RU2839575C1 - Network access control method and system - Google Patents

Abstract

FIELD: physics.

SUBSTANCE: invention relates to network access control systems. Method includes generating a network certificate for a network host device for accessing a local area network, generating, for a network certificate associated with a network host device, an authorization tag indicating a set of actions that the network host device is allowed to perform in the local area network, and transmitting data indicative of the association between the network certificate and the authorization tag associated with the network host device to the local area network authentication server, as a result of which the authentication server allows the network host device to access the local network and perform a set of actions in it.

EFFECT: enabling detection of security threats associated with authorized electronic devices.

18 cl, 6 dwg

Description

Field of technology to which the invention relates

[0001] The present technology relates to methods and systems for network access control, in particular, to port-based network access control.

State of the art

[0002] Network Access Control (NAC) includes a variety of approaches aimed at ensuring or restricting access of various electronic devices to a network (e.g., a private or corporate network) and its nodes, in particular, preventing unauthorized access of electronic devices or restricting access of electronic devices that violate any network security policies.

[0003] In this regard, some traditional approaches to network access control provide for issuing special digital certificates to authorized electronic devices. Such a certificate ensures mutual authentication between the authorized device and the network nodes, which allows the authorized electronic device to access the network. In other words, such a certificate contains data (1) for the digital identification of the electronic device and (2) for permissions for actions that this electronic device can perform on the network. Such actions include, for example, connecting to a network printer and using it, or accessing an application on one of the network servers and launching it.

[0004] However, in cases where an authorized electronic device violates network security policies, preventing the spread of potential malicious activity on the network by reissuing a digital certificate may be ineffective. For example, if a malware attack on an electronic device causes the antivirus application to stop working, the electronic device may retain access to the network and remain connected to it, continuing malicious activity until a new certificate is received. In another example, a rogue electronic device may steal a digital certificate from an authorized electronic device and act on the network on behalf of that authorized electronic device.

[0005] Detecting such security breaches, reissuing digital certificates, and ensuring that reissued digital certificates are registered on network nodes may be time-consuming and resource-intensive, which may, on the one hand, result in serious damage to data stored on the network and, on the other hand, may result in deterioration in service to users of authorized electronic devices.

[0006] A number of methods have been proposed in the known technical solutions to solve the above technical problem.

[0007] In the patent application US 20180352003 A1 "Network access control with compliance policy check" (Network access control with compliance policy check), published on December 6, 2018 and owned by Opswat Inc, methods are disclosed that involve using an authentication application, a client application, or a network access control server in combination with the authentication application and the client application. The client application collects data on the compliance of the user device with the established requirements and transmits it to the network access control server. Depending on this data, which determines whether the user device complies with the security policy for the server operating on the "software as a service" model, the network access control server generates a compliance check result. If the check result is positive, the authentication application grants access to the user device, and if negative, denies access to this device. In some embodiments, the compliance check result or the user device identifier is stored in a web browser cookie or in a client certificate on the user device.

[0008] US 20180198786 A1, "Associating Layer 2 and Layer 3 sessions for access control," published July 12, 2018, by Pulse Secure LLC, discloses a network access control device that provides access to one or more remote network devices in accordance with one or more policies. A network access control device comprises a processor capable of receiving credential identification data from a user device via a layer 2 connection, including first identification data of the user device, authenticating the user device based on these credential identification data, receiving compliance data from the user device via a layer 3 connection, including second identification data of the user device, associating the layer 2 connection with the layer 3 connection using the first and second identification data, and if the compliance data meets one or more policies, providing the user device with access to one or more remote network devices.

Disclosure of invention

[0009] The aim of the present technology is to eliminate at least one of the disadvantages of known technical solutions.

[0010] The developers of this technology took into account that access control of an authorized electronic device to the network can be implemented without re-issuing certificates.

[0011] In particular, various non-limiting embodiments of the present technology are oriented towards managing permissions for an authorized electronic device in a network using a special authorization tag assigned to a digital certificate. Thus, in accordance with at least some non-limiting embodiments of the present technology, in the event of a security threat, the network access control server is capable of replacing the assigned authorization tag, which allows the authorized electronic device to perform a specified set of actions in the normal operating mode, with a secure mode tag, which allows such an authorized electronic device to perform a limited set of actions and, therefore, prohibits it from performing actions associated with the normal operating mode. The limited set of actions can be defined in such a way that if the authorized electronic device is compromised, it cannot damage the network. This makes it possible to effectively limit the access of suspicious electronic devices to the network, reducing the risks of damage to data stored and transmitted on the network.

[0012] In addition, some non-limiting embodiments of the present methods and systems are oriented towards monitoring individual parameters of an authorized electronic device that indicate a security breach (e.g., disabling an antivirus application or forcibly terminating certain operating system tasks) via various channels. In particular, the network access control server is capable of monitoring these parameters, ensuring (e.g., via a special internal application of the device monitoring manager) the collection of such data by the authorized electronic device and their transmission to the network access control server. In this case, the network access control server is capable of simultaneously collecting this data using external applications of the device monitoring manager that ensure the collection of data from authorized electronic devices independently of them. Thus, in the event of a compromise of an authorized electronic device, as a result of which the data on the device parameters transmitted by the internal application of the device monitoring manager to the network access control server may be falsified, the network access control server can still receive reliable information on the state of this authorized electronic device. This enables more effective detection of security threats associated with authorized electronic devices, thereby strengthening the network's protection against unauthorized access.

[0013] In particular, according to one broad aspect of the present technology, a computer method for controlling port-based network access for a plurality of network host devices in a local area network (LAN) is implemented. The port-based network access control is implemented in accordance with the IEEE 802.1x standard. The local area network comprises (1) a server that hosts a certificate database and (2) an authentication server capable of providing access to the local area network to a plurality of network host devices based on network certificates. The local area network is associated with a network security policy. The method comprises forming a network certificate for access to a local network in a certificate database for a network host device from a plurality of network host devices, forming an authorization tag in the certificate database for the network certificate associated with the network host device, indicating a set of actions that the network host device is permitted to perform in the local network, transmitting data indicating a relationship between the network certificate and the authorization tag associated with the network host device to an authentication server of the local network, as a result of which the authentication server permits the network host device (1) access to the local network and (2) performing a set of actions in it, determining the presence of a security violation associated with the network host device, which includes an indication of a violation by the network host device of the network security policy of the local network, and, if there is a security violation associated with the network host device, replacing the authorization tag of the network certificate of the network host device in the certificate database with a secure mode tag indicating a limited, more a narrower set of actions than that of the authorization tag that the network host device is permitted to perform on the local network until the security breach is resolved, and transmitting data indicating an association between the network certificate and the secure mode tag associated with the network host device to an authentication server of the local network, as a result of which the authentication server (1) prohibits the network host device from performing the set of actions associated with the authorization tag, and (2) permits the network host device to perform only a limited set of actions.

[0014] In some embodiments of the method, a security violation includes an indication of the use of a network certificate associated with a network host device for accessing a local network by another network host device from a plurality of network host devices, and determining the presence of a security violation includes monitoring sessions of each of the plurality of network host devices in the local network for a specified period based on network certificates and detecting an overlap of at least two sessions of using a network certificate associated with a host device for a time exceeding a specified threshold period.

[0015] In some embodiments of the method, a security violation includes an indication of a deviation of the current value of at least one specified parameter from a plurality of specified parameters of the network host device from a specified value, and determining the presence of a security violation involves monitoring the current values of the plurality of specified parameters of the network host device.

[0016] In some embodiments of the method, monitoring includes ensuring that the electronic host device (1) collects current values of a plurality of specified device parameters using an internal device monitoring manager, and (2) transmits current values of a plurality of specified device parameters to a server.

[0017] In some embodiments of the method, the internal device monitoring manager is the internal Osquery device monitoring manager.

