WO2010036612A1

WO2010036612A1 - A method and apparatus for security-risk based admission control

Info

Publication number: WO2010036612A1
Application number: PCT/US2009/057685
Authority: WO
Inventors: Ulas C. Kozat; Svetlana Radosavac; James Kempf
Original assignee: NTT Docomo Inc
Current assignee: NTT Docomo Inc
Priority date: 2008-09-25
Filing date: 2009-09-21
Publication date: 2010-04-01
Anticipated expiration: 2011-03-25
Also published as: US20100077470A1; US8316428B2

Abstract

A method and apparatus is disclosed herein for security risk-based admission control. In one embodiment, the method comprises: receiving a request from the user device to access the network; determining whether to admit the user device based on a security-based admission control policy that admits user devices based on a constraint optimization that attempts to maximize the sum utility of the currently admitted user devices in view of a security assessment of the user device and security risk imposed on the network and already admitted user devices if the user device is admitted to the network, wherein the constraint optimization is based on a utility associated with admitting the user device to the network, a reputation value associated with the user device, and a botnet damage estimation on the network associated with the user device; and admitting the user device to the network based on results of determining whether to admit the user device.

Description

A METHOD AND APPARATUS FOR SECURITY-RISK BASED ADMISSION CONTROL

PRIORITY

[0001] The present patent application claims priority to and incorporates by reference the corresponding provisional patent application serial no. 61/100,192, titled, "A Method and Apparatus for Security-Risk Based Admission Control", filed on September 25, 2008.

FIELD OF THE INVENTION

[0002] The present invention relates to the fields of communication networks and network security; more particularly, the present invention relates to admission control that decides to admit user devices into a network based on security risk assessments of user devices waiting to connect the network and those already in the network.

BACKGROUND OF THE INVENTION

[0003] Admission control in a communication network amounts to the decision of admitting a particular subscriber/user into the system or not every time that subscriber/user wants to connect to the network and use network's resources. The traditional admission control policies typically address authorization, authentication, and quality of service issues in their decision processes.

[0004] Security risks arise due to several facts such as: subscriber's private information can be compromised, subscriber devices are compromised and are used to launch attack on others by spreading malware, many subscriber devices together form a botnet to launch distributed denial of service attacks on the network itself and/or on other network users, mainly businesses, etc. The damages can be measured both in monetary and network performance terms. The network performance can be measured as the disconnectivity incurred inside the network or at the edge links of the network that connects businesses and users to the communication network, e.g., Internet. [0005] Cyber insurance was first proposed as a method for mitigating the residual risk in the Internet in 2000. The cyber insurance policy was offered through a partnership of two companies: security company Counterpane and insurance company Lloyd's of London.

[0006] There are a number of problems that arise in this field, which are analogous with the auto and health insurance markets. Others have stated that, just like other successful insurance markets, the cyber insurance market will be developed over time in a response to experience and result in well-functioning insurance markets.

[0007] An analysis of the impact of insurance and self- investment in user- user interactions has been developed. This analysis indicates that protection against attacks involves four different responses: 1) avoid the risk, 2) absorb the risk, 3) self- protect to mitigate the risk, and 4) transfer the risk through insurance or hedging. The analysis starts with a utility function model of the interplay between insurance and self protection in the single agent case. Depending on the costs of self protection and insurance versus the probability and perceived loss from attack, users are motivated to either insure and seek self -protection, not insure and seek self- protection, or absorb the risk by not protecting. The analysis then extends this model to multiple agents and examines the effects of moral hazard (the tendency of people to engage in more risky actions when they believe their losses will be compensated). This multi-agent model also considers the interactions between self -protection in different individuals, where the decision of one individual to self-protect affects the losses of others in the case of attack. The analysis applies this analysis to two different kinds of networks, a full mesh and a star network very similar to the Internet's power law network form. They observe a threshold phenomenon, in which the reduced premiums for self-protection for insured users cause a small portion of the population to invest in self -protection, which ultimately causes all users to self- protect.

