POLICY-BASED COMPLIANCE MANAGEMENT AND REMEDIATION OF DEVICES IN AN ENTERPRISE SYSTEM

• US 20160088021A1
• Filed: 04/17/2015
• Published: 03/24/2016
• Est. Priority Date: 09/24/2014
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Mohamad Abdul, Mohamad Raja Gani, Jayanti Venkata, Bhagavati Kumar, Maheshwari, Harsh, Kandasamy, Parthipan
• Granted Patent: US 9,749,311 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06F 9/452 Remote windowing, e.g. X-Window System, desktop virtualisation protocols for virtual reality H04L67/131
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 : Access control lists [ACL]
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/104 : Grouping of entities
• CPC Class Codes: H04L 63/105 : Multiple levels of security
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 : involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/12 : specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/55 : Push-based network services
• CPC Class Codes: H04L 67/75 : Indicating network or usage conditions on the user display
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/33 : using wearable devices, e.g. using a smartwatch or smart-glasses
• CPC Class Codes: H04W 16/06 : Hybrid resource partitioning, e.g. channel borrowing
• CPC Class Codes: H04W 4/08 : User group management
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/60 : Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
• CPC Class Codes: H04W 4/70 : Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

The present disclosure relates generally to managing compliance of remote devices that access an enterprise system. More particularly, techniques are disclosed for using a compliance policy to manage remediation of non-compliances of remote devices that access an enterprise system. A device access management system may be implemented to automate remediation of non-compliances of remote devices accessing an enterprise system. Remediation may be controlled based on different levels of non-compliance, each defined by one or more different non-compliances. In some embodiments, a level of non-compliance may be conditionally defined by one or more user roles for which non-compliance is assessed. Access to computing resources of an enterprise system may be controlled for a remote device based on compliance of the remote device. Access may be inhibited for those resources not permitted during a time period of a non-compliance.

Claims

1. A method comprising:

identifying a compliance policy for using a remote device with an enterprise computer system, wherein the remote device is registered to access the enterprise computer system;

detecting, based on the compliance policy, a non-compliance of the remote device;

assessing, by a computer system, based on the compliance policy, a level of non-compliance of the remote device;

establishing, based on the compliance policy and the level of non-compliance, a time period for remediation of the non-compliance;

receiving a request to access a computing resource in the enterprise computer system;

providing access to the computing resource based on the level of non-compliance;

inhibiting access to the computing resource in the enterprise computer system based on the level of non-compliance and based on determining that the time period has expired; and

instructing the remote device to perform an action to remedy the non-compliance based on determining that the time period has expired.

2. The method of claim 1, wherein the compliance policy indicates the action to remedy the non-compliance and indicates a time period for performing the action.

3. The method of claim 1, wherein the compliance policy indicates a condition for the non-compliance, and wherein the condition is based on a first user role, and wherein the compliance policy identifies the time period for remediation of the non-compliance and the action for remedying the non-compliance based on determining that the condition is satisfied.

4. The method of claim 3, further comprising:

identifying a user role associated with an identity of a user of the remote device, the user role enabling the identity to access the enterprise computer system; and

determining that the condition is satisfied based on the user role matching the first user role.

5. The method of claim 3, further comprising:

determining one or more device attributes of the remote device and a geolocation of the remote device, wherein the condition is further based on a remote device attribute and a remote device geolocation; and

determining that the condition is satisfied based on the remote device attribute matching a device attribute of the remote device and based on the geolocation of the remote device matching the remote device geolocation.

6. The method of claim 1, wherein the non-compliance of the remote device includes altering a hardware configuration of the remote device.

7. The method of claim 1, wherein the non-compliance of the remote device includes installing a blacklisted application on the remote device.

8. The method of claim 1, wherein the non-compliance of the remote device includes use of the remote device in a manner that is non-compliant with a policy related to registration of the remote device to access the enterprise computer system.