[0018] In some embodiments of the method, monitoring includes executing on the server a network application of a device monitoring manager capable of requesting over the local network the current values of a plurality of specified device parameters from at least a portion of a plurality of network host devices, including the given network host device.

[0019] In some embodiments of the method, the network device monitoring manager comprises at least one of the network device monitoring managers SCCM, Jamf, and Salt Manager.

[0020] In some embodiments of the method, monitoring includes ensuring that the electronic host device (1) collects current values of a plurality of specified device parameters using an internal device monitoring manager, and (2) transmits current values of a plurality of specified device parameters to a server, as well as executing on the server a network application of the device monitoring manager capable of requesting current values of a plurality of specified device parameters over a local network from at least a portion of a plurality of network host devices, including this network host device, and the security violation includes an indication of a deviation of the current value of at least one specified parameter of the network host device from a specified value, detected by the internal device monitoring manager and the central device configuration manager of the system.

[0021] In some embodiments of the method, upon detection of the elimination of a security violation, it is additionally provided to replace in the certificate database the secure mode tag of the network certificate of the network host device again with an authorization tag, and to transmit data indicating the relationship between the network certificate and the authorization tag associated with the network host device to the authentication server of the local network, as a result of which the authentication server allows the network host device to perform a set of actions.

[0022] According to another broad aspect of the present technology, a server is implemented for controlling port-based network access for a plurality of network host devices in a local network. The port-based network access control is implemented in accordance with the IEEE 802.1x standard. The local network comprises an authentication server capable of providing access to the local network to a plurality of network host devices based on network certificates. The local network is associated with a network security policy. A certificate database is located on the server. The server comprises at least one processor and at least one physical machine-readable medium storing executable instructions, the execution of which by at least one processor on the server ensures the generation in a certificate database for a network host device from a plurality of network host devices of a network certificate for accessing a local network, the generation in the certificate database for a network certificate associated with the network host device of an authorization tag indicating a set of actions that the network host device is permitted to perform in the local network, the transmission of data indicating a relationship between the network certificate and the authorization tag associated with the network host device to an authentication server of the local network, as a result of which the authentication server permits the network host device to (1) access the local network and (2) perform a set of actions therein, determining the presence of a security violation associated with the network host device, which includes an indication of a violation by the network host device of the network security policy of the local network, in the presence of a security violation associated with by a network host device, replacing in a certificate database an authorization tag of a network certificate of the network host device with a secure mode tag indicating a limited set of actions, narrower than that of the authorization tag, that the network host device is permitted to perform on the local network until the security breach is eliminated, and transmitting data indicating an association between the network certificate and the secure mode tag associated with the network host device to an authentication server of the local network, as a result of which the authentication server (1) prohibits the network host device from performing the set of actions associated with the authorization tag, and (2) permits the network host device to perform only a limited set of actions.

[0023] In some embodiments of the server, a security violation includes an indication of the use of a network certificate associated with a network host device for accessing a local network by another network host device from a plurality of network host devices, and to determine the presence of a security violation, at least one processor ensures that the server monitors sessions of each of the plurality of network host devices in the local network for a specified period based on network certificates and detects an overlap of at least two sessions of using a network certificate associated with the host device for a time exceeding a specified threshold period.

[0024] In some embodiments of the server, a security violation includes an indication of a deviation of the current value of at least one specified parameter from a plurality of specified parameters of the network host device from a specified value, and to determine the presence of a security violation, at least one processor ensures that the server monitors the current values of the plurality of specified parameters of the network host device.

[0025] In some embodiments of a server for monitoring current values of a plurality of specified device parameters, at least one processor ensures that an electronic host device under the control of the server (1) collects current values of a plurality of specified device parameters using an internal device monitoring manager, and (2) transmits current values of a plurality of specified device parameters to the server.

[0026] In some server implementations, the internal device monitoring manager is the Osquery internal device monitoring manager.

[0027] In some embodiments of a server for monitoring current values of a plurality of specified device parameters, at least one processor ensures execution on the server of a network application of a device monitoring manager, capable of requesting current values of a plurality of specified device parameters over a local network from at least a portion of a plurality of network host devices, including the given network host device.

[0028] In some embodiments of the server, the network device monitoring manager comprises at least one of the network device monitoring managers SCCM, Jamf, and Salt Manager.

[0029] In some embodiments of a server for monitoring current values of a plurality of specified device parameters, at least one processor ensures that an electronic host device under the control of the server (1) collects current values of a plurality of specified device parameters using an internal device monitoring manager, and (2) transmits current values of a plurality of specified device parameters to the server, and that a network application of the device monitoring manager is executed on the server, capable of requesting current values of a plurality of specified device parameters over a local network from at least a portion of a plurality of network host devices, including this network host device, and the security violation includes an indication of a deviation of a current value of at least one specified parameter of a network host device from a specified value, detected by the internal device monitoring manager and the central device configuration manager of the system.

[0030] In some embodiments of the server, upon detection of a security breach elimination, at least one processor further ensures that the server replaces in the certificate database the secure mode tag of the network certificate of the network host device again with an authorization tag and transmits data indicating a relationship between the network certificate and the authorization tag associated with the network host device to the authentication server of the local network, as a result of which the authentication server allows the network host device to perform a set of actions.

[0031] In the context of the present description, a "server" is a computer program executed on appropriate hardware and capable of receiving requests over a network (e.g., from client devices) and executing or initiating the execution of these requests. Such hardware may be implemented as a single physical computer or a single physical computer system, which is not essential for the present technology. In this context, when using the expression "server", it is not implied that any particular task or all tasks (e.g., received commands or requests) are received, executed or started on the same server (i.e., by the same software and/or hardware), but it is meant that any number of software or hardware may participate in receiving, transmitting, executing or initiating the execution of any tasks or requests or the results of any tasks or requests, and that all of these software and hardware may represent a single server or several servers, and the expression "at least one server" covers both of these cases.

[0032] In the context of the present description, a "client device" is any computer hardware capable of running software suitable for performing a given task. Thus, non-limiting examples of client devices are personal computers (desktop computers, laptops, netbooks, etc.), smartphones and tablets, as well as network equipment such as routers, switches and gateways. It should be noted that a device acting as a client in this context is not deprived of the ability to act as a server for other client devices. The use of the expression "client device" does not exclude the use of several client devices for receiving, transmitting, performing or initiating the performance of any tasks or requests, the results of any tasks or requests, or the steps of any method described herein.

[0033] In the context of the present description, the term "database" means any structured set of data, regardless of its specific structure, software for managing the database, and computer hardware for storing such data, using them, or otherwise providing for their use. The database may be located in the same hardware where the process providing for the storage or use of information stored in the database is implemented, or in separate hardware, such as a specialized server or a group of servers.

[0034] In the context of the present description, the expression "information" means information of any kind or type capable of being stored in a database. Thus, information includes, among other things, audiovisual works (images, films, sound recordings, presentations, etc.), data (location data, numerical data, etc.), text (reviews, comments, questions, messages, etc.), documents, spreadsheets, word lists, etc.

[0035] In the context of the present description, the expression "component" means software (in the context of specific hardware) necessary and sufficient to perform the specific functions mentioned.

[0036] In the context of the present description, the expression "computer storage medium" is intended to refer to media of any kind and type, including RAM, ROM, disks (CD-ROM, DVD, floppy disks, hard disks, etc.), USB drives, solid state drives, tape drives, etc.

[0037] As used herein, the numerals "first," "second," "third," etc., serve merely to distinguish between the nouns to which they refer, and do not describe any particular relationships between those nouns. Thus, it should be understood that, for example, the terms "first server" and "third server" do not imply the existence of any particular order, type, chronology, hierarchy, or ranking of servers, and the use of these terms (in and of themselves) does not necessarily imply the presence of any "second server" in any particular situation. Furthermore, as used herein in other contexts, references to a "first" element and a "second" element do not exclude the possibility that the two elements may in fact be the same element. For example, in some cases the “first” and “second” servers may represent the same software and/or hardware, and in other cases, different software and/or hardware.