[0008] Others have assumed that the security risk of each player in the network depends on a linear combination of investments of all users in the network and have shown that the Price of Anarchy (POA) is very large in the one-shot game and increases with the number of players. In the repeated game, it is possible to achieve social optimum if it doesn't interfere with individual rationality. However, implementing this strategy in a repeated game requires cooperation and communication among the players. This can be achieved either in an environment where all players cooperate or when a social planner that ensures certain level of investments by all users is used.

[0009] The applicability of the existing insurance schemes in the current

Internet has been explored. Using standard insurance models, whether business models based on cyber insurance schemes that utilize such insurance models can survive in the competitive insurance market have been analyzed. After taking into account information asymmetry (before contract signing) and hidden information (after contract signing), it would appear that no policy that is based on the current insurance models can survive in the competitive market. Therefore, different Internet architecture must be adopted for mitigating and/or eliminating this information asymmetry.

SUMMARY OF THE INVENTION

[0010] A method and apparatus is disclosed herein for security risk-based admission control. In one embodiment, the method comprises: receiving a request from the user device to access the network; determining whether to admit the user device based on a security-based admission control policy that admits user devices based on a constraint optimization that attempts to maximize the sum utility of the currently admitted user devices in view of a security assessment of the user device and security risk imposed on the network and already admitted user devices if the user device is admitted to the network, wherein the constraint optimization is based on a utility associated with admitting the user device to the network, a reputation value associated with the user device, and a botnet damage estimation on the network associated with the user device; and admitting the user device to the network based on results of determining whether to admit the user device.

BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The present invention will be understood more fully from the detailed description given below and from the accompanying drawings of various embodiments of the invention, which, however, should not be taken to limit the invention to the specific embodiments, but are for explanation and understanding only.

Figure 1 illustrates one embodiment of a network with user devices and an admission controller.

Figure 2 is a flow diagram of one embodiment of a process for admitting a user device waiting to enter a network having one or more currently admitted user devices, based on a security assessment of the user devices.

Figure 3 is a flow diagram of one embodiment of a process for admitting one or more user devices into a network.

Figure 4 is a block diagram of an exemplary computer system.

Figure 5 is a flow diagram of one of embodiment of the admission control process.

DETAILED DESCRIPTION OF THE PRESENT INVENTION

[0012] An admission control policy for communication and computer networks is disclosed. In one embodiment, the admission policy is targeted towards building a secure network, where the security is not rigid in the sense that network and users can bear a certain degree of security risk, where the cost of feasible attacks is marginalized and/or compensated (e.g., through insurance). [0013] In the following description, numerous details are set forth to provide a more thorough explanation of the present invention. It will be apparent, however, to one skilled in the art, that the present invention may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form, rather than in detail, in order to avoid obscuring the present invention.

[0014] Some portions of the detailed descriptions which follow are presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These algorithmic descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here, and generally, conceived to be a self-consistent sequence of steps leading to a desired result. The steps are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated. It has proven convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like.

[0015] It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless specifically stated otherwise as apparent from the following discussion, it is appreciated that throughout the description, discussions utilizing terms such as "processing" or "computing" or "calculating" or "determining" or "displaying" or the like, refer to the action and processes of a computer system, or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission or display devices. [0016] The present invention also relates to apparatus for performing the operations herein. This apparatus may be specially constructed for the required purposes, or it may comprise a general purpose computer selectively activated or reconfigured by a computer program stored in the computer. Such a computer program may be stored in a computer readable storage medium, such as, but is not limited to, any type of disk including floppy disks, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs), EPROMs, EEPROMs, magnetic or optical cards, or any type of media suitable for storing electronic instructions, and each coupled to a computer system bus.

[0017] The algorithms and displays presented herein are not inherently related to any particular computer or other apparatus. Various general purpose systems may be used with programs in accordance with the teachings herein, or it may prove convenient to construct more specialized apparatus to perform the required method steps. The required structure for a variety of these systems will appear from the description below. In addition, the present invention is not described with reference to any particular programming language. It will be appreciated that a variety of programming languages may be used to implement the teachings of the invention as described herein.

