Method and system for verification of an endpoint security scan

• US 20060174115A1
• Filed: 10/21/2005
• Published: 08/03/2006
• Est. Priority Date: 01/28/2005
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Ernest Simmons, Timothy, Rao, Goutham, McCarthy, Lewis
• Granted Patent: US 8,024,568 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user

Abstract

A method of granting access to resources includes the step of receiving a request from a node to access a resource. A scanning agent is generated to gather information about the node. A key is generated and embedded in the scanning agent. The scanning agent is transmitted to the node and gathers information regarding the node. The scanning agent encrypts the gathered information using the at least one generated key. The encrypted gathered information is received from the scanning agent and decrypted.

Claims

1. A method of granting access to resources, the method comprising the steps of:

(a) receiving a request from a node to access a resource;

(b) generating a scanning agent to gather information about the node;

(c) generating at least one key;

(d) embedding in the scanning agent the at least one generated key;

(e) transmitting the scanning agent to the node;

(f) gathering, by the scanning agent, information regarding the node;

(g) encrypting, by the scanning agent, the gathered information using the at least one generated key;

(h) receiving from the scanning agent the encrypted gathered information; and

(i) decrypting the encrypted gathered information.

2. The method of claim 1, wherein step (a) further comprises receiving the request via a network connection.

3. The method of claim 1, wherein step (b) further comprises selecting, for execution on the node, a subset of scan routines from a plurality of available scan routines.

4. The method of claim 1, wherein step (c) further comprises generating a shared secret key.

5. The method of claim 1, wherein step (c) further comprises generating a public key and a private key.

6. The method of claim 5, wherein step (g) further comprises encrypting the gathered information with the generated public key.

7. The method of claim 5, wherein step (i) further comprises decrypting the encrypted gathered information with the generated public key.

8. The method of claim 1, wherein step (d) further comprises obfuscating the scanning agent.

9. The method of claim 1, wherein step (f) further comprises gathering the information across a network connection.

10. The method of claim 1, wherein step (f) further comprises gathering information by executing at least one script on the endpoint.

11. The method of claim 1, wherein step (i) further comprises decrypting the encrypted gathered information with the at least one generated key.

12. A system of granting access to resources by an access gateway comprising:

a receiver, receiving a request to access a resource;

an agent constructor, generating a scanning agent for gathering information about the requester, the scanning agent comprising program code;

a key generator, in communication with the receiver and the agent constructor, generating at least one key;

a encryption function generator, in communication with the agent constructor and the key generator, embedding the at least one generated key in the generated scanning agent; and

a decryptor, receiving encrypted gathered information about the requestor and decrypting the gathered information.

13. The system of claim 12, wherein the agent constructor selects a subset of a plurality of scan routines for execution on the requestor.

14. The system of claim 12, wherein the agent constructor obfuscates the program code of the scanning agent.

15. The system of claim 12, wherein the agent constructor further comprises a transmitter for transmitting the generated scanning agent to the requester.

16. The system of claim 12, wherein the encryption function generator provides functionality for encrypting data with a generated key.

17. The system of claim 12, wherein the receiver receives encrypted gathered information from the scanning agent and transmits the received encrypted gathered information to the decryptor.

18. The system of claim 12, wherein the key generator further comprises generating a shared secret key.

19. The system of claim 12, wherein the key generator further comprises generating a public key and a private key.

20. The system of claim 12, further comprising a policy engine applying a policy to the received gathered information.