[0038] Each embodiment of the present technology relates to at least one of the above-mentioned objectives and/or to one of the above-mentioned aspects, but not necessarily to all of them. It should be understood that some aspects of the present technology associated with an attempt to achieve the above-mentioned objective may not correspond to this objective and/or may correspond to other objectives not explicitly mentioned herein.

[0039] Additional and/or alternative features, aspects and advantages of embodiments of the present technology are contained in the following description, in the attached drawings and in the claims.

Brief description of the drawings

[0040] For a more complete understanding of the present technology, as well as its aspects and additional features, reference should be made to the following description in conjunction with the accompanying drawings.

[0041] Fig. 1 is a schematic representation of an example of a computer system suitable for implementing certain non-limiting embodiments of systems and/or methods in accordance with the present technology.

[0042] Fig. 2 illustrates a networked computer environment suitable for organizing access control of multiple electronic devices to a local area network based on ports in accordance with certain non-limiting embodiments of the present technology.

[0043] Fig. 3 is a schematic representation of a certificate database located on a server that is part of the network computer environment shown in Fig. 2 and illustrating an example of assigning a secure mode tag to an electronic device from a plurality of electronic devices when the network security policies of a local network are violated, in accordance with some non-limiting embodiments of the present technology.

[0044] Fig. 4 is a time diagram of the operating sessions of two electronic devices that are part of a networked computer environment and that have accessed the local network using the same digital certificate, in accordance with some non-limiting embodiments of the present technology.

[0045] Fig. 5 is a schematic representation of the certificate database of Fig. 3, in which the secure mode tag has been replaced with an authorization tag as a result of a server, which is part of the networked computer environment shown in Fig. 2, detecting that a security breach has been corrected in connection with an electronic device, in accordance with some non-limiting embodiments of the present technology.

[0046] Fig. 6 is a block diagram of a method for controlling access of a plurality of electronic devices to a local area network based on ports, implemented in accordance with some non-limiting embodiments of the present technology.

Implementation of the invention

[0047] The examples and conventional language provided herein are intended to provide a better understanding of the principles of the present technology, and not to limit its scope to such specifically provided examples and conditions. It is obvious that those skilled in the art are able to develop various methods and devices that are not explicitly described or shown, but implement the principles of the present technology within its spirit and scope.

[0048] In addition, to facilitate better understanding, the following description may contain simplified embodiments of the present technology. Those skilled in the art will understand that various embodiments of the present technology may be significantly more complex.

[0049] In some cases, supposedly useful examples of modifications of the present technology are given. They are intended only to facilitate understanding and also do not define the scope or boundaries of the present technology. The presented list of modifications is not exhaustive and a person skilled in the art can develop other modifications within the scope of the present technology. In addition, if in some cases modifications are not described, this does not mean that they are impossible and/or that the description contains the only possible embodiment of a particular element of the present technology.

[0050] The description of the principles, aspects and embodiments of the present technology, as well as specific examples thereof, are intended to cover their structural and functional equivalents, regardless of whether they are currently known or will be developed in the future. For example, those skilled in the art should understand that all block diagrams provided herein correspond to conceptual representations of illustrative circuit diagrams implementing the principles of the present technology. It should also be understood that all block diagrams, process diagrams, state transition diagrams, pseudocodes and the like correspond to various processes that can be represented on a machine-readable physical storage medium and can be executed by a computer or processor, regardless of whether such a computer or processor is shown explicitly or not.

[0051] The functions of the various elements shown in the drawings, including all functional blocks designated as a "processor" or "graphics processor", may be implemented using specialized hardware, as well as hardware capable of supporting the execution of corresponding software. If a processor is used, these functions may be performed by a single dedicated processor, a single shared processor, and/or multiple separate processors, some of which may be used together. In some embodiments of the present technology, the processor may be a general-purpose processor, such as a central processing unit, or a processor dedicated to solving a specific task, such as a graphic processing unit. Furthermore, the explicit use of the term "processor" or "controller" should not be interpreted as indicating exclusively hardware capable of supporting the execution of software, and may mean, among other things, hardware of a digital signal processor (DSP), a network processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), ROM for storing software, RAM, and/or non-volatile memory. Other hardware, general purpose and/or custom, may also be included.

[0052] Software modules or simply modules, the implementation of which is supposed to be based on software, may be represented here in the form of any combination of flow chart elements or other elements indicating the execution of process steps and/or containing a text description. Such modules may be implemented using hardware, shown explicitly or implied.

[0053] Taking into account the above principles, some non-limiting examples are discussed below to illustrate various embodiments of aspects of the present technology.

Computer system

[0054] Fig. 1 shows a computer system 100 suitable for use in some embodiments of the present technology. The computer system 100 includes various hardware elements, including one or more single-core or multi-core processors, collectively represented by a processor 110, a graphics processor 111, a solid-state drive 120, a random access memory (RAM) 130, a display interface 140, and an input/output interface 150.

[0055] Communication between elements of the computer system 100 may be accomplished via one or more internal and/or external buses 160 (such as a PCI bus, a USB bus, an IEEE 1394 FireWire bus, a SCSI bus, a Serial-ATA bus, etc.) to which various hardware elements are electronically connected.

[0056] The input/output interface 150 may be connected to a touch screen 190 and/or to one or more internal and/or external buses 160. The touch screen 190 may be part of a display. In some non-limiting embodiments of the present technology, the touch screen 190 is a display. The touch screen 190 may also be referred to as a screen 190. In the embodiments shown in FIG. 1, the touch screen 190 comprises touch means 194 (for example, touch elements embedded in the display layer and providing registration of physical interaction between the user and the display) and a touch input/output controller 192 providing communication with the display interface 140 and/or with one or more internal and/or external buses 160. In some embodiments, the input/output interface 150 may be connected to a keyboard (not shown), a mouse (not shown), or a touch pad (not shown), which provide user interaction with the computer system 100 in addition to or instead of the touch screen 190.

[0057] It should be noted that in some non-limiting embodiments of the present technology, some elements of the computer system 100 may be missing. For example, the touch screen 190 may be missing, particularly in cases (among other things) where the computer system is implemented as a server.

[0058] According to embodiments of the present technology, the solid-state drive 120 stores software instructions suitable for loading into the RAM 130 and executing by the processor 110 and/or the graphics processor 111. For example, the software instructions may be part of a library or an application.

Networked computing environment

[0059] Fig. 2 is a schematic representation of a networked computing environment 200 suitable for use with certain non-limiting embodiments of systems and/or methods in accordance with the present technology. The networked computing environment 200 comprises a network access control server 202 and an authentication server 212 coupled to a first electronic device 204 and to a second electronic device 205 via a local area network 208.

[0060] In some non-limiting embodiments of the present technology, the first and second electronic devices 204, 205 may be any computer hardware capable of running software suitable for solving the task. In this regard, the first and second electronic devices 204, 205 may comprise some or all of the elements of the computer system 100 shown in Fig. 1. Thus, non-limiting examples of the first and second electronic devices 204, 205 are personal computers (desktop computers, laptops, netbooks, etc.), smartphones and tablets. In addition, it is obvious that in some non-limiting embodiments of the present technology, the first and second electronic devices 204, 205, without departing from the spirit and scope of the present technology, may be associated with a user or a group of users (not separately shown).

[0061] In some non-limiting embodiments of the present technology, the network access control server 202 is implemented as a conventional computer server and may include some or all of the elements of the computer system 100 shown in Fig. 1. In a specific non-limiting example, the network access control server 202 is implemented as a Dell™ PowerEdge™ server running a Microsoft™ Windows Server™ operating system, but it may also be implemented based on any other suitable types of hardware, software and/or firmware, or a combination thereof. In the shown non-limiting embodiments of the present technology, the network access control server 202 is a single server. In other non-limiting embodiments of the present technology (not shown), the functions of the network access control server 202 may be distributed among multiple servers. The authentication server 212 may be implemented similarly to the network access control server 202.

