Client reputation driven role-based access control

Patent metadata

Field	Value
Publication number	US-9848005-B2
Application number	US-201414445711-A
Country	US
Kind code	B2
Filing date	Jul 29, 2014
Priority date	Jul 29, 2014
Publication date	Dec 19, 2017
Grant date	Dec 19, 2017

Abstract

The present disclosure discloses a system and method for dynamically modifying role based access control for a client based on the activity. Generally, a client device is granted access to a network resource based on a first reputation score assigned to the client device. The activity of the client device is monitored. Responsive to monitoring the activity of the client device, a second reputation score is determined for the client device based on the activity. The access by the client device to the network resource is then modified to be granted based on the second reputation score.

First claim

What is claimed is:

1. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, causes performance of operations comprising:
granting a client device access to network resources of a network in accordance with a first configuration based on a first reputation score assigned to the client device, wherein the first reputation score characterizes a reputation of the client device in the network;
monitoring content of data packets exchanged between the client device and an application during a network session while the client accesses the application;
identifying, from metadata recovered from deep packet inspection of the exchanged data packets in the network, a characteristic of the access of the application by the client device characterizing the application and quantifying a metric of the data packet exchange;
determining, based on the characteristic of the access identified from the metadata, whether the access is permitted based on a comparison of the characteristic of the access of the application to a data structure specifying a plurality of application access permissions assigned to the client device for a plurality of applications;
based on the determination of whether the access of the application by the client device is permitted, modifying the first reputation score to a second reputation score assigned to the client device, wherein the second reputation score characterizes a modified reputation of the client device, and wherein modifying the first reputation score comprises:
increasing the reputation score when the access of the application by the client device is permitted; and
decreasing the first reputation score when the access of the application by the client device is not permitted; and

modifying the access by the client device to the network resources to be granted in accordance with a second configuration based on the second reputation score.

2. The medium of claim 1 , wherein modifying the first reputation score to the second reputation score comprises:
decreasing the first reputation score to obtain a third reputation score based on a first set of actions performed by the client device during a first period of time;
increasing the third reputation score to obtain the second reputation score based on a second set of actions performed by the client device during a second period of time.

3. The medium of claim 1 , wherein modifying the first reputation score is proportional to a weighted value associated with each of the monitored activities.

4. The medium of claim 1 , wherein the operations further comprise distributing the second reputation score for the client device to one or more network devices.

5. The medium of claim 1 , wherein the operations further comprise:
subsequent to modifying the first reputation score to the second reputation score:
storing the second reputation score in association with the client device;
wherein the client device logs out from a network and thereafter logging back into the network;
subsequent to the client device logging back into the network, assigning the client device the second reputation score previously stored in association with the client device.

6. The medium of claim 1 , wherein granting access to the network resources in accordance with the first configuration comprises granting access to a first set of network resources, and wherein granting access to the network resources in accordance with the second configuration comprises granting access to a second set of network resources different than the first set of network resources.

7. The method of claim 1 , wherein granting access to the network resources in accordance with the first configuration comprises granting access using a first bandwidth for the client device, and wherein granting access to the network resources in accordance with the second configuration comprises granting access using a second bandwidth for the client device different than the first bandwidth.

8. The medium of claim 1 , wherein granting access to the network resources in accordance with the first configuration comprises granting access using a first radio frequency band for the client device, and wherein granting access to the network resource in accordance with the second configuration comprises granting access using a second radio frequency band for the client device different than the first radio frequency band.

9. The medium of claim 1 , wherein the operations further comprise monitoring content of data packets exchanged between the client device and the plurality of applications while the client device accesses each of the plurality of applications.

10. The medium of claim 1 , wherein monitoring the content of the data packets exchanged by the client device during the network session comprises monitoring a confidentiality level associated with the content of the data packets.

11. The medium of claim 1 , wherein monitoring the content of the data packets exchanged by the client device during the network session comprises monitoring an electronic mail attachment transmitted by the client device or received by the client device to detect a virus signature contained in the electronic mail attachment.

12. The medium of claim 1 , wherein identifying the characteristic of the access of the application includes identifying a type of the application accessed by the client device, and wherein the type of application comprises at least one of a social networking application, an instant messaging application, a peer-to-peer file sharing application, a video-chatting application, a photo-sharing application, a microblogging application, a video-sharing application, and a video streaming application.

13. The medium of claim 1 , wherein modifying the first reputation score further comprises modifying the first reputation score based on a productivity level of the client device, and modifying the first reputation score based on the productivity level.

14. The medium of claim 1 , wherein monitoring the content of the data packets exchanged by the client device during the network session comprises monitoring data breached by the client device, wherein the data is confidential and sensitive.

15. The medium of claim 1 , wherein monitoring the content of the data packets exchanged by the client device during the network session comprises detecting a denial of service attack originated by the client device.

16. The medium of claim 1 , wherein a rate of change for increasing a reputation score is smaller than a rate of change for decreasing the reputation score.

17. A non-transitory computer readable medium comprising instructions which, when executed by a hardware processor, cause the hardware processor to:
grant a client device access to a plurality of network resources of a network in accordance with a first configuration based on a first reputation score assigned to the client device, wherein the first reputation score characterizes a reputation of the client device in the network;
monitor a plurality of resources accessible by the client device and content of data packets exchanged between the client device and an application during a network session while the client accesses the application;
identifying, from metadata recovered from deep packet inspection of the exchanged data packets in the network, a characteristic of the access of the application by the client device characterizing the application and quantifying a metric of the data packet exchange;
determine, based on the characteristic of the access identified from the m

Assignees

• Aruba Networks Inc

Inventors

• Ardeli Ramesh
• Kurmala Hari Krishna

Classifications

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title