METHOD AND APARATUS FOR PRESENCE BASED RESOURCE MANAGEMENT

• US 20140181889A1
• Filed: 12/21/2012
• Published: 06/26/2014
• Est. Priority Date: 12/21/2012
• Status: Active Grant

• Current Assignee: Forcepoint LLC (Francisco Partners Management LLC)
• Original Assignee: Forcepoint LLC (Francisco Partners Management LLC)
• Inventors: Black, Robert Barth
• Granted Patent: US 9,117,054 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time

Abstract

Methods and apparatus provide resource authorization based on a computer'"'"'s presence information. Presence information may include information relating to a computer'"'"'s operating environment. In some implementations, a presence detector on a computer determines presence information and provides the information to a resource manager. The computer may then generate a resource access request. A resource manager may then determine whether the resource request is authorized based, at least in part, on the presence information. The resource manager then responds to the resource access request, either granting or denying the request for resources.

Claims

1. A method of managing a computer'"'"'s access to resources, comprising:

receiving a request for computer resources;

executing instructions on computer hardware to determine presence information relating to the computer;

determining a resource control policy to apply to the request for computer resources based on the presence information; and

executing instructions on computer hardware to allow or disallow the request for resources based on the policy.

2. The method of claim 1, wherein the presence information indicates an interactivity level on the computer.

3. The method of claim 2, wherein an interactivity level is based on whether an input has been received from an input device directly connected to the computer within a time period.

4. The method of claim 2, wherein an interactivity level is based on whether an interactive shell is running on the computer.

5. The method of claim 2, wherein an interactivity level is based on whether a screen saver is active on the computer'"'"'s console.

6. The method of claim 1, wherein an interactivity level is based on the amount of idle CPU cycles on the computer within a time period.

7. The method of claim 1, wherein the presence information indicates whether the computer is communicating over a secure network connection.

8. The method of claim 1, wherein the presence information indicates the computer'"'"'s location within a corporate network.

9. The method of claim 1, wherein the presence information indicates the physical location of the computer.

10. The method of claim 1, wherein the resource control policy controls the use of hardware resources of the computer.

11. The method of claim 1, wherein the resource control policy controls access to network data by the computer.

12. The method of claim 10, wherein the access to network data is controlled based, at least in part, on one or more content categories of a URL identifying the network data.

13. The method of claim 12 wherein a first set of URL categories are accessible to the computer when the presence information indicates a first presence state and a second set of URL categories are accessible to the computer when the presence information indicates a second presence state.

14. The method of claim 1, wherein the resource control policy controls whether network communication by the computer is encrypted.

15. The method of claim 1, wherein the resource control policy controls whether network data sent by the computer is compressed.

16. The method of claim 1, wherein the resource control policy controls whether network data sent by the computer is signed.

17. The method of claim 1, wherein the resource control policy controls the rate at which data sent or received by the computer may be transferred on a network.

18. The method of claim 1, wherein the resource control policy controls content of email messages sent by the computer.

19. An apparatus for managing a computer'"'"'s access to resources, comprising:

a memory;

a processor, configured to fetch instructions from the memory; and

a network interface, operatively coupled to the processor,

wherein the memory stores;

a presence management module, configured to cause the processor to receive and store presence information for the computer to a storage,

a URL filtering interface module, configured to cause the processor to receive a URL access request including a requested URL,

a URL categorization module, configured to cause the processor to determine one or more URL categories of the requested URL,

a policy determination module, configured to cause the processor to determine a policy to apply to the requested URL based, at least in part, on the presence information for the computer, and

a policy application module, configured to cause the processor to authorize or not authorize access to the requested URL by the computer based, at least in part, on the determined policy and the one or more URL categories.

20. The apparatus of claim 19, wherein the presence information indicates an interactivity level of the computer.

21. The apparatus of claim 19, wherein the URL access request is based, at least in part, on a request for the URL by the computer.

22. An apparatus for managing a computer'"'"'s access to resources, comprising:

means for determining presence information relating to the computer; and

means for applying a resource control policy based on the presence information.

23. The apparatus of claim 22, wherein the presence information indicates at least one of an interactivity level of the computer or the computer'"'"'s location within a corporate network, and wherein the resource control policy controls access to network data based, at least in part, on one or more content categories of a URL identifying the network data.

24. A non-transitory computer readable medium, storing instructions that when executed by a processor perform a method of managing a computer'"'"'s access to resources, the method comprising:

determining presence information relating to the computer; and

applying a resource control policy based on the presence information.

25. The non-transitory computer readable medium of claim 24, wherein the presence information indicates at least one of an interactivity level of the computer or the computer'"'"'s location within a corporate network, and wherein the resource control policy controls access to network data based, at least in part, on one or more content categories of a URL identifying the network data.