Network access control with compliance policy check

• US 10,063,594 B2
• Filed: 03/14/2016
• Issued: 08/28/2018
• Est. Priority Date: 12/16/2014
• Status: Active Grant

• Current Assignee: OPSWAT, Inc.
• Original Assignee: OPSWAT, Inc.
• Inventors: Winn, Adam Gregory, Czarny, Benjamin, Mo, Jianpeng, Miao, Yiyi
• Primary Examiner(s): Homayounmehr, Farid
• Assistant Examiner(s): Le, Thanh T
• Application Number:
  US15/069,459
• Publication Number:
  US 20160197962A1
• Time in Patent Office: 897 Days
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Embodiments of the present invention include methods involving an authentication application, a client application, or a combination of a network access control server with the authentication application and the client application. The client application collects compliance data regarding the user device and communicates the compliance data to the network access control server. The network access control server generates a compliance check result based on whether the compliance data indicates that the user device is compliant with a security policy for the software-as-a-service server. The authentication application grants access by the user device when the compliance check result is positive; and the authentication application denies access by the user device when the compliance check result is negative. In some embodiments, the compliance check result or a user device identifier is stored in a web browser cookie or a client certificate on the user device.

Claims

1. A method comprising:

receiving, by an authentication application from a user device, a request to access a software-as-a-service server;

retrieving, by the authentication application from the user device, a compliance check result generated by a network access control server based on

     1) compliance data collected by a client application on the user device, and

     2) a security policy for the software-as-a-service server,

wherein the compliance check result indicates whether the user device is compliant with the security policy for the software-as-a-service server;

granting, by the authentication application, access by the user device to the software-as-a service server when the compliance check result is positive; and

denying, by the authentication application, access by the user device to the software-as-a service server when the compliance check result is negative;

wherein the compliance data includes an encryption state of the user device, a potential for a malware infection of the user device, whether a potentially unwanted application is present on the user device, whether a potentially unwanted hardware component is present on the user device, how often the user device has experienced a malware infection in a period of time, whether the user device is set up to require a password to be entered upon booting of the user device, antivirus products that are installed and activated in the user device, settings of the antivirus products, a running state of applications on the user device, and anti-malware definition state information.

2. The method of claim 1, wherein the retrieving further comprises:

requesting, by the authentication application, a cookie of a web browser from the user device during a login procedure, the cookie containing the compliance check result; and

reading, by the authentication application, the compliance check result from the cookie.

3. The method of claim 1, wherein the retrieving further comprises:

requesting, by the authentication application, a client certificate from the user device during a login procedure, the client certificate containing the compliance check result; and

reading, by the authentication application, the compliance check result from the client certificate.

4. The method of claim 1, further comprising:

requesting, by the authentication application, the compliance data from the network access control server; and

granting or denying, by the authentication application, access by the user device based on the compliance check result and the compliance data.

5. The method of claim 1, further comprising:

receiving, by the authentication application from the network access control server, a decryption key; and

decrypting, by the authentication application using the decryption key, the compliance check result.

6. The method of claim 1, further comprising:

generating, by an authentication server, a secure session ID when the compliance check result is positive; and

granting, by the authentication application, access by the user device based on the secure session ID.

7. A method comprising:

receiving, by an authentication application from a user device, a request to access a software-as-a-service server;

retrieving, by the authentication application, a compliance check result generated by a network access control server based on

     1) compliance data collected by a client application on the user device, and

     2) a security policy for the software-as-a-service server;

granting, by the authentication application, access by the user device to the software-as-a-service server when the compliance check result is positive; and

denying, by the authentication application, access by the user device to the software-as-a-service server when the compliance check result is negative;

wherein the compliance data includes an encryption state of the user device, a potential for a malware infection of the user device, whether a potentially unwanted application is present on the user device, whether a potentially unwanted hardware component is present on the user device, how often the user device has experienced a malware infection in a period of time, whether the user device is set up to require a password to be entered upon booting of the user device, antivirus products that are installed and activated in the user device, settings of the antivirus products, a running state of applications on the user device, and anti-malware definition state information.

8. A method comprising:

collecting, by a client application on a user device, compliance data on the user device; and

sending, by the client application, the compliance data to a network access control server for the network access control server to generate a compliance check result based on the compliance data and a security policy for a software-as-a-service server, wherein the compliance check result is for use by an authentication application to grant access by the user device to the software-as-a-service server when the compliance check result is positive and to deny access by the user device to the software-as-a-service server when the compliance check result is negative,

and wherein the compliance check result indicates whether the user device is compliant with the security policy for the software-as-a-service server;

receiving, by the client application, the compliance check result from the network access control server; and

storing, by the client application, the compliance check result for the user device to send the compliance check result to the authentication application upon receiving a request for the compliance check result from the authentication application during a login procedure;

wherein the compliance data includes an encryption state of the user device, a potential for a malware infection of the user device, whether a potentially unwanted application is present on the user device, whether a potentially unwanted hardware component is present on the user device, how often the user device has experienced a malware infection in a period of time, whether the user device is set up to require a password to be entered upon booting of the user device, antivirus products that are installed and activated in the user device, settings of the antivirus products, a running state of applications on the user device, and anti-malware definition state information.

