Post-connection client certificate authentication

Patent metadata

Field	Value
Publication number	US-10530764-B2
Application number	US-201615383230-A
Country	US
Kind code	B2
Filing date	Dec 19, 2016
Priority date	Dec 19, 2016
Publication date	Jan 7, 2020
Grant date	Jan 7, 2020

Abstract

A network access control (NAC) device detects a connection of an endpoint device at a network switch coupled to a network and restricts access of the endpoint device to prevent the endpoint device from accessing resources of the network. The NAC device establishes a connection with the endpoint device, validates a client certificate corresponding to the endpoint device to authenticate the endpoint device as a corporate device and grants the endpoint device access to the resources of the network.

First claim

What is claimed is:

1. A system comprising:
a memory; and
a processing device operatively coupled to the memory, the processing device to:
detect a connection of an endpoint device at a network switch coupled to a network;
restrict access of the endpoint device to prevent the endpoint device from accessing resources of the network by applying a VLAN assignment to the network switch;
establish a connection with the endpoint device;
validate a client certificate corresponding to the endpoint device to authenticate the endpoint device as a corporate device, wherein to validate the client certificate, the processing device to:
receive the client certificate from the endpoint device, the client certificate comprising a subject name, a client public key and a digital signature of the client public key by a certificate authority;
retrieve a certificate authority certificate from the certificate authority, the certificate authority certificate comprising a certificate public key;
verify the digital signature of the client public key using the certificate authority public key; and
verify the subject name using the client public key; and

grant the endpoint device access to the resources of the network.

2. The system of claim 1 , wherein to establish the connection with the endpoint device, the processing device to receive a communication request from a network access control agent on the endpoint device.

3. The system of claim 1 , wherein to establish the connection with the endpoint device, the processing device to monitor network traffic through the switch and detect a presence of the endpoint device.

4. The system of claim 1 , wherein to grant the endpoint device access to the resources of the network, the processing device to update an access control list for the switch based on characteristics of the endpoint device and access policy considerations of the network.

5. The system of claim 1 , wherein the processing device further to:
not restrict access of the endpoint device to the resources of the network when a network access control device in the network suffers a failure during authentication of the endpoint device.

6. A method comprising:
detecting a connection of a client device to a network;
setting access permissions for the client device to restrict access to resources of the network;
establishing a connection between a network access control device and the client device, wherein establishing the connection between the network access control device and the client device comprises receiving a communication request from a network access control agent on the client device;
authenticating, by a processing device, the client device based on a client security token; and
updating the access permissions to grant the client device access to the resources of the network in response to the authenticating, wherein the security token comprises a client certificate and a client certificate handshake operation comprising:
receiving the client certificate from the client device, the client certificate comprising a subject name, a client public key and a digital signature of the client public key by a certificate authority;
retrieving a certificate authority certificate from the certificate authority, the certificate authority certificate comprising a certificate authority public key;
verifying the digital signature of the client public key using the certificate authority public key; and
verifying the subject name using the client public key.

7. The method of claim 6 , wherein establishing the connection between the network access control device and the client device comprises monitoring network traffic through an access control device in the network and detecting a presence of the client device.

8. The method of claim 6 , further comprising:
not restricting access of the client device to the resources of the network when the network access control device suffers a failure during authentication of the client device.

9. A non-transitory computer readable storage medium storing instructions, which when executed, cause a processing device to:
upon connection of a computing device to a network, prevent the computing device from accessing any resources of the network except a network access control device by applying a virtual firewall to a switch in the network;
establish a connection between the network access control device and the computing device;
determine, by the processing device, whether the computing device is an authorized computing device, wherein to determine whether the computing device is an authorized computing device, the processing device to:
receive a client certificate from the computing device, the client certificate comprising a subject name, a client public key and a digital signature of the client public key by a certificate authority;
retrieve a certificate authority certificate from the certificate authority, the certificate authority certificate comprising a certificate authority public key;
verify the digital signature of the client public key using the certificate authority public key; and
verify the subject name using the client public key; and

when the computing device is an authorized computing device, allow the computing device to access additional resources of the network.

10. The non-transitory computer readable storage medium of claim 9 , wherein to establish the connection between the network access control device and the computing device, the processing device to receive a communication request from a network access control agent on the computing device.

11. The non-transitory computer readable storage medium of claim 9 , wherein to establish the connection between the network access control device and the computing device, the processing device to monitor network traffic through a switch in the network and detect a presence of the computing device.

12. The non-transitory computer readable storage medium of claim 9 , wherein to allow the computing device to access additional resources of the network, the processing device to update an access control list for the switch based on characteristics of the computing device and access policy considerations of the network.

13. The non-transitory computer readable storage medium of claim 9 , wherein instructions further cause the processing device to:
not restrict access of the computing device to the resources of the network when the network access control suffers a failure during authentication of the computing device.

Assignees

• Forescout Tech Inc

Inventors

• Comay Oded
• Mayer Kevin Benjamin
• Nechushtan Oren
• Reisner Tomer

Classifications

• H04L63/0272

  Virtual private networks · CPC title

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title