Network access control for cloud services

• US 9,087,189 B1
• Filed: 12/30/2011
• Issued: 07/21/2015
• Est. Priority Date: 05/03/2011
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Koeten, Robert, Popp, Nicolas
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Zoubair, Noura
• Application Number:
  US13/341,197
• Time in Patent Office: 1,299 Days
• Field of Search: 726/1, 726/3, 726/4, 726/11, 726/13, 726/22, 719/318, 703/21, 703/22
• US Class Current: 1/1
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 41/022 Multivendor or multi-standard integration
• CPC Class Codes: H04L 41/0226 Mapping or translating multiple network management protocols
• CPC Class Codes: H04L 41/0253 using browsers or web-pages for accessing management information
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/30 Profiles

Abstract

A cloud service access and information gateway receives, from a user device, a request to access a cloud service. The cloud service access and information gateway compares a security status of the user device to a network access control policy for the cloud service. If the security status satisfies a condition of the network access control policy, the cloud service access and information gateway grants the user device access to the cloud service. If the security status does not satisfy the condition of the network access control policy, the cloud service access and information gateway requests an update to the security status of the user device to satisfy the condition.

Claims

1. A method, comprising:

receiving, from a user device, a request to access a cloud service;

comparing, by a processor, a security status of the user device to a network access control policy for the cloud service, wherein the network access control policy defines a level of security specifying a set of security features for the user device based on a category of the user device, a category of information requested, and a category of the cloud service and specifies at least one condition, the condition comprising a presence of an updated version of a security agent on the user device;

determining that the user device does not include the updated version of the security agent as specified by the condition of the network access control policy;

determining an update to the security status of the user device that will cause the security status of the user device to satisfy the condition for future requests to access the cloud service;

redirecting the request to a security provider, the security provider to provide an updated version of the security agent to the user device in order to satisfy the condition of the network access control policy; and

upon determining that the security status of the user device satisfies the condition of the network access control policy granting the user device access to the cloud service.

2. The method of claim 1, wherein the cloud service comprises at least one of a public cloud service or a private cloud service.

3. The method of claim 1, wherein the network access control policy comprises one of a plurality of network access control policies.

4. The method of claim 3, wherein the condition comprises at least one of a presence of security software, a security signature or an encryption capability.

5. The method of claim 1, wherein a cloud service access and information gateway compares the security status of the user device to the network access control policy.

6. The method of claim 5, wherein the cloud service access and information gateway is independent of the user device and the cloud service.

7. The method of claim 1, wherein determining the update to the security status of the device comprises identifying at least one of security software, a security agent, a security signature or an encryption capability in real time before responding to the request.

8. A system, comprising:

a memory; and

a processor coupled with the memory to;

receive, from a user device, a request to access a cloud service;

compare a security status of the user device to a network access control policy for the cloud service, wherein the network access control policy defines a level of security specifying a set of security features for the user device based on a category of the user device, a category of information requested, and a category of the cloud service and specifies at least one condition, the condition comprising a presence of an updated version of a security agent on the user device;

determine that the user device does not include the updated version of the security agent as specified by the condition of the network access control policy;

determine an update to the security status of the user device that will cause the security status of the user device to satisfy the condition for future requests to access the cloud service;

redirect the request to a security provider, the security provider to provide an updated version of the security agent to the user device in order to satisfy the condition of the network access control policy; and

upon determining that the security status of the user device satisfies the condition of the network access control policy, grant the user device access to the cloud service.

9. The system of claim 8, wherein the cloud service comprises at least one of a public cloud service or a private cloud service.

10. The system of claim 8, wherein the network access control policy comprises one of a plurality of network access control policies.

11. The system of claim 10, wherein the condition comprises at least one of a presence of security software, a security signature or an encryption capability.

12. The system of claim 8, wherein a cloud service access and information gateway compares the security status of the user device to the network access control policy.

13. The system of claim 12, wherein the cloud service access and information gateway is independent of the user device and the cloud service.

14. The system of claim 8, wherein to determine the update to the security status of the device, the processor to identify at least one of security software, a security agent, a security signature or an encryption capability in real time before responding to the request.

15. A non-transitory computer readable storage medium including instructions that, when executed by a processor, cause the processor to perform operations comprising:

receiving, from a user device, a request to access a cloud service;

comparing, by a processor, a security status of the user device to a network access control policy for the cloud service, wherein the network access control policy defines a level of security specifying a set of security features for the user device based on a category of the user device, a category of information requested, and a category of the cloud service and specifies at least one condition, the condition comprising a presence of an updated version of a security agent on the user device;

determining that the user device does not include the updated version of the security agent as specified by the condition of the network access control policy;

determining an update to the security status of the user device that will cause the security status of the user device to satisfy the condition for future requests to access the cloud service;

redirecting the request to a security provider, the security provider to provide an updated version of the security agent to the user device in order to satisfy the condition of the network access control policy; and

upon determining that the security status of the user device satisfies the condition of the network access control policy, granting the user device access to the cloud service.

16. The non-transitory computer readable storage medium of claim 15, wherein the cloud service comprises at least one of a public cloud service or a private cloud service.

17. The