Method and system for performing a security check

• US 7,627,758 B1
• Filed: 08/13/2004
• Issued: 12/01/2009
• Est. Priority Date: 08/13/2004
• Status: Active Grant

• Current Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Original Assignee: Juniper Networks Incorporated
• Inventors: Harding, Andrew R., Egorov, Vadim, Srinivas, Sampath, Tock, Theron
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): TABOR, AMARE F
• Application Number:
  US10/917,338
• Time in Patent Office: 1,936 Days
• Field of Search: 713/168, 713187-189, 713192-194
• US Class Current: 713/168
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An access request is transmitted from a first device to a second device causing one or more security functions to be executed on the first device. Whether to grant the access request is based on a result of the executed one or more security functions.

Claims

1. A method for implementing a security system comprising:

configuring a group of security modules via a standardized interface to add one or more independently produced security modules, the security modules each implementing one or more security functions that are to be executed on a remote device;

transmitting the group of security modules to the remote device for execution of the one or more security functions implemented by the security modules at the remote device;

causing the one or more security functions to be executed at predetermined intervals; and

determining whether to grant an access request based on a result of the executed one or more security functions.

2. The method of claim 1, where the added one or more security modules each include a field that includes a name of the provider of the added security module.

3. The method of claim 1, where the security functions in the group of security modules relate to one or more of spyware detection, virus detection, or detection of missing software patches.

4. The method of claim 1, where the group of security modules is transmitted in a compressed archive format.

5. The method of claim 1, where the group of security modules includes:

a package manifest section that includes a name of a provider of the security module.

6. The method of claim 5, where the package manifest section further includes a version number.

7. The method of claim 1, where the group of security modules further includes:

a security module section that includes an identification of one or more policies supported by the security module.

8. The method of claim 1, where the group of security modules further includes:

a security framework section that includes a program interface for the security module.

9. The method of claim 8, where the program interface for the security framework section includes:

an SC_CreateInstance function called to initialize entry points to the security module.

10. The method of claim 8, where the program interface for the security framework section includes:

a GetAPIVersion function called to obtain an application program interface (API) version of additional security software at the remote device.

11. The method of claim 1, where the group of security modules further includes:

a package manifest section that includes a name of a provider of the security module;

a security module section that includes an identification of one or more policies supported by the security module; and

a security framework section that includes a program interface for the security module.

12. The method of claim 1, further comprising:

receiving a result of the one or more executed security functions.

13. The method of claim 1, where the independently produced security modules are produced by entities different than an entity that produced the security system.

14. A computing device comprising:

storage including a plurality of instructions; and

a processor operable to execute the instructions included in the storage, where when the processor executes the instructions, the processor is to;

receive an access request from a remote device;

retrieve a security module provided by a third party, the security module including one or more security functions that are to be executed on the remote device;

transmit the security module to the remote device;

receive results from the remote device of the one or more security functions that are to be executed at predetermined intervals on the remote device; and

determine whether to grant the access request based on a result of the executed one or more security functions.

15. The computing device of claim 14, where the one or more security functions in the security module relate to one or more of spyware detection, virus detection, or detection of missing software patches.

16. The computing device of claim 14, where the security module further includes:

a package manifest section that includes a name of the third party.

17. The computing device of claim 16, where the package manifest section further includes a version number.

18. The computing device of claim 14, where the security module further includes:

a security module section that includes an identification of one or more policies supported by the security module.

19. The computing device of claim 14, where the security module further includes:

a security framework section that includes a program interface for the security module.

20. The computing device of claim 19, where the program interface for the security framework section includes:

an SC_CreateInstance function called to initialize entry points to the security module.

21. The computing device of claim 19, where the program interface for the security framework section includes:

a GetAPIVersion function called to obtain an application program interface (API) version of additional security software at the remote device.

22. The computing device of claim 14, where the security module includes:

a package manifest section that includes a name of a provider of the security module;

a security module section that includes an identification of one or more policies supported by the security module; and

a security framework section that includes a program interface for the security module.

23. A security module data structure stored on a computer-readable memory device to be executed as part of a security system, the security module data structure comprising:

a package manifest section that includes an identifier of a provider of the security module data structure;

a security module section that includes an identification of one or more security policies supported by the security module data structure;

a security framework section that includes a program interface for the security module data structure; and

one or more security functions that are to be executed at predetermined intervals on a client device to perform security operations on the client device, where the security module data structure is to be transmitted to the client device in response to an access request from the client device for a network resource and where permission for the client device to access the network resource is granted based on a result of execution of the one or more security functions.

24. The security module data structure of claim 23, where the security module data structure is distributed in a compressed archive format.

25. The security module data structure of claim 23, where the security functions in the security module relate to one or more of spyware detection, virus detection, or detection of missing software patches.

26. The security module data structure of claim 23, where the program interface for the security framework section includes:

an SC_CreateInstance function called to initialize entry points to the security module data structure.

27. The security module data structure of claim 23, where the program interface for the security framework section includes:

a GetAPIVersion function called to obtain an application program interface (API) version of additional security software at the client device.

28. The security module data structure of claim 23, where the provider includes a provider different than a provider of the security system.