[0018] A machine-readable medium includes any mechanism for storing or transmitting information in a form readable by a machine (e.g., a computer). For example, a machine-readable medium includes read only memory ("ROM"); random access memory ("RAM"); magnetic disk storage media; optical storage media; and/or flash memory devices.

Overview

[0019] A security-based admission control policy for maintaining secure networks is disclosed. In one embodiment, the admission control policy is used to establish a secure network whose resources such as links, routers, switches, data centers, storage, services, etc. can be used by only the users admitted into the system. The network to be secured might be a private network, it can be a public network with users carrying devices that have installed right set of hardware and software solutions allowed and/or controlled by the network, or it can be a network with multiple isolated virtualized slices running over the same set of physical resources without interfering with each other and some of the slices run the admission control policies as disclosed herein. In one embodiment, the admission policy is targeted towards building a secure network, where the security is not rigid in the sense that network, and users can bear a certain degree of security risk, where the cost of feasible attacks is marginalized and/or compensated (e.g., through insurance). [0020] In one embodiment, the admission control policy disclosed herein uses the security risks as a system constraint and tries to maximally improve the utility of admission decision. In one embodiment, the admission control policy not only determines whether a user is admissible or not, but when the user is admissible as well.

[0021] Figure 1 illustrates one embodiment of a network with user devices

101-106 and an admission controller 120 which determines whether to admit user devices into the network based on a policy. User devices 101-106 may be mobile or fixed stations or devices. Although only 6 are shown, the number of user devices may be more or less than this number. Note that for purposes herein, the terms "user device" and "user" will be used interchangeably with respect to their admittance into the network.

[0022] Using the policy, an admission controller 120 admits network users based on their security assessment and imposed security risk on the network and other network users. In one embodiment, admission controller 120 assesses the risk based on the past behavior of the user as well as the real-time scanning and device inspection before the admission into the system. Admission controller 120 manages the accessed network and makes an admission decision for each candidate network user by computing the overall risk after the admission of that particular user. If the overall risk is below a certain threshold that can be accommodated by the network operator, admission controller 120 admits the user; otherwise, admission controller 120 delays the user's admission is delayed until the overall risk drops below the threshold. In one embodiment, the overall risk can be reduced due to (1) increased reputation of the users who are already in the system, (2) departed users, (3) increased reputation of the user waiting to be admitted during the scanning and inspection period, (4) capacity increase inside the network and at the edges, (5) accumulated wealth by the operator due to the premium charged to access the network, and so on.

[0023] When there is more than one user waiting to get admitted at a given time, admission controller 120 decides when to admit each user based on the system constraints and utility of admitting each user at a particular access delay. In one embodiment, admission control 120 uses a security-based admission control policy for maintaining secure networks, where the admission control policy uses the security risks as a system constraint and tries to maximally improve the utility of admission decision. In one embodiment, the utility reflects the service level agreement or quality of service, while the system constraints reflect the quality of security for the admitted users.

[0024] In one embodiment, admission controller 120, using the admission control policy, not only determines whether a user is admissible or not, but when the user is admissible as well. [0025] The network of Figure 1 also includes monitoring device 121 that monitors network traffic and/or congestion as well as a scanning device 122 that scans user devices seeking entry into the network and downloads security patches (or causes the download of security patches) to these user devices based on the results of their scan. Note that admission controller 120, monitoring device 121, and scanning device 122 may be one device or multiple devices and may comprise a client or server that contains a network interface or some other method that can be used to provide connectivity to the network, and may be located anywhere inside the network.