[0062] According to some non-limiting embodiments of the present technology, the local network 208 may be any private or corporate local network that connects a plurality of electronic devices in a limited area. The number of electronic devices that can be connected to the local network 208 is not limited and depends on the number of network and computing resources in this network, such as routers (not shown), switches (not shown), hubs (not shown), bridges (not shown) and servers, including network access control and authentication servers 202, 212. For example, the local network 208 can provide for the connection of tens, hundreds, thousands, or even tens or hundreds of thousands of electronic devices.

[0063] In this case, no restrictions are imposed on the implementation of the communication channel between the first and second electronic devices 204, 205, the network access control and authentication servers 202, 212 and the local network 208. In some non-limiting embodiments of the present technology, such a communication channel may be a wired communication channel. In one example, the wired communication channel may be implemented as a twisted pair with an RJ-45 communication interface. However, other embodiments of the wired communication channel are also possible (for example, a fiber-optic or coaxial cable line), as well as other suitable interfaces for connecting, for example, the first and second electronic devices 204, 205 with the authentication server 212. In other non-limiting embodiments of the present technology, the communication channel may be implemented as a wireless communication channel. Examples of wireless communication protocols that can be used to implement the wireless communication channel include, among others, the Bluetooth ^™ , Zigbee ^™ and NFC ^™ wireless communication protocols. In some non-limiting embodiments of the present technology, the wireless communication channel may be a network wireless communication channel implemented on the basis of the Wi-Fi ^™ wireless communication network protocol, one of the 3G/4G/5G wireless communication network protocols, etc. In such embodiments, (1) the first and second electronic devices 204, 205 and the authentication server 212, (2) the authentication server 212 and the local network 208 and/or (3) the network access control server 202 and the local network 208 may be directly or indirectly (via a proxy server or a VPN (virtual private network)) connected to each other via another network (not shown in Fig. 2), for example, via the Internet. A direct communication channel can also be used between the network access control server 202 and each of the first and second electronic devices 204, 205, bypassing the authentication server 212.

[0064] According to some non-limiting embodiments of the present technology, the local network 208 may be associated with network security policies adopted therein, based on which the network access control server 202 is capable of generating commands and transmitting them to the authentication server 212 to grant or restrict access to the local network 208 to a plurality of electronic devices, such as the first and second electronic devices 204, 205. In this regard, the first and second electronic devices 204, 205 may be referred to as "network host devices". In addition, it should be noted that in some non-limiting embodiments of the present technology, the network access control server 202 and the authentication server 212 may be implemented as a single server capable of determining and implementing network security policies.

[0065] In general, network security policies in the local network 208 establish security standards for electronic devices that can access the local network 208 and remain connected to it. In particular, in some non-limiting embodiments of the present technology, network security policies can establish, among other things, target values of a plurality of specified device parameters that allow each of the first and second electronic devices 204, 205 to access the local network 208 and remain connected to it.

[0066] In various non-limiting embodiments of the present technology, the plurality of specified parameters of the electronic device, such as the first electronic device 204, may include, among other things, (1) the presence of software applications on the first electronic device 204, (2) the name and version of the operating system running on the first electronic device 204, (3) operating system parameters, including, for example, language settings, font sizes and styles, time settings and regional settings, etc., and (4) the presence of processes and services running in the operating system of the first electronic device 204.

[0067] For example, a given device parameter may be the presence of an antivirus application, for which a target binary value, such as "true", is defined in the network security policies, indicating that an antivirus application must be present and/or functioning on each of the first and second electronic devices 204, 205 when accessing the local network 208. In another example, a given device parameter may be a font style in a graphical user interface of an operating system of an electronic device, for which a plurality of target values of a string type are defined in the network security policies, such as "Times New Roman", "Arial" and "Cambria", indicating that at least one of only these font styles must be installed in the operating system of each of the first and second electronic devices 204, 205 when accessing the local network 208.

[0068] In another example, a given device parameter may be the presence of a process or service that has been previously determined to be associated with the execution of an untrusted and/or malicious application. For this given device parameter, a target binary value, such as "false", may be defined in the network security policies, indicating that such a process and/or such a service should not be launched in the operating system of each of the first and second electronic devices 204, 205 when accessing the local network 208. In this regard, in some non-limiting embodiments of the present technology, a blacklist of applications and/or processes and services associated with them that have been determined to be untrusted and/or malicious may be placed on the network access control server 202.

[0069] Thus, the network access control server 202 is capable of (1) providing access to the local network 208 to each of the first and second electronic devices 204, 205, (2) determining for each of the first and second electronic devices 204, 205 the actions that they are allowed to perform in the local network 208, as described below, (3) transmitting data about the first and second electronic devices 204, 205 and the actions they are allowed to the authentication server 212 for the purpose of providing access to each of the first and second electronic devices 204, 205 to the local network 208 in accordance with the network security policies, and (4) monitoring the compliance of each of the first and second electronic devices 204, 205 with the network security policies when they are connected.

[0070] According to some non-limiting embodiments of the present technology, the network access control server 202 is capable of providing or restricting access to the local network 208 for each of the first and second electronic devices 204, 205 by issuing and subsequently transmitting to the authentication server 212 network (digital) certificates for the first and second electronic devices 204, 205.

[0071] In the context of the present description, a digital certificate is an electronic document issued for an electronic device and containing (1) two keys - a public and a private key, (2) identification data of the electronic device, including, for example, the type, brand name, operating system associated with the electronic device, and the affiliation of the electronic device (if applicable), as well as (3) a digital signature of the issuing authority (also called a "certificate authority" (CA)), which has verified the contents of the certificate and approved it with its private key, thereby putting its digital signature. Thus, thanks to the digital certificate, the electronic device is able to encrypt messages sent to the recipient (another electronic device or a server) using the private key, and the public key associated with this electronic device, necessary for decrypting and reading messages, can be provided to the recipient of the messages after checking the digital signature of the issuing authority on the digital certificate.

[0072] In some non-limiting embodiments of the present technology, the issuing authority may be a third party organization that senders (i.e., electronic devices in the above example) and recipients trust to issue, sign, and store digital certificates. In other non-limiting embodiments of the present technology, the issuing authority may be the same authority that operates (or otherwise owns) the network access control server 202 in the local network 208. For example, in some non-limiting embodiments of the present technology, the issuing authority may be Yandex LLC, registered at 119021, Russian Federation, Moscow, Leo Tolstoy St., Bldg. 16.

[0073] In such embodiments, an internal certification authority (not indicated separately) capable of issuing, signing and storing digital certificates may operate on the network access control server 202. In another embodiment, the network access control server 202 may access an external (third-party) certification authority to generate digital certificates.

[0074] In this case, for example, the network access control server 202 is capable of creating (1) the first digital certificate 214 for the first electronic device 204 and (2) the second digital certificate 215 for the second electronic device 205. In addition, the network access control server 202 is capable of transmitting these certificates (1) to the corresponding electronic devices, thereby allowing them to access the local network 208, as well as (2) to the authentication server 212 for subsequent authentication of the first and second electronic devices 204, 205 in the local network 208. There are no restrictions on the format of the digital certificates issued by the network access control server 202. Among other things, such a format is determined by the selected standard for implementing access control to the local network 208.

[0075] In some non-limiting embodiments of the present technology, the network access control server 202 is capable of providing network access control according to the IEEE 802.1x standard (herein, such control is also called port-based network access control), implementing access control of a plurality of electronic devices to the local network 208 at the network and transport layers of the Open Systems Interconnection (OSI) model. Accordingly, in such embodiments, the network access control server 202 is capable of issuing digital certificates in the X.509 format. To ensure the use of digital certificates in the X.509 format, the authentication server 212 is capable of authenticating a plurality of electronic devices in the local network 208 using the EAP-TSL authentication protocols.

