End point control

• US 20060161970A1
• Filed: 10/14/2005
• Published: 07/20/2006
• Est. Priority Date: 12/10/2003
• Status: Active Grant

• Current Assignee: Aventail LLC
• Original Assignee: Aventail LLC
• Inventors: Young, Brian, Anandam, Parvez, Hopen, Chris, Tomlinson, Gary, O'Reilley, Jude Michael Dylan, Flagg, Alan
• Granted Patent: US 7,827,590 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Systems and techniques are provided for controlling requests for resources from remote computers. A remote computer'"'"'s ability to access a resource is determined based upon the computer'"'"'s operating environment. The computer or computers responsible for controlling access to a resource will interrogate the remote computer to ascertain its operating environment. The computer or computers responsible for controlling access to a resource may, for example, download one or more interrogator agents onto the remote computer to determine its operating environment. Based upon the interrogation results, the computer or computers responsible for controlling access to a resource will control the remote computer'"'"'s access to the requested resource.

Claims

1. A method of determining a computing environment of a client computer, comprising:

establishing a secure communication method with the client computer in response to receipt of a network connection request from the client computer;

installing an interrogator agent onto a client computer using the secure communication method; and

receiving interrogation results produced by the interrogator agent that describe one or more elements of the computing environment of the client computer.

2. The method recited in claim 1, further comprising assigning a zone of trust to the client computer based upon the interrogation results produce by the interrogator agent.

3. The method recited in claim 2, further comprising performing an independent evaluation of multiple device profiles to assign a zone of trust to the client computer.

4. The method recited in claim 2, further comprising:

determining a set of process objects required for secure operation of the client computer in the assigned zone of trust; and

installing process objects on the client computer to match the assigned set of process objects.

5. The method recited in claim 1, further comprising

installing a second interrogator agent onto the client computer through the secure communication method;

and

receiving interrogation results produced by the second interrogator agent.

6. The method recited in claim 5, further comprising

analyzing the interrogation results products by the second interrogator agent;

and

approving the client computer for secure access to the network based upon the analyzed interrogation results.

7. The method recited in claim 6, further comprising

creating a set of access credentials for the client computer;

and

storing said access credentials and interrogation results in a cache on one or more servers on the network.

8. A method of controlling a computer'"'"'s access to a resource, comprising:

receiving a request for a client computer for a set of resources from a network;

analyzing the computing environment of said client computer;

determining if the computing environment of said client computer complies with a zone of trust associated with the requested set of resources, and satisfies an access control rule; and

assigning access rights to the client computer if the client computer complies with the zone of trust associated with the requested set of resources, and satisfies the access control rule.

9. The method of controlling a client computer'"'"'s access to a resource recited in claim 8, further comprising authorizing a second network server to allow the client computer to obtain the resource from the network.

10. A method of obtaining access to resources on a network server, comprising:

requesting a resource on a network from an access server;

executing an interrogator agent that analyzes a client computing environment;

transmitting results obtained from the execution of the interrogator agent to a control module; and

in response to transmitting the obtained results, obtaining access to the resource.

11. The method recited in claim 10, further comprising:

receiving the interrogator agent from a provisioning server; and

installing the interrogator agent on the client computer.

12. The method recited in claim 10, further comprising:

identifying resources on other network servers accessible to the client computer, and obtaining the resource from the other network servers.

13. A method of controlling a client computer'"'"'s access to a resource on a network, comprising:

receiving a request for a resource from a client computer;

in response to receiving the request, installing a first interrogator agent onto the client computer;

receiving first interrogation results produced by the first interrogator agent;

identifying one or more security process objects corresponding to the first interrogation results;

installing the identified security process objects onto the client computer;

authenticating an identity of a user of the client computer using results obtained from execution of the identified security process objects on the client computer;

installing a second interrogator agent onto the client computer;

receiving second interrogation results produced by the second interrogator agent; and

based upon the first interrogation results and the second interrogation results, assigning the client computer a zone of trust.

14. The method recited in claim 13, further comprising:

identifying one or more security process objects required by the assigned zone of trust;

installing the required security process objects onto the client computer; and

determining whether the client computer can access the requested resource based upon the assigned zone of trust.

15. The method recited in claim 14, further comprising:

determining if the identified one or more security process objects are properly operating on the client computer, and

if the identified security process objects are properly operating on the client computer, allowing the client computer to obtain the requested resource, and

if one or more of the identified security process objects is not properly operating on the client computer, refusing to allow the client computer to obtain the requested resource.