[0026] Figure 2 is a flow diagram of one embodiment of a process for admitting a user device waiting to enter a network having one or more currently admitted user devices, based on a security assessment of the user devices. The process is performed by processing logic that may comprise hardware (e.g., circuitry, dedicated logic, etc.), software (such as is run on a general purpose computer system or a dedicated machine), or a combination of both. In one embodiment, the processing logic is part of or controlled by an admission controller. [0027] Referring to Figure 2, the process begins by processing logic receiving a request from the user device to access the network (processing block 201). In response to the request, processing logic scans the user device to perform security checks and downloads any necessary software based on scanning results (processing block 202). In one embodiment, where the security assessment is based on a reputation value of a user device, processing logic increases reputation value of the user device responsive to the scanning of the user device and the downloading of software updates.

[0028] After receiving a request to enter a network, processing logic determines whether to admit the user device based on a security-based admission control policy that admits user devices based on a constraint optimization that attempts to maximize the sum utility of the currently admitted user devices in view of a security assessment of the user device and security risk imposed on the network and already admitted user devices if the user device is admitted to the network, where the constraint optimization is based on a utility associated with admitting the user device to the network, a reputation value associated with the user device, and a botnet damage estimation on the network associated with the user device (processing block 203). In one embodiment, the security assessment is based on a reputation value. In one embodiment, processing logic determines to admit the user device to use the network occurs if results of determining whether to admit the user device occurs indicate a likelihood of possible damage that can be incurred by the user device and the one or more currently admitted user devices to disrupt one or more network services is lower than a threshold. In one embodiment, the likelihood of possible damage comprises the likelihood that the user device and the one or more currently admitted user devices could cooperate together to become a botnet. In one embodiment, determining whether to admit the user device is based on a traffic injection rate of the user device, a reputation value indicative of a trust level for the user device with respect to the network, and each reputation value of the one or more currently admitted user devices.

[0029] Once a determination has been made to admit a user device, processing logic determines when the user device is to be admitted (prior to admitting the user device) (processing block 204).

[0030] Next, processing logic admits the user device to the network based on results of determining whether to admit the user device (processing block 205). Note that processing logic may determine whether to admit the user and admit the user occurs prior to completion of both scanning the user device to perform security checks and downloading software updates to address security risks identified from the security checks.

[0031] Figure 3 is a flow diagram of one embodiment of a process for admitting one or more user devices into a network. The process is performed by processing logic that may comprise hardware (e.g., circuitry, dedicated logic, etc.), software (such as is run on a general purpose computer system or a dedicated machine), or a combination of both. In one embodiment, the processing logic is part of or controlled by an admission controller.

[0032] The process begins by processing logic of the admission controller receiving requests from user devices to access the network (processing block 301). [0033] Using a utility function, processing logic of the admission controller computes a priority for each user (processing block 302). In one embodiment, the priority is based on the maximum admission delay and a derivative of the utility function. Other concave utility functions can be similarly defined and for each a different priority function can be computed.

[0034] Next, processing logic of the admission controller orders the users from the lowest priority to the highest (processing block 303). After the priority is computed, processing logic of the admission controller sets an admission threshold where only the users above the threshold are labeled as admissible (processing block 304).

[0035] Processing logic of the admission controller computes the admission delay for those determined to be admissible (processing block 305). Then, processing logic in the admission controller admits the users at time equal to the arrival time of user i into the system plus its admission delay (processing block 306).

Specific Algorithm Embodiments

[0036] In one embodiment, there are K user devices that have already been admitted into the network and N user devices waiting to be admitted. The utility of the network increases as more users are admitted. In one embodiment, the goal of the network is to admit as many users as quickly as possible while keeping expected damages below a tolerable threshold. In order to achieve this, the network constructs an admission policy that admits users based on a security assessment and the security risk they impose to the network and to the already admitted users. [0037] Each user device U₁, i e {l, ... , N} that attempts to join the secure network is characterized with two parameters: reputation p_t, p_t e [θ, p_{t max} J and traffic injection rate r_t (i.e. the user is allowed to inject traffic no faster than this rate). While for some cases, p_hmax < 1, in one embodiment, it is assumed tha.tp_hmax =1. Reputation p_t signifies the trust level put on that user by the network. When user U₁ requests access to the secure network, the system determines its initial reputation value p_lfi based on the results of real-time scanning the user device, past interactions between the user and the network, etc. In another embodiment, if an access control list exist, which shows what privileges user has to access network and networked resources, it can be also used, particularly since the more privileges a user has the more damage it can cause and hence the higher the risk is. [0038] After pφ is determined for all user devices waiting for admission, the admission control policy mechanism of the admission controller makes an admission decision for each user device by computing the overall risk after the admission for that particular user. The reputation of an admitted user is assessed and updated in real-time starting from an initial value at the time of the user's arrival:

where g(τ_t )is a non-negative non-decreasing function of admission delay T₁ , i.e., as the access delay increases the system either discovers that the specific user is secure and the reputation increases or discovers that the user does not have the required properties and forces the user to update the device, which results in increase of the user's reputation (otherwise the reputation remains the same). [0039] The admission controller also captures the security threat of a given subset Bi = Ju₁₁, u_l2, ..., u_im} of admitted user devices U₁₁ to u_im by the sum rate m

Σ_; = ^ r_l} where r_υ is the rate user u_υ can connect to the network, i.e., the user

device is allowed to inject traffic at most at this rate. The damage D(B₁) that can be caused by subset B₁ is then modeled as a non-decreasing monotonic function of ∑_t , i.e., D(B₁) = f(∑_; ). In one embodiment, the form of f is a linear function of Σ_; , but it can take other arbitrary forms as long as it is non-decreasing with the sum rate. In one embodiment, the function f that is used is linear f(∑, ) = cx∑_; for some constant

"c".

[0040] In one embodiment, a reputation value per user (e.g., 0<p₇<l) that signifies the trust level put on that user by the system is used. The trust is continuously updated based on the past interactions and reputation of the user as well as based on the real-time scanning of the user device. The quantity (1- p_}) is then used to measure the likelihood/probability of user j becoming a member of a malicious subset Bi. Assuming the misbehavior of one arbitrary user is independent of another arbitrary user, the damage probability πi of a particular subset of users Bi is computed as in one embodiment.

[0041] In one embodiment, the admission control policy guarantees that expected damage over all possible subsets of admitted users is less than a threshold D_th, which is computed based on the a-priori assessment of the cost of damage that is tolerable to the network operator and end users. The computation of D_th involves many considerations such as the service level agreement (SLA) between the users of the network and the network operator, premiums paid to access the network, premiums paid to get insurance based on this threshold, the compensation amount by the operator if the SLA is violated and/or an insurance payment is made, the accumulated wealth of the operator and insurer, future cost implications on the victim of the security attack, etc. In one embodiment, the admission controller computes the expected damage as:

where the expectation is taken over the set B of all possible subsets Bi. [0042] In one embodiment, the admission controller uses the admission control policy to determine which user to admit at what time by solving the following optimization question:

N max ∑E/. Cr, ) ι=l s.t. E_B [D] ≤ T_th (1)

P, = P₁₀ + 8(τ, ) ' i=h- - -, N (2)

0 ≤ p, ≤ l , i=l,..., N (3)

In other words, the objective of the admission controller is to maximize the sum utility of users admitted into the system, where the individual utilities depend on the admission delay of that particular user. As set forth above, N denotes the number of users that are not yet admitted into the network. The admission control policy can be executed periodically or after each new user arrival. When a user arrives at time t, there are already other users either already admitted into the system or waiting for their admission time as computed by the solution of the utility optimization presented above. The number of users N in the optimization problem then corresponds to the total number of users whose arrival time plus the previously computed admission delay exceeds the current time. In other words, N corresponds to the users who are not already admitted into the system and waiting to get admitted. Therefore, at each new arrival, N might be different and for some users admission control algorithm can be executed for more than once according to an updated utility function.