[0076] In addition, in some non-limiting embodiments of the present technology, the network access control server 202 may be configured to host (or otherwise provide access to) a certificate database 216 for storing digital certificates. Fig. 3 schematically illustrates the structure of the certificate database 216 in accordance with some non-limiting embodiments of the present technology.

[0077] It is apparent that in some non-limiting embodiments of the present technology, the network access control server 202 is capable of storing each digital certificate in the certificate database 216 in association with the corresponding electronic devices authorized to access the local network 208. For example, the network access control server 202 is capable of storing (1) the identification number of the first electronic device 204 in association with the serial number of the first digital certificate 214 and (2) the identification number of the second electronic device 205 in association with the serial number of the second digital certificate 215. In some non-limiting embodiments of the present technology, the identification number of the electronic device may be generated automatically by the network access control server 202. In some non-limiting embodiments of the present technology, the device identification number may be a proprietary number of the electronic device, such as a MAC address, and the network access control server 202 is capable of obtaining the device identification number from the electronic device itself.

[0078] Furthermore, according to some non-limiting embodiments of the present technology, the network access control server 202 is capable of determining the permitted actions for the electronic device by assigning a special tag to the digital certificate, in particular, a first authorization tag 224 assigned to a first digital certificate 214 issued for the first electronic device 204. In the context of the present description, a “tag” assigned to a digital certificate is an electronic document (separate or part of the digital certificate) that defines permissions for the electronic device in the local network 208. Such permissions in various non-limiting embodiments of the present technology may include, for example, (1) a specified set of actions that the electronic device is permitted to perform in the local network 208, and (2) a list of electronic devices on which the electronic device is permitted to perform the permitted actions. In some non-limiting embodiments of the present technology, the network access control server 202 is capable of transmitting data about the association between the tag and the digital certificate to the authentication server 212 so that the authentication server 212 allows the electronic device to perform a specified set of actions in the local network 208. In some non-limiting embodiments of the present technology, the network access control server 202 is capable of storing tags of all electronic devices authorized in the local network 208 in the certificate database 216.

[0079] Thus, continuing with the example shown in Fig. 3, the network access control server 202 is capable of assigning to the first digital certificate 214 associated with the first electronic device 204, a first authorization tag 224 defining (among other things) the following set of actions that the first electronic device 204 is permitted to perform in the local network 208: (1) reading files on all electronic devices connected to the local network 208, (2) writing a new file to the memory of all electronic devices connected to the local network 208, (3) executing executable files on all electronic devices connected to the local network 208, (4) deleting any files on all electronic devices connected to the local network 208, (5) modifying any files on all electronic devices connected to the local network 208, and (6) taking ownership of any file on all electronic devices connected to the local network 208. The first electronic device 204 may also be permitted to perform other actions. In addition, it should be understood that the first authorization tag 224, allowing the first electronic device 204 to perform the above-mentioned actions on all electronic devices connected to the local network 208, serves only as an example and in some non-limiting embodiments of the present technology, the network access control server 202 is capable of including in the first authorization tag 224 lists of electronic devices for individual actions, which may be the same or may differ.

[0080] In addition, in some non-limiting embodiments of the present technology, the network access control server 202 is capable of transmitting data characterizing the relationship between the digital certificate and the tag assigned to it to the authentication server 212 in order to provide the electronic device having the digital certificate with access to the local network 208 in accordance with the permissions defined in the tag. In this regard, in some non-limiting embodiments of the present technology, a separate database (not shown) can be placed on the authentication server 212 for storing data on the relationships between the issued digital certificates and the tags assigned to them received from the network access control server 202. In other non-limiting embodiments of the present technology, the network access control server 202 is capable of providing access to the certificate database 216 to the authentication server 212 via the local network 208.

[0081] Thus, according to some non-limiting embodiments of the present technology, the first electronic device 204, when attempting to connect to the local network 208, is capable of transmitting to the authentication server 212 a request for access to the local network 208, including the first digital certificate 214. In response to this, the authentication server 212 is capable of (1) verifying the digital signature of the issuing authority on the first digital certificate 214 and (2) in the event of a decision that the issuing authority is a trusted certification authority, such as, for example, the network access control server 202, allowing the first electronic device 204 to access the local network 208. Furthermore, according to some non-limiting embodiments of the present technology, the authentication server 212 is capable of allowing the first electronic device 204 to perform on the local network 208 a given set of actions defined in the first authorization tag 224.

[0082] Also, in accordance with some non-limiting embodiments of the present technology, the network access control server 202 is capable of detecting a security violation associated with the electronic device, that is, detecting a violation by the electronic device of one of the network security policies. In some non-limiting embodiments of the present technology, the network access control server 202 is capable of detecting a security violation by monitoring and/or analyzing the current values of a plurality of specified parameters of the electronic device.

[0083] According to some non-limiting embodiments of the present technology, the network access control server 202 is capable of obtaining current values of a plurality of specified parameters of the electronic device, in particular, the first electronic device 204, in various ways. As shown in Fig. 2, in some non-limiting embodiments of the present technology, the network access control server 202 is capable of obtaining current values of a plurality of specified parameters of the device directly from the first electronic device 204. In this regard, the first electronic device 204 is capable of executing an internal device monitoring manager application 206. In general, the internal device monitoring manager application 206 is a software application capable of collecting and storing various analytical data of the operating system of the first electronic device 204, including the current values of a plurality of specified parameters of this device, and presenting this data, for example, in the form of a relational database. Using the internal application 206 of the device monitoring manager, the first electronic device 204 is capable of transmitting a relational database (or its updates) in response to a request from the network access control server 202. By sending requests for obtaining the relational database, the network access control server 202 is capable of obtaining current values of a plurality of specified parameters of the first electronic device 204. Non-limiting examples of the internal application 206 of the device monitoring manager are the internal applications of the Osquery ^TM , Ossec ^TM and ELK ^TM device monitoring manager.

[0084] In other non-limiting embodiments of the present technology, the network access control server 202 is capable of receiving current values of a plurality of specified device parameters from the network device monitoring manager application 210. In general, the network device monitoring manager application 210 is capable of collecting analytical data from operating systems of a plurality of electronic devices connected to the local network 208, including the first electronic device 204, and doing so independently for each of the plurality of electronic devices. Thus, if the current values of a plurality of specified device parameters collected by the internal device monitoring manager application 206 are falsified before being transmitted to the network access control server 202, for example, as a result of a malware attack, the network access control server 202 is capable of checking the validity of these values based on the data provided by the network device monitoring manager application 210.

[0085] In some non-limiting embodiments of the present technology, the network device monitoring manager application 210 may be executed on the network access control server 202. In other non-limiting embodiments of the present technology, the network device monitoring manager application 210 may be executed on another electronic device that is associated with the local network 208. In such embodiments, the other electronic device may be a third-party server of the manufacturer of the network device monitoring manager application 210 that is granted access to the local network 208. The implementation of the network device monitoring manager application 210 is not limited and generally depends on the operating system running on the plurality of electronic devices to be monitored. For example, among other things, in those non-limiting embodiments of the present technology in which the electronic device is running the Windows ^TM operating system, the network device monitoring manager application 210 may be the SCCM ^TM network device monitoring manager application for monitoring the current values of the plurality of specified parameters of the device. In another non-limiting example, where the electronic device operates under the iOS ^TM or macOS ^TM operating system, the Jamf ^TM device monitoring manager network application can be used as the device monitoring manager network application 210 for monitoring the current values of the plurality of specified device parameters. In another example, where the electronic device operates under the Linux ^TM operating system, the Salt Manager ^TM device monitoring manager network application can be used as the device monitoring manager network application 210 for monitoring the current values of the plurality of specified device parameters. In those non-limiting embodiments of the present technology in which a plurality of electronic devices connected to the local network 208 operate under different operating systems, the network access control server 202 is capable of accessing different versions of the device monitoring manager network application 210, listed above in a non-exhaustive manner.