16. The method recited in claim 13, further comprising assigning the zone of trust based upon the identity of the user.

17. The method recited in claim 13, further comprising allowing the client computer to obtain the resource on the network.

18. The method recited in claim 17, further comprising authorizing one or more network servers to provide one or more resources to the client computer.

19. A method of provisioning resources to a client computer, comprising:

receiving a request for a resource from a client computer;

creating at least one rule identifying a set of elements of a secure computing environment for a client computer;

interrogating the client computer to determine if the client computer contains the set of elements required by the rule; and

provisioning the identified process objects to the client computer to match the required set of elements of a secure computing environment.

20. The method recited in claim 19, further comprising:

creating a rule to further require that an identity associated with the client computer be an authenticated identity before provisioning the set of process objects onto the client computer.

21. The method recited in claim 19, further comprising:

creating the rule to specify a set of communication methods for secure provisioning and execution of process objects on the client computer.

22. A method of provisioning resources to a client computer, comprising:

creating at least one rule identifying

a client computer computing environment,

a resource, and

an action to be taken when the rule is applied in response to a request from the client computer for a resource.

23. The method recited in claim 22, wherein the action allows the client computer to obtain the resource when the rule is applied.

24. The method recited in claim 22, wherein the action prohibits the client computer from obtaining the resource when the rule is applied.

25. The method recited in claim 22, further comprising:

creating the rule to further require that an identity associated with the client computer be authenticated before taking the action in response to a request from the client computer for a resource.

26. The method recited in claim 22, further comprising:

creating the rule to control the use of a set of communication methods.

27. A method of provisioning a client computer, comprising:

receiving a communication from a client computer;

installing at least one interrogator agent onto the client computer in response to said communication;

receiving interrogation results produced by the at least one interrogator agent;

based upon the interrogation results, identifying one or more process objects in the computing environment of the client computer; and

installing the one or more process objects onto the client computer.

28. The method recited in claim 27, wherein

the process objects are communication process objects.

29. The method recited in claim 28, wherein

the communication from the client computer employs a first communication method;

and

at least one of the communication process objects implements a second communication method different from the first communication technique.

30. The method recited in claim 27, further comprising installing an end point installer to facilitate subsequent installation of the process objects.

31. A method of receiving process objects from a network server to a client computer, comprising:

transmitting a communication to a network server;

receiving an interrogator agent;

executing the interrogator agent to analyze a client computing environment;

transmitting results obtained from the execution of the interrogator agent to the network server; and

in response to transmitting the obtained results, receiving at least one process object; and

installing the at least one process object on the client computer for execution.

32. The method recited in claim 31, wherein

the at least one process object is a communication process object.

33. A method of a network server performing an action based upon an operating environment of a client computer, comprising:

installing an interrogator agent onto the client computer; and

receiving interrogation results produced by the interrogator agent;

assigning a zone of trust to the client computer based upon the interrogation results sent by the interrogator; and

performing an action associated with the zone of trust.

34. The method recited in claim 33, wherein the action is to log the client computer off of a secure communication session.

35. The method recited in claim 33, wherein the action is to terminate the secure communication session with the client computer.

36. The method recited in claim 33, wherein the action is to allow the client computer to access one or more requested resources.

37. The method recited in claim 36, wherein the action is to authorize one or more network servers to provide the client computer with the requested resources.

38. The method recited in claim 33, wherein the action is to provision and execute on the client computer at least one process object.

39. The method recited in claim 38, wherein the at least one process object is a communication process object.

40. The method recited in claim 38, wherein the at least one process object is a security process object.

41. A network device, comprising:

an access module that establishes communication with a client computer;

a provisioning module that installs at least one interrogator agent onto a client computer communicating with the access module;

an end point control module that

analyzes interrogation results provided by the at least one interrogator agent, and

assigns a zone of trust to the client computer based upon the interrogation results provided by the at least one interrogator agent.

42. The network device recited in claim 41, further comprising:

a policy module implementing rules for associating a zone of trust with an operating environment of a client computer.

43. The network device recited in claim 42, wherein the policy module further authenticates an identity associated with a client computer communicating with the access module.

44. The network device recited in claim 43, wherein the provisioning module

installs a first interrogation agent onto a client computer communicating with the access module before the policy module authenticates an identity associated with that client computer;

and

installs a second interrogation agent onto that client computer after the policy module authenticates an identity associated with that client computer.

45. The network device recited in claim 41, wherein the access module establishes secure communication with a client computer.