[0043] The first constraint (1) reflects the cost of expected damage over the set of possible attack points on the system, the second constraint (2) reflects the fact that the reputation pi of each user device is assessed and updated in real-time starting from an initial value at the time of user's arrival, while the last constraint (3) reflects the fact that user reputation is less than 1 and greater than zero. The function g{τ_ι ) is a non-negative increasing function of the admission delay T₁ . The second constraint means that/?, is a non-negative non-decreasing function of the admission delay, i.e., it cannot be smaller than the initial reputation, and it increases with time. As soon as a user requests to connect to the system, it starts with an initial reputation value securely obtained by off-line evaluation and the admission controller begins scanning the user device.

[0044] In one embodiment, as time progresses and user passes certain scanning steps as secure, its reputation increases. When the user device passes the scan, its reputation value increases. When a step is not passed, the user device is quarantined and the necessary security patches (after being downloaded) are installed, after which the admission controller increase to the reputation value for the user device because the user device is now up to the current security level. User devices do not need to wait until a full scanning is completed and/or necessary patches are applied. If their current risk imposed on the network as captured by constraint (1) is acceptable and there is greater gain of admitting the user earlier than the full scan in accordance with the utility maximization, then the user can be admitted earlier. However, the scanning process and reputation update continues even after the user is admitted to the system. [0045] In one embodiment, g( T₁ ) is a linear function of the form g(τ_t , where α is a positive constant. For a maximum scanning delay target of r _v , α can be set to l/τ_mi,_v , where r _v is typically in the order of seconds or minutes (e.g., 50 seconds). Note that in one embodiment, in the optimization framework, users do not need to wait until a full scanning is completed and/or necessary patches are applied. If the risk they impose on the network as captured by Eq. 1 is acceptable and there is greater gain in admitting the user earlier rather than after performing a full scan, then the user can be admitted earlier. However, the scanning process and the reputation updates continue even after the user is admitted to the network.

[0046] In one embodiment, the admission control policy defines the damage

D(B₁) of subset B₁ as a linear function of sum rate of B₁, i.e., D(B₁) =SX∑_! . In one embodiment, s is set to 1. In another embodiment, instead of using the exact value of the expected value computation in (1), an upper bound that is convex in p,'s can be used. One such function is in the form of

with γ being a real value between 1 and 2 N , r_t is the allowed connection rate of i-th user. Note that γ™ is an upper bound. Also, smaller values of γ can be used to more tightly upper bound the expected damage.

[0047] With the linear approximations for the constraints, the optimization problem becomes a convex optimization problem. Accordingly, the following Lagrangian function is defined:

ψ{λ,μ) = ∑U_ι{τ_ι )-λ(γ∑{l- p_ιO -aτ_ι )τ_ι -r_th) -∑μ_ι{p_ιO +aτ_ι -l) ι=l V ι=l J ι=l where λ andμ_ι are the Lagrange multipliers. Solving for the Kuhn-Tucker conditions reveals that:

∑U;-^ι[-α_Kλ]_rι (9)

where U' (.) is the derivative of U₁ and U'^'1 (.) is the inverse function of U' (.).

[0048] Let A be the set of users who are admitted into the system before they reach the maximum reputation level. Once λ is computed, the admission delay of each user i can be computed as:

Here, τ_{ι msκ} = (l - p_l0 )/ (X represents the maximum delay user i can observe before being admitted into the system (after T_{1 ^x} the user' s reputation becomes one, thus it does not pose a security risk).

[0049] To find the admission times for each user, the value of the set A needs to be determined. First, observe that for each i e A , the following inequality exists:

T₁ = V₁ -¹ I- (XYr₁AU T_hmax or equivalently,

due to the fact that U'(x) is a decreasing function of x. For purposes herein, λ, is referred to as the user priority function. Note that the lower λ values would result in admitting more users into the system since more users would satisfy the above inequality. A lower λ would also decrease the admission delay of each user since U'(x) is a decreasing function of x and so U'^~l(— Jt) is an increasing function of x.