[0086] In some other non-limiting embodiments of the present technology, the network access control server 202 is capable of receiving current values of a plurality of specified parameters of the first electronic device 204 from both the internal device monitoring manager application 206 and the network device monitoring manager application 210. For example, in such embodiments, the network access control server 202 is capable of verifying data received from the internal device monitoring manager application 206 using data received from the network device monitoring manager application 210.

[0087] In some non-limiting embodiments of the present technology, the network access control server 202 is capable of receiving current values of a plurality of specified parameters of each of the first and second electronic devices 204, 205 continuously in real time. In other non-limiting embodiments of the present technology, the network access control server 202 is capable of receiving such values periodically, such as once per minute, once per twelve hours, once per day, etc.

[0088] For example, by analyzing the current values of a plurality of specified parameters of some electronic device, such as the second electronic device 205, the network access control server 202 is able to detect that one of the applications that must be installed on the second electronic device 205 in accordance with the network security policies of the local network 208, in particular, an antivirus application, has been disabled or removed. In another example, the network access control server 202 is able to detect that a process and/or service has been launched in the operating system of the second electronic device 205, indicating the presence and/or activity of an application that must not be installed and/or executed in accordance with the network security policies, for example, a game application, an additional web browser, or an application determined by the network access control server 202 as untrusted (or malicious).

[0089] In some non-limiting embodiments of the present technology, the network access control server 202 is capable of detecting a security violation by detecting an overlap of operating sessions of at least two electronic devices in the local network 208 that have accessed the local network 208 using the same digital certificate. To this end, in some non-limiting embodiments of the present technology, the network access control server 202 is capable of accessing an access log (not indicated) on the authentication server 212 and thereby analyzing (1) the digital certificate used by the electronic device to access the local network 208 and (2) the duration of the network session during which this electronic device remained connected to the local network 208. In some non-limiting embodiments of the present technology, the network access control server 202 is capable of requesting the access log from the authentication server 212 as needed, for example periodically. In such embodiments, the network access control server 202 is capable of accessing the access log on the authentication server 212 once an hour, once a day, once a week, etc. In other non-limiting embodiments of the present technology, the network access control server 202 is capable of accessing the access log on the authentication server 212 in real time and monitoring the corresponding data continuously.

[0090] Fig. 4 is a time diagram of the operating sessions of two electronic devices that have accessed the local network 208 using the second digital certificate 215, in accordance with some non-limiting embodiments of the present technology.

[0091] From the example shown in Fig. 4, it is evident that the second electronic device 205 gained access to the local network 208 using the second digital certificate 215, as described above, and remained connected to it during the first network session 402. Moreover, while the second electronic device 205 was connected to the local network 208, another, third, electronic device 405 (not shown in Fig. 2) connected to the local network 208, also using the second digital certificate 215, and remained connected to the local network 208 during the second network session 404. The third electronic device 405 could have obtained the second digital certificate 215, for example, as a result of a malicious attack on the second electronic device 205.

[0092] Thus, by analyzing the access log on the authentication server 212, the network access control server 202 is able to detect an overlap 406 of network sessions between the first network session 402 of the second electronic device 205 and the second network session 404 of the third electronic device 405, thereby detecting a security violation. In some non-limiting embodiments of the present technology, the network access control server 202 is able to detect a security violation if the duration of the overlap 406 of network sessions exceeds a specified time threshold, such as 1, 5, or 10 minutes.

[0093] Other examples of violation of network security policies include accessing the local network 208 using an expired digital certificate, attempting to perform actions that are not included in the specified set of actions defined for the electronic device in the authorization tag, discrepancies between data received from the internal device monitoring manager application 206 and data received from the network device monitoring manager application 210, etc.

[0094] Thus, upon detection of a security breach associated with, for example, the second electronic device 205, the network access control server 202 is capable of restricting access of the second electronic device 205 to the network. As shown in Fig. 3, in accordance with some non-limiting embodiments of the present technology, the network access control server 202 is capable of restricting access of the second electronic device 205 by assigning a secure mode tag 225 to the second digital certificate 215 associated therewith instead of a previously assigned authorization tag, such as the second authorization tag 525 shown in Fig. 5. In some non-limiting embodiments of the present technology, the second authorization tag 525 of the second digital certificate 215 may be similar to the first authorization tag 224 assigned to the first electronic device 204, that is, it may define the same set of actions that are permitted to be performed in the local network 208 by the second electronic device 205 with respect to the same list of electronic devices. In other non-limiting embodiments of the present technology, the second authorization tag 525 may define a set of actions and/or a list of electronic devices that are different from those defined by the first authorization tag 224.

[0095] According to some non-limiting embodiments of the present technology, the secure mode tag 225 may define a limited set of actions that is narrower than the specified set of actions defined by the second authorization tag 525, such as only reading or executing executable files on electronic devices connected to the local network 208. In other non-limiting embodiments of the present technology, the secure mode tag 225 may define a limited list of electronic devices on which the electronic device having the second digital certificate 215 is allowed to perform permitted actions. For example, electronic devices included in the limited list of electronic devices may be associated with a lower risk of compromising other electronic devices in the local network 208. An electronic device from the limited list of electronic devices may be selected by determining by the network access control server 202 or external (including third-party) software, including the network application 210 of the device monitoring manager, the second authorization tag 525 of the second digital certificate 215 associated with the selected device. In particular, the selected electronic device may be associated with unique identification data of the hardware, additionally stored in the certificate database 216, on the basis of which the network access control server 202 assigns the secure mode tag 225. In some other non-limiting embodiments of the present technology, the secure mode tag 225 may define both a limited set of actions that the electronic device having the second digital certificate 215 is allowed to perform and a limited list of electronic devices on which the electronic devices having the second digital certificate 215 are allowed to perform the limited set of actions. In some other non-limiting embodiments of the present technology, the secure mode tag 225 of the second digital certificate may include an indication of a complete ban on access of the electronic device having the second digital certificate 215 to the local network 208.

[0096] In addition, after the network access control server 202 replaces the second authorization tag 525 of the second digital certificate 215 in the certificate database 216 with the secure mode tag 225, the network access control server 202 is capable of transmitting to the authentication server 212 data characterizing the relationship between the second digital certificate 215 and the secure mode tag 225, which may include an update of the certificate database 216. After receiving data on the connection between the second digital certificate 215 and the secure mode tag 225, the authentication server 212, in turn, in response to a request for access to the local network 208 from the electronic device having the second digital certificate 215 (such as the second electronic device 205), is able to provide such access to the second electronic device 205 in accordance with the permissions defined in the secure mode tag 225, namely (1) to allow the second electronic device 205 to perform a limited set of actions and/or (2) to allow the second electronic device 205 to perform permissible actions on electronic devices of the local network 208 from a limited list.

[0097] Furthermore, according to some non-limiting embodiments of the present technology, upon detection that the violation associated with the second electronic device 205 has been resolved, such as by monitoring a plurality of specified parameters of the first and second electronic devices 204, 205, the network access control server 202 is configured to (1) remove the secure mode tag 225 from the second digital certificate 215 in the certificate database 216 and (2) reassign the second authorization tag 525 to this certificate, as schematically illustrated in Fig. 5. Thus, the network access control server 202 is configured to permit electronic devices having the second digital certificate 215, such as the second electronic device 205, to perform on the local network 208 the original set of actions that were permitted prior to the violation of the network security policies by the second electronic device 205.

[0098] For example, if the network access control server 202 has assigned the secure mode tag 225 to the second digital certificate 215 after detecting that the antivirus application on the second electronic device 205 has been disabled, then upon detecting that the antivirus application on the second electronic device 205 has been resumed, the network access control server 202 is able to again replace the secure mode tag 225 of the second digital certificate 215 in the certificate database 216 with the second authorization tag 525.

