Network access protection

• US 20060250968A1
• Filed: 05/03/2005
• Published: 11/09/2006
• Est. Priority Date: 05/03/2005
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Hudis, Efim, Mondri, Ron
• Application Number:
  US11/120,759
• Publication Number:
  US 20060250968A1
• Time in Patent Office: Days
• US Class Current: 370/241
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0817 by checking functioning

Abstract

A network access protection method includes creating an access policy as a function of statement-of-health information. The network access protection method also includes selectively allowing, denying or redirecting communications based upon the access policy and the current statement-of-health of one or more computing devices associated with the communications.

Claims

1. A method comprising:

receiving a statement-of-health of a first computing device; and

controlling communications between the first computing device and a second computing device as a function of the statement-of-health of the first computing device.

2. A method according to claim 1, wherein controlling communications between the first and second computing devices further comprises selectively routing communications as a function of the statement-of-health.

3. A method according to claim 1, wherein controlling communications between the first and second computing devices further comprises allowing or denying communications between the first and second computing devices as a function of the statement-of-health of the first computing device.

4. A method according to claim 3, wherein controlling communications between the first and second computing devices further comprises redirecting communications between the first and second computing devices to a third computing device as a function of the statement-of-health of the first computing device.

5. A method according to claim 3, wherein controlling communications between the first and second computing devices further comprises filtering communications between the first and second computing devices as a function of the statement-of-health of the first computing device.

6. A method according to claim 1, further comprising:

receiving a statement-of-health of the second computing device; and

controlling communications between the first and second computing devices as a function of the statement-of-health of the second computing device.

7. A method according to claim 1, further comprising:

receiving a network provisioning or traffic parameter selected from a group consisting of a domain name of a source, a domain name of a destination, an internet protocol address of a source, an internet protocol address of a destination, a communication channel identifier, an application protocol identifier, a security credential of a source and a security credential of a destination; and

further controlling communications between the first and second computing devices as a function of the network provisioning or traffic parameter.

8. One or more computer-readable media having instructions that, when executed on one or more processors, perform acts comprising:

creating an access policy as a function of a statement-of-health based rule; and

applying the access policy to communications between a first computing device and a second computing device based upon a current statement-of-health of the first computing device.

9. One or more computer-readable media according to claim 8, wherein applying the access policy comprises selectively allowing or preventing the communications between the first and second computing devices as a function of the current statement-of-health of the first computing device.

10. One or more computer-readable media according to claim 9, wherein applying the access policy further comprises selectively pushing the first computing device to a resource for updating the first computing device'"'"'s statement-of-health.

11. One or more computer-readable media according to claim 10, wherein applying the access policy further comprises selectively filtering the communications between the first and second computing devices as a function of one or more network provisioning or traffic parameters.

12. One or more computer-readable media according to claim 10, further comprising applying the access policy to communications between the first computing device and the second computing device based upon a current statement-of-health of the second computing device.

13. One or more computer-readable media according to claim 12, wherein applying the access policy further comprises selectively allowing or denying the communications between the first and second computing devices as a function of the current statement-of-health of the second computing device.

14. One or more computer-readable media according to claim 13, wherein applying the access policy further comprises selectively pushing the second computing device to a resource for updating the second computing device'"'"'s statement-of-health.

15. An apparatus comprising:

a processor;

memory communicatively coupled to the processor;

a communication port, communicatively coupled to the processor, for receiving and sending communications;

wherein the apparatus is adapted to receive a current statement-of-health of a computing device associated with a communication and to route the communication according to a statement-of-health based rule and the current statement-of-health.

16. An apparatus according to claim 15, wherein the apparatus is further adapted to selectively filter the communication according to a network provisioning and traffic based rule and the current statement-of-health.

17. An apparatus according to claim 16, wherein the network provisioning and traffic based rule limits the communication as a function of one or more parameters selected from a group consisting of a domain name of a source, a domain name of a destination, an internet protocol address of a source, an internet protocol address of a destination, a communication channel identifier, an application protocol identifier, a security credential of a source and a security credential of a destination.

18. An apparatus according to claim 15, wherein the current statement-of-health comprises a state of a source computing device, a destination computing device or both.

19. An apparatus according to claim 18, wherein the current statement-of-health comprises a state of each of one or more criteria selected from a group consisting of an installed application status, an installed patch status, a configuration status, a device performance status and a presence of a hardware component.

20. An apparatus according to claim 18, wherein the current statement-of-health comprises an aggregation of a state of each of one or more criteria selected from a group consisting of an installed application status, an installed patch status, a configuration status, a device performance status and a presence of a hardware component.