9. The method of claim 1, wherein the non-compliance of the remote device includes adjusting a security configuration of the remote device in a manner that is non-compliant with a security policy for accessing the enterprise computer system.

10. The method of claim 1, further comprising:

wherein access to the computing resource is provided based on determining that the level of non-compliance satisfies a compliance threshold, and wherein access to the computing resource is inhibited based on determining that the level of non-compliance does not satisfy a compliance threshold.

11. The method of claim 1, further comprising:

identifying a second compliance policy for using the remote device with the enterprise computer system, wherein the compliance policy is a first compliance policy that is different from the second compliance policy;

detecting a second non-compliance of the remote device based on the second compliance policy; and

wherein the time period is established based on selecting a time period from one of the first compliance policy or the second compliance policy.

12. The method of claim 11, further comprising:

assessing, based on the second compliance policy, a second level of non-compliance of the remote device, wherein the level of non-compliance corresponds to a first level of non-compliance, and wherein the time period is selected based on comparing the first level of non-compliance or the second level of non-compliance.

13. The method of claim 1, wherein the action includes preventing access to use of the remote device with the enterprise computer system.

14. The method of claim 1, wherein the action includes altering registration of the remote device to access the enterprise computer system.

15. A non-transitory computer-readable medium for protecting a computer from an electronic communication containing malicious code, comprising instructions stored thereon, that when executed on a processor, perform the steps of claim 1.

16. A system comprising:

one or more processors; and

a memory storing instructions that, when executed by the one or more processors, cause the one or more processors to;

identify a compliance policy for using a remote device with an enterprise computer system, wherein the remote device is registered to access the enterprise computer system;

detect, based on the compliance policy, a non-compliance of the remote device;

assess, by a computer system, based on the compliance policy, a level of non-compliance of the remote device;

establish, based on the compliance policy and the level of non-compliance, a time period for remediation of the non-compliance;

receive a request to access a computing resource in the enterprise computer system;

provide access to the computing resource based on the level of non-compliance;

inhibit access to the computing resource in the enterprise computer system based on the level of non-compliance and based on determining that the time period has expired; and

instruct the remote device to perform an action to remedy the non-compliance based on determining that the time period has expired.

17. The system of claim 16, wherein the instructions, when executed by the one or more processors, further cause the one or more processors to:

identify a second compliance policy for using the remote device with the enterprise computer system, wherein the compliance policy is a first compliance policy that is different from the second compliance policy;

detect a second non-compliance of the remote device based on the second compliance policy; and

assess, based on the second compliance policy, a second level of non-compliance of the remote device, wherein the level of non-compliance corresponds to a first level of non-compliance, and

wherein the time period is established based on selecting a time period from one of the first compliance policy or the second compliance policy.

18. A method comprising:

identifying a compliance policy for using a remote device with an enterprise computer system, wherein the remote device is registered to access the enterprise computer system;

detecting, by a computer system, a non-compliance of the remote device based on the compliance policy;

categorizing the non-compliance into a level of non-compliance based on the compliance policy and establishing a time period for remediation of the non-compliance;

allowing access to a first computing resource in the enterprise computer system despite the level of non-compliance;

inhibiting access to a second computing resource in the enterprise computer system based on the level of non-compliance;

determining that the time period has passed;

inhibiting access to the first computing resource in the enterprise computer system based on the level of non-compliance and based on determining that the time period has passed; and

transmitting a message to the remote device based on determining that the time period has passed, wherein the message instructs the remote device to automatically remedy the non-compliance.

19. The method of claim 18, wherein the time period is stored with the compliance policy and is established based on the level of non-compliance.

20. The method of claim 18, wherein the compliance policy is a first compliance policy associated with a user role for accessing the enterprise computer system, and wherein the method further comprises:

identifying a second compliance policy for using the remote device to access the enterprise computer system;

observing a second non-compliance of the remote device based on the second compliance policy; and

selecting the time period from the first compliance policy for implementation over a time period of the second compliance policy.