[0099] In addition, after receiving the data on the relationship between the second digital certificate 215 and the second authorization tag 525, the authentication server 212 is capable of allowing the second electronic device 205, based on the second digital certificate 215, (1) access to the local network 208 and (2) performing a specified set of actions on electronic devices from a specified list according to the second authorization tag 525.

Way

[0100] Taking into account the above-described architecture and the given examples, it is possible to implement a method for controlling access to a network based on ports for a plurality of electronic devices in a local network, in particular, for the first and second electronic devices 204, 205 in the local network 208. Fig. 6 shows a block diagram of a method 600 in accordance with non-limiting embodiments of the present technology. The method 600 can be implemented by a network access control server 202 with elements of a computer system 100.

Step 602: Generating a network certificate for accessing the local network in the certificate database for a network host device from among the plurality of network host devices.

[0101] The method 600 begins with step 602, in which the network access control server 202 is capable of issuing first and second digital certificates 214, 215 for the first and second electronic devices 204, 205, respectively, as described in detail above with reference to Figs. 2 and 3. As indicated above, the network access control server 202 is capable of storing the first and second digital certificates 214, 215 in the certificate database 216 with a link to the identification numbers of the first and second electronic devices 204, 205.

[0102] According to some non-limiting embodiments of the present technology, a digital certificate generated for the first electronic device 204, such as the first digital certificate 214, allows the authentication server 212 to verify messages (in particular, requests for access to the local network 208) transmitted to it by the first electronic device 204, and based on this, to permit access of the first electronic device 204 to the local network 208.

[0103] As noted above, in some non-limiting embodiments of the present technology in which the network access control server 202 is capable of controlling network access according to the IEEE 802.1x standard, the first and second digital certificates 214, 215 may be in X.509 format.

[0104] The next step in method 600 is step 604.

Step 604: Generate in the certificate database for the network certificate associated with the network host device an authorization tag that specifies the set of actions that the network host device is authorized to perform on the local network.

[0105] In step 604, according to some non-limiting embodiments of the present technology, the network access control server 202 is capable of creating authorization tags for the first and second digital certificates 214, 215 in the certificate database 216, in particular, the first and second authorization tags 224, 525. As noted above with reference to Fig. 3, an authorization tag, for example, the first authorization tag 224, assigned to the first digital certificate 214, defines (1) a given set of actions that the first electronic device 204 is allowed to perform in the local network 208, and (2) a list of electronic devices on which the first electronic device 204 is allowed to perform this given set of actions.

[0106] The next step in method 600 is step 606.

Step 606: transmitting data indicating a relationship between a network certificate and an authorization tag associated with a network host device to an authentication server of the local network, whereby the authentication server permits the network host device to (1) access the local network and (2) perform a set of actions on the local network.

[0107] At step 606, in some non-limiting embodiments of the present technology, the network access control server 202 is configured to transmit data about a relationship, for example, between the first authorization tag 224 and the first digital certificate 214, to the authentication server 212 so that the authentication server 212 allows the first electronic device 204 to perform in the local network 208 a specified set of actions on the electronic devices from the list defined in the first authorization tag 224.

[0108] The next step in method 600 is step 608.

Step 608: Determine whether there is a security violation associated with the network host device, which includes an indication that the network host device has violated the local network security policy.

[0109] At step 608, according to some non-limiting embodiments of the present technology, the network access control server 202 is capable of detecting a security violation associated with any of the first and second electronic devices 204, 205. In other words, at this step, the network access control server 202 is capable of detecting a violation by at least one of the first and second electronic devices 204, 205 of one or more network security policies of the local network 208.

[0110] To this end, in some non-limiting embodiments of the present technology, the network access control server 202 is configured to detect a deviation of one or more current values of a plurality of specified parameters of at least one of the first and second electronic devices 204, 205 from target values defined in network security policies, as described above with reference to Fig. 2. According to some non-limiting embodiments of the present technology, the network access control server 202 is configured to monitor the current values of the plurality of specified parameters of each of the first and second electronic devices 204, 205 using an internal device monitoring manager application 206 and/or a network device monitoring manager application 210, as described above with reference to Fig. 2. In some non-limiting embodiments of the present technology, the network access control server 202 is capable of detecting a security violation in the event of a discrepancy between one or more current values of a plurality of specified device parameters received from the internal device monitoring manager application 206 of the given electronic device and the values received from the network device monitoring manager application 210.

[0111] In some non-limiting embodiments of the present technology, the network access control server 202 is capable of detecting a security violation by detecting an overlap of operating sessions of at least two electronic devices in the local network 208 that have accessed the local network 208 using the same digital certificate. For example, the network access control server 202 is capable of detecting an overlap 406 of network sessions between the first network session 402 and the second network session 404 of the second electronic device 205 and the third electronic device 405, respectively, that have accessed the local network 208 using the same second digital certificate 215, as described above with reference to Fig. 4.

[0112] The next step in method 600 is step 610.

Step 610: If there is a security violation associated with a network host device, replace the authorization tag of the network certificate of the network host device with a secure mode tag in the certificate database.

[0113] In step 610, according to some non-limiting embodiments of the present technology, upon detection of a security breach associated with an electronic device, such as the second electronic device 205, the network access control server 202 is configured to replace in the certificate database 216 the second authorization tag 525, originally assigned to the second digital certificate 215, with a secure mode tag 225.

[0114] According to some non-limiting embodiments of the present technology, the secure mode tag 225 may define a limited set of actions that is narrower than the specified set of actions defined by the second authorization tag 525, such as only reading or executing executable files on electronic devices connected to the local network 208. In other non-limiting embodiments of the present technology, the secure mode tag 225 may define a limited list of electronic devices on which the electronic device having the second digital certificate 215 is allowed to perform permitted actions. For example, electronic devices included in the restricted list of electronic devices may be associated with a lower risk of compromising other electronic devices on the local network 208. In some other non-limiting embodiments of the present technology, the secure mode tag 225 may define both a restricted set of actions that an electronic device having the second digital certificate 215 is permitted to perform and a restricted list of electronic devices on which electronic devices having the second digital certificate 215 are permitted to perform the restricted set of actions. In some other non-limiting embodiments of the present technology, the secure mode tag 225 of the second digital certificate may include an indication of a complete ban on access of the electronic device having the second digital certificate 215 to the local network 208.

[0115] In addition, after the network access control server 202 replaces the second authorization tag 525 of the second digital certificate 215 in the certificate database 216 with the secure mode tag 225, the network access control server 202 is capable of transmitting to the authentication server 212 data characterizing the relationship between the second digital certificate 215 and the secure mode tag 225, which may include an update of the certificate database 216. After receiving data on the connection between the second digital certificate 215 and the secure mode tag 225, the authentication server 212, in turn, in response to a request for access to the local network 208 from the electronic device having the second digital certificate 215 (such as the second electronic device 205), is able to provide such access to the second electronic device 205 in accordance with the permissions defined in the secure mode tag 225, namely (1) to allow the second electronic device 205 to perform a limited set of actions and/or (2) to allow the second electronic device 205 to perform permissible actions on electronic devices of the local network 208 from a limited list.

[0116] In addition, when it is determined that the violation associated with the second electronic device 205 is eliminated, for example, when monitoring a plurality of specified parameters of the first and second electronic devices 204, 205, the network access control server 202 is capable of (1) deleting the secure mode tag 225 from the second digital certificate 215 in the certificate database 216, (2) again assigning the second authorization tag 525 to this certificate, and (3) transmitting data about the relationship between the second digital certificate 215 and the second authorization tag 525 to the authentication server 212 so that the authentication server 212 allows access of the second electronic device 205 to the local network in accordance with the permission defined in the second authorization tag 525.

[0117] This completes the implementation of method 600.