9. The method of claim 8, wherein:

the storing of the compliance check result further comprises storing, by the client application, the compliance check result in a cookie of a web browser installed on the user device for the user device to send the compliance check result in the cookie to the authentication application upon receiving a request for the cookie from the authentication application during the login procedure.

10. The method of claim 9, further comprising:

encrypting, by the client application, the compliance check result using an encryption key; and

storing, by the client application, the encrypted compliance check result in the cookie further for the authentication application to decrypt the encrypted compliance check result using a decryption key that the authentication application receives from the network access control server.

11. The method of claim 8, further comprising:

the storing of the compliance check result further comprises storing, by the client application, the compliance check result in a client certificate on the user device, for the user device to send the compliance check result in the client certificate to the authentication application upon receiving a request for the client certificate from the authentication application during the login procedure.

12. A method comprising:

collecting, by a client application on a user device, compliance data on the user device; and

sending, by the client application, the compliance data to a network access control server for the network access control server to generate a compliance check result based on the compliance data and a security policy for a software-as-a-service server, wherein the compliance check result is for use by an authentication application to grant access by the user device to the software-as-a-service server when the compliance check result is positive and to deny access by the user device to the software-as-a-service server when the compliance check result is negative;

wherein the compliance data includes an encryption state of the user device, a potential for a malware infection of the user device, whether a potentially unwanted application is present on the user device, whether a potentially unwanted hardware component is present on the user device, how often the user device has experienced a malware infection in a period of time, whether the user device is set up to require a password to be entered upon booting of the user device, antivirus products that are installed and activated in the user device, settings of the antivirus products, a running state of applications on the user device, and anti-malware definition state information.

13. A method comprising:

collecting, by a client application, compliance data on a user device;

sending, by the client application, the compliance data to a network access control server;

generating, by the network access control server, a compliance check result based on the compliance data and a security policy for a software-as-a-service server, wherein the compliance check result indicates whether the user device is compliant with the security policy for the software-as-a-service server;

sending, by the network access control server to the user device, the compliance check result;

storing, by the client application, the compliance check result on the user device;

receiving, by an authentication application from a user device, a request to access the software-as-a-service server;

retrieving, by the authentication application from the user device, the compliance check result during a login procedure;

granting, by the authentication application, access by the user device to the software-as-a service server when the compliance check result is positive; and

denying, by the authentication application, access by the user device to the software-as-a service server when the compliance check result is negative;

wherein the compliance data includes an encryption state of the user device, a potential for a malware infection of the user device, whether a potentially unwanted application is present on the user device, whether a potentially unwanted hardware component is present on the user device, how often the user device has experienced a malware infection in a period of time, whether the user device is set up to require a password to be entered upon booting of the user device, antivirus products that are installed and activated in the user device, settings of the antivirus products, a running state of applications on the user device, and anti-malware definition state information.

14. The method of claim 13, further comprising:

encrypting the compliance check result using an encryption key;

receiving, by the authentication application from the network access control server, a decryption key; and

decrypting, by the authentication application using the decryption key, the compliance check result.

15. The method of claim 13, further comprising:

requesting, by the authentication application, the compliance data from the network access control server; and

granting or denying, by the authentication application, access by the user device based on the compliance check result and the compliance data.

16. The method of claim 13, further comprising:

generating, by an authentication server, a secure session ID when the compliance check result is positive; and

granting, by the authentication application, access by the user device based on the secure session ID.

17. A method comprising:

collecting, by a client application, compliance data on a user device;

sending, by the client application, the compliance data to a network access control server;

generating, by the network access control server, a compliance check result based on the compliance data and a security policy for a software-as-a-service server;

storing, by the network access control server, the compliance check result;

storing, by the client application, a user device identifier in a client certificate on the user device;

requesting, by an authentication application, the client certificate during a login procedure;

reading, by the authentication application, the user device identifier from the client certificate;

based on the user device identifier, requesting, by the authentication application, the compliance check result from the network access control server;

granting, by the authentication application, access by the user device to the software-as-a-service server when the compliance check result is positive; and

denying, by the authentication application, access by the user device to the software-as-a-service server when the compliance check result is negative;

wherein the compliance data includes an encryption state of the user device, a potential for a malware infection of the user device, whether a potentially unwanted application is present on the user device, whether a potentially unwanted hardware component is present on the user device, how often the user device has experienced a malware infection in a period of time, whether the user device is set up to require a password to be entered upon booting of the user device, antivirus products that are installed and activated in the user device, settings of the antivirus products, a running state of applications on the user device, and anti-malware definition state information.