policy table; and
adding the one or more policies to the policy table to allow a network traffic flow between the endpoint and a second endpoint.

8. The method of claim 1 , wherein the one or more policies are blacklist rules, and updating the policy data includes:
determining one or more second policies that are applicable to the endpoint based on the security measurement corresponding to the first value;
adding the one or more second policies to a policy table; and
removing the one or more policies to deny a network traffic flow between the endpoint and a second endpoint.

9. The method of claim 1 , further comprising:
receiving a packet including a source or a destination corresponding to the endpoint;
determining a network action for the packet based on the one or more policies; and
performing the network action,
wherein the network action is one of forwarding the packet, dropping the packet, logging the packet, marking the packet, selecting a service graph for the packet, redirecting the packet, or copying the packet.

10. The method of claim 1 , wherein the policy data includes a policy table applicable to a first collection of endpoints of the network and not applicable to a second collection of endpoints of the network.

11. The method of claim 1 , wherein the policy data includes a policy table applicable to an entirety of the network.

12. A non-transitory computer-readable medium having computer readable instructions that, when executed by a processor of a computer, cause the computer to:
define a conditional policy for an endpoint in a network, the conditional policy corresponding to at least a first policy for the endpoint having a first value for a security measurement and a second policy for the endpoint having a second value for the security measurement, the security measurement represented by a number on a scale, a decimal number from 0-1, a binary result, or multiple values describing different security parameters;
determine that the security measurement of the endpoint corresponds to the first value;
add the first policy to a policy table of the network; and
enforce the first policy.

13. The non-transitory computer-readable medium of claim 12 , wherein the computer readable instructions further cause the computer to:
update an endpoint group of the endpoint from a first endpoint group to a second endpoint group,
wherein the first policy is applicable to the second endpoint group and not applicable to the first endpoint group.

14. The non-transitory computer-readable medium of claim 12 , wherein,
the policy table includes the second policy, and
the first policy is enforced instead of the second policy based on the first policy corresponding to a level of specificity exceeding that of the second policy.

15. The non-transitory computer-readable medium of claim 12 , wherein the computer readable instructions further cause the computer to:
remove the second policy from the policy table.

16. The non-transitory computer-readable medium of claim 12 , wherein the computer readable instructions further cause the computer to:
modify a state of the endpoint based on network traffic flow between the endpoint and a remediation server,
wherein the first policy allows the network traffic flow between the endpoint and the remediation server.

17. The non-transitory computer-readable medium of claim 16 , wherein the computer readable instructions further cause the computer to:
detect a change to the security measurement of the endpoint from the first value to the second value;
obtain the second policy based on the security measurement corresponding to the first value; and
update the policy table to enforce the second policy with respect to the endpoint.

18. A system comprising:
a processor; and
a memory including instructions that when executed by the processor, cause the system to:
define a policy for an endpoint group in a network corresponding to a first value range for a first security measurement;
detect a second security measurement corresponding to an endpoint not associated with the endpoint group;
determine that the second security measurement is within the first value range; and
assign the endpoint to the endpoint group,

wherein,
the first security measurement and/or the second security measurement is represented by a number on a scale, a decimal number from 0-1, a binary result, or multiple values describing different security parameters.

19. The system of claim 18 , wherein the policy is a whitelist rule, and the instructions further cause the system to:
determine one or more second policies that are applicable to the endpoint based on t

Assignees

• Cisco Tech Inc

Inventors

• Gupta Sunil Kumar
• Yadav Navindra
• Watts Michael Standish
• Parandehgheibi Ali
• Gandham Shashidhar
• Kulshreshtha Ashutosh
• Deen Khawar

Classifications

• G06T11/26

  Drawing of charts or graphs · CPC title

• H04W72/54

  based on quality criteria · CPC title

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L43/10

  Active monitoring, e.g. heartbeat, ping or trace-route · CPC title

• H04L9/0866

  involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics · CPC title