[0118] Thus, some non-limiting embodiments of the method 600 make it possible to (1) more effectively identify suspicious electronic devices on the local network 208 and (2) more quickly prevent such electronic devices from accessing it, which helps to improve the security of the local network 208 and the quality of service to its users.

[0119] It is obvious that not all technical effects mentioned herein are subject to implementation in each specific embodiment of the present technology.

[0120] Possible changes and improvements to the above-described embodiments of the present technology may be obvious to a person skilled in the art. The preceding description is provided for illustrative purposes only and is not intended to limit the scope of the invention. The scope of protection of the present technology is determined solely by the scope of the appended claims.

Claims (36)

1. A computer method for managing access to a network based on ports, implemented in accordance with the IEEE 802.1x standard, for a plurality of network host devices in a local network containing an authentication server capable of providing access to the local network to a plurality of network host devices based on network certificates, and a server on which a certificate database is located, wherein the local network is associated with a network security policy, and the method provides: - formation in the certificate database for a network host device from a plurality of network host devices of a network certificate for access to a local network; - generation in the certificate database for a network certificate associated with a network host device of an authorization tag indicating the set of actions that the network host device is permitted to perform in the local network, - transmitting data indicating a relationship between a network certificate and an authorization tag associated with a network host device to a local network authentication server, whereby the authentication server authorizes the network host device to access the local network and perform a set of actions therein; - determining the presence of a security violation associated with a network host device and including an indication of a violation by the network host device of the local network security policy; - if there is a security breach associated with a network host device: - replacing the authorization tag of the network certificate of the network host device in the certificate database with a secure mode tag indicating a limited set of actions, narrower than those of the authorization tag, that the network host device is permitted to perform on the local network until the security breach is resolved; and - transmitting data indicating an association between a network certificate and a secure mode tag associated with a network host device to a local network authentication server, as a result of which the authentication server prohibits the network host device from performing a set of actions associated with the authorization tag and permits the network host device to perform only a limited set of actions. 2. The method according to claim 1, wherein the security violation includes an indication of the use of a network certificate associated with a network host device for accessing a local network by another network host device from a plurality of network host devices, and determining the presence of a security violation includes: - monitoring sessions of each of a plurality of network host devices in a local network for a specified period based on network certificates; and - detection of an overlap of at least two sessions of use of a network certificate associated with a host device for a period of time exceeding a specified threshold period. 3. The method according to claim 1, wherein the security violation includes an indication of a deviation of the current value of at least one specified parameter from a plurality of specified parameters of the network host device from a specified value, and determining the presence of a security violation involves monitoring the current values of the plurality of specified parameters of the network host device. 4. The method according to claim 3, wherein the monitoring includes ensuring that the electronic host device collects current values of a plurality of specified device parameters using an internal device monitoring manager and transmits current values of a plurality of specified device parameters to the server. 5. The method according to claim 4, wherein the internal device monitoring manager is the internal Osquery device monitoring manager. 6. The method according to claim 3, wherein the monitoring includes executing on the server a network application of a device monitoring manager capable of requesting via the local network the current values of a plurality of specified device parameters from at least a portion of the plurality of network host devices, including the given network host device. 7. The method of claim 6, wherein the network device monitoring manager comprises at least one of the following network device monitoring managers: SCCM, Jamf, and Salt Manager. 8. The method according to claim 3, wherein the monitoring includes ensuring that the electronic host device collects current values of a plurality of specified device parameters using an internal device monitoring manager and transmits the current values of the plurality of specified device parameters to the server, as well as executing on the server a network application of the device monitoring manager capable of requesting over a local network the current values of the plurality of specified device parameters from at least a portion of the plurality of network host devices, including the given network host device, wherein the security violation includes an indication of a deviation of the current value of at least one specified parameter of the network host device from a specified value, detected by the internal device monitoring manager and the central device configuration manager of the system. 9. The method according to claim 1, which, upon detection of the elimination of the security violation, further includes replacing in the certificate database the secure mode tag of the network certificate of the network host device again with an authorization tag and transmitting data indicating the relationship between the network certificate and the authorization tag associated with the network host device to the authentication server of the local network, as a result of which the authentication server allows the network host device to perform a set of actions. 10. A server for port-based network access control implemented in accordance with the IEEE 802.1x standard for a plurality of network host devices in a local area network containing an authentication server capable of providing access to the local area network to a plurality of network host devices based on network certificates, wherein the local area network is associated with a network security policy, a certificate database is located on the server, and the server contains at least one processor and at least one physical machine-readable medium storing executable commands, the execution of which by at least one processor on the server ensures: - formation in the certificate database for a network host device from a plurality of network host devices of a network certificate for access to a local network; - generation in the certificate database for a network certificate associated with a network host device of an authorization tag indicating the set of actions that the network host device is permitted to perform in the local network; - transmitting data indicating a relationship between a network certificate and an authorization tag associated with a network host device to a local network authentication server, whereby the authentication server authorizes the network host device to access the local network and perform a set of actions therein; - determining the presence of a security violation associated with a network host device, which includes an indication that the network host device has violated the local network security policy; - if there is a security breach associated with a network host device: - replacing the authorization tag of the network certificate of the network host device in the certificate database with a secure mode tag indicating a limited set of actions, narrower than those of the authorization tag, that the network host device is permitted to perform on the local network until the security breach is resolved; and - transmitting data indicating an association between a network certificate and a secure mode tag associated with a network host device to a local network authentication server, as a result of which the authentication server prohibits the network host device from performing a set of actions associated with the authorization tag and permits the network host device to perform only a limited set of actions. 11. The server of claim 10, wherein the security violation includes an indication of the use of a network certificate associated with a network host device for accessing a local network by another network host device from a plurality of network host devices, and to determine the presence of a security violation, at least one processor ensures that the server performs: - monitoring sessions of each of a plurality of network host devices in a local network for a specified period based on network certificates; and - detecting an overlap of at least two sessions of use of a network certificate associated with a host device for a period of time exceeding a specified threshold period. 12. The server according to claim 10, wherein the security violation includes an indication of a deviation of the current value of at least one specified parameter from a plurality of specified parameters of the network host device from a specified value, and to determine the presence of a security violation, at least one processor ensures that the server monitors the current values of the plurality of specified parameters of the network host device. 13. The server according to claim 12, wherein for monitoring current values of a plurality of specified device parameters, at least one processor ensures that the electronic host device under the control of the server collects current values of a plurality of specified device parameters using an internal device monitoring manager and transmits current values of a plurality of specified device parameters to the server. 14. The server of claim 13, wherein the internal device monitoring manager is the internal Osquery device monitoring manager. 15. The server according to claim 12, wherein for monitoring the current values of a plurality of specified device parameters, at least one processor ensures execution on the server of a network application of a device monitoring manager, capable of requesting, via a local network, the current values of a plurality of specified device parameters from at least a portion of a plurality of network host devices, including the given network host device. 16. The server of claim 15, wherein the network device monitoring manager comprises at least one of the following network device monitoring managers: SCCM, Jamf, and Salt Manager. 17. The server according to claim 12, wherein for monitoring current values of a plurality of specified device parameters, at least one processor ensures that the electronic host device under the control of the server collects current values of a plurality of specified device parameters using an internal device monitoring manager and transmits the current values of the plurality of specified device parameters to the server, and that a network application of the device monitoring manager is executed on the server, capable of requesting current values of a plurality of specified device parameters over a local network from at least a portion of a plurality of network host devices, including the given network host device, wherein the security violation includes an indication of a deviation of the current value of at least one specified parameter of the network host device from a specified value, detected by the internal device monitoring manager and the central device configuration manager of the system. 18. The server according to claim 10, wherein upon detection of the elimination of the security violation, at least one processor additionally ensures that the server replaces in the certificate database the secure mode tag of the network certificate of the network host device again with an authorization tag and transmits data indicating the relationship between the network certificate and the authorization tag associated with the network host device to the authentication server of the local network, as a result of which the authentication server allows the network host device to perform a set of actions.