Method and system for assigning access control levels in providing access to networked content files

• US 20060190455A1
• Filed: 03/01/2006
• Published: 08/24/2006
• Est. Priority Date: 09/30/2004
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Simmons, Timothy Ernest, Braddy, Ricky Gene, Cockerill, Aaron David
• Granted Patent: US 8,065,423 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/88 Mark-up to mark-up conversion conversion for visualization in web browsing G06F16/9577
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 4/18 Information format or content conversion, e.g. adaptation by the network of the transmitted or received information for the purpose of wireless delivery to users or terminals

Abstract

A method and system for assigning access control levels when granting access to resources includes a client node, a collection agent, and a policy engine. The client node requests access to a resource. The collection agent gathers information about the client node. The policy engine receives the gathered information and assigns one of a plurality of levels of access responsive to application of a policy to the received information and transmits the information.

Claims

1. A system of granting access to resources comprising:

a client node requesting access to a resource;

a collection agent gathering information about the client node; and

a policy engine receiving the gathered information, identifying one of a plurality of levels of access responsive to application of a policy to the received information, and transmitting the identification.

2. The system of claim 1 wherein the policy engine further comprises a database storing configurable policies.

3. The system of claim 1, wherein the policy engine resides on a server.

4. The system of claim 1, wherein the policy engine resides on a firewall.

5. The system of claim 1 wherein a system administrator configures policies in the policy engine to provide a level of access control rights to the client node.

6. The system of claim 1 wherein the policy engine transmits instructions to the collection agent determining the type of information the collection agent gathers.

7. The system of claim 1, wherein the policy engine transmits a policy determination to a firewall.

8. The system of claim 1, wherein the policy engine transmits the identification to a firewall.

9. The system of claim 1, wherein the policy engine comprises a Remote Authentication Dial In User Service (RADIUS) server.

10. The system of claim 1, wherein the policy engine resides on a Remote Authentication Dial In User Service (RADIUS) server.

11. The system of claim 1, further comprising a Remote Authentication Dial In User Service (RADIUS) server receiving the gathered information and transmitting the gathered information to the policy engine.

12. The system of claim 1 wherein the policy engine transmits the collection agent to the client node.

13. The system of claim 1 wherein the collection agent executes on the client node.

14. The system of claim 1 wherein the collection agent comprises at least one script.

15. The system of claim 1 wherein the collection agent comprises bytecode.

16. The system of claim 1 wherein the collection agent gathers the information by running at least one script on the client node.

17. The system of claim 1 wherein the collection agent transmits a request to the policy engine for instructions identifying the type of information the collection agent gathers.

18. The system of claim 1 wherein the collection agent gathers information about the client node, said information residing on a server.

19. The system of claim 18, wherein the collection agent gathers information comprising HTTP headers.

20. The system of claim 18, wherein the collection agent gathers information comprising the network zone of the client node.

21. The system of claim 18, wherein the collection agent gathers information comprising the method of authentication used by the client node.

22. The system of claim 1 wherein the collection agent gathers a machine ID of the client node.

23. The system of claim 1 wherein the collection agent gathers information comprising operating system type.

24. The system of claim 1 wherein the collection agent gathers information comprising existence of a patch to an operating system.

25. The system of claim 1 wherein the collection agent gathers information comprising MAC addresses of installed network cards.

26. The system of claim 1 wherein the collection agent gathers information comprising a watermark on the client device.

27. The system of claim 1 wherein the collection agent gathers information comprising membership in an Active Directory.

28. The system of claim 1 wherein the collection agent gathers information comprising existence of a virus scanner.

29. The system of claim 1 wherein the collection agent gathers information comprising existence of a firewall.

30. The system of claim 1 wherein the collection agent gathers information comprising an HTTP header.

31. A method of granting access to resources, the method comprising:

(a) requesting, by a client node, access to a resource;

(b) gathering, by a collection agent, information about the client node;

(c) receiving, by the policy engine, the gathered information; and

(d) transmitting an access control decision assigning one of a plurality of levels of access responsive to application of a policy to the received information.

32. The method of claim 31, wherein step (a) further comprises requesting the resource over a network connection.

33. The method of claim 31, wherein step (b) further comprises gathering the information over a network connection.

34. The method of claim 31, wherein step (b) further comprises gathering information by executing at least one script on the client node.

35. The method of claim 31, wherein step (c) further comprises determining if the received information satisfies a condition.

36. The method of claim 35, further comprising determining if the received information satisfies a condition by comparing the received information to at least one condition.

37. The method of claim 36, wherein step (d) further comprises making an access control decision by applying a policy to the condition.

38. The method of claim 31, wherein step (c) comprises receiving, by a Remote Authentication Dial In User Service (RADIUS) server, the gathered information.

39. The method of claim 31, wherein step (c) further comprises receiving, by a policy engine, the gathered information.

40. The method of claim 31, wherein step (d) further comprises transmitting the access control decision to a firewall.

41. The method of claim 31, wherein step (d) further comprises transmitting, by the policy engine, the access control decision.

42. The method of claim 31, wherein step (d) further comprises transmitting, by an SSL VPN, the access control decision.