Therefore, a lower λ value implies a lower admission delay for users in set A. As a result, the sum utility increases. In one embodiment, the optimum solution finds the smallest X(A) > 0 such that the above constraints are satisfied. [0050] Note that if a user with λ, is in A, then all j such that λ ≥ X₁ must be in A. In one embodiment, all users are sorted in increasing λ, such that λ_}i < λ_]2 < ... < λ_]N . Set A can then be one of the following (N +1) subsets A(O) =

{ju... J_N], A(I) = {J₂,...J_N}, A(2) = {J₃,...J_N}, ..., A(N- 1) = {j_N}, A(N) = 0 . In one embodiment, the admission controller executes the following algorithm: for m=0 to N

A := A(m);

Compute λ according to Eq. (9);

If A' ≡ A set X = λ and exit; Else continue to next iteration; end

[0051] After the algorithm halts, the admission controller computes the admission time T₁ of each user i according to Eq. (10) using λ = λ and the last A.

The users are then admitted at time τ_arr , + T₁ , where τ_{arr l} is the arrival time of user i into the system.

[0052] In a typical case, where there are multiple arrivals of users over a certain period of time, each new user arrival triggers the re-execution of the algorithm for the users who are waiting for admission either because their admission time is not reached or because their admission time is not yet computed (e.g., the newly arrived users). Suppose Z denotes the set of users at time t who are already admitted into the network, not yet departed, and have reputation less than one, i.e., Z = {Vj : T _{arr l} + T₁ < t < τ_{depart l} A P₁ < l}. Also, let Ψ be the set of all possible subsets of Z. The first constraint given by (5) can then be rewritten as

E_B [D] ≤ Y_th - E_ψ [D] . In other words, the damage threshold is reduced by the expected damage that can be caused by different subsets of users who are already admitted into the network. As before when linear approximation is used, in one embodiment, this damage is computed as

After the new conditions are taken into account (i.e., the expected damage is updated with the newly arrived users, their reputations, and traffic injection rates), the admission times for the users who are still waiting to enter the network are computed/recomputed using the same algorithm as before. [0053] Figure 5 is a flow diagram of one of embodiment of the admission control process as described above.

Solution for a Specific Utility Function

[0054] In one embodiment, the utility function Ui(T₁ J is a concave non- increasing function of T₁ . In one embodiment, the following utility function is used:

where T₁ represents the additional delay due to the re-executed admission control algorithm.

[0055] Using this expression for the utility, the exact values of priority λ, are calculated from Eq. (11):

where T_1113x represents the maximum tolerable access delay. In one embodiment, the value of β is 1.

[0056] For this specific utility function, the following observations are evident. First, the users with a higher upload rate have lower λ, values, and hence they are more likely to be excluded from set A and wait until the end of a full scan. Also, users with lower T_{1 max} (i.e., with higher initial reputation) are also likely to be delayed until their systems are fully scanned. At first sight, this might seem surprising, since the users with a higher initial reputation value are likely to pose less security risk. However, the key here is the utility function: when users have high initial reputation value, their maximum delays T_{1 max} are already small and their utilities are little impacted by the extra delay. Hence, from the network point of view, it is reasonable to preferentially opt for eliminating the security risks of lower reputation users with full scanning and patching.

[0057] Following the steps of the admission algorithm outlined above and utilizing the expression for λ, from Eq. 14, the expression for λ is computed from Eq.

9:

and the corresponding λ , as it was outlined above, is computed. [0058] Since the utility function is of form Eq. 13, we have:

U;^~i- aγ_rιX] = τ_ £- (16) aγr_tλ and the access delay is:

An Example of a Computer System

[0059] Figure 4 is a block diagram of an exemplary computer system that may perform one or more of the operations described herein. Referring to Figure 4, computer system 400 may comprise an exemplary client or server computer system. Computer system 400 comprises a communication mechanism or bus 411 for communicating information, and a processor 412 coupled with bus 411 for processing information. Processor 412 includes a microprocessor, but is not limited to a microprocessor, such as, for example, Pentium™, PowerPC™, Alpha™, etc. [0060] System 400 further comprises a random access memory (RAM), or other dynamic storage device 404 (referred to as main memory) coupled to bus 411 for storing information and instructions to be executed by processor 412. Main memory 404 also may be used for storing temporary variables or other intermediate information during execution of instructions by processor 412. [0061] Computer system 400 also comprises a read only memory (ROM) and/or other static storage device 406 coupled to bus 411 for storing static information and instructions for processor 412, and a data storage device 407, such as a magnetic disk or optical disk and its corresponding disk drive. Data storage device 407 is coupled to bus 411 for storing information and instructions. [0062] Computer system 400 may further be coupled to a display device 421, such as a cathode ray tube (CRT) or liquid crystal display (LCD), coupled to bus 411 for displaying information to a computer user. An alphanumeric input device 422, including alphanumeric and other keys, may also be coupled to bus 411 for communicating information and command selections to processor 412. An additional user input device is cursor control 423, such as a mouse, trackball, trackpad, stylus, or cursor direction keys, coupled to bus 411 for communicating direction information and command selections to processor 412, and for controlling cursor movement on display 421. [0063] Another device that may be coupled to bus 411 is hard copy device

424, which may be used for marking information on a medium such as paper, film, or similar types of media. Another device that may be coupled to bus 411 is a wired/wireless communication capability 425 to communicate to a network (via a network interface) or another device (e.g., mobile device).

[0064] Note that any or all of the components of system 400 and associated hardware may be used in the present invention. However, it can be appreciated that other configurations of the computer system may include some or all of the devices. [0065] Whereas many alterations and modifications of the present invention will no doubt become apparent to a person of ordinary skill in the art after having read the foregoing description, it is to be understood that any particular embodiment shown and described by way of illustration is in no way intended to be considered limiting. Therefore, references to details of various embodiments are not intended to limit the scope of the claims which in themselves recite only those features regarded as essential to the invention.

Claims

CLAIMSWe claim:

1. A method for admitting a user device waiting to enter a network having one or more currently admitted user devices, the method comprising: receiving a request from the user device to access the network; determining whether to admit the user device based on a security-based admission control policy that admits user devices based on a constraint optimization that attempts to maximize the sum utility of the currently admitted user devices in view of a security assessment of the user device and security risk imposed on the network and already admitted user devices if the user device is admitted to the network, wherein the constraint optimization is based on a utility associated with admitting the user device to the network, a reputation value associated with the user device, and a botnet damage estimation on the network associated with the user device; and admitting the user device to the network based on results of determining whether to admit the user device.

2. An admission control for use in admitting a user device waiting to enter a network having one or more currently admitted user devices, the admission control comprising: a memory to store instructions; and a processor coupled to the memory to execute the instructions to perform a method comprising receiving a request from the user device to access the network, determining whether to admit the user device based on a security- based admission control policy that admits user devices based on a constraint optimization that attempts to maximize the sum utility of the currently admitted user devices in view of a security assessment of the user device and security risk imposed on the network and already admitted user devices if the user device is admitted to the network, wherein the constraint optimization is based on a utility associated with admitting the user device to the network, a reputation value associated with the user device, and a botnet damage estimation on the network associated with the user device, and admitting the user device to the network based on results of determining whether to admit the user device.

3. An article of manufacture having one or more computer readable storage media storing instructions which when executed by an admission controller of a network cause the admission controller to perform a method comprising: receiving a request from the user device to access the network; determining whether to admit the user device based on a security-based admission control policy that admits user devices based on a constraint optimization that attempts to maximize the sum utility of the currently admitted user devices in view of a security assessment of the user device and security risk imposed on the network and already admitted user devices if the user device is admitted to the network, wherein the constraint optimization is based on a utility associated with admitting the user device to the network, a reputation value associated with the user device, and a botnet damage estimation on the network associated with the user device; and admitting the user device to the network based on results of determining whether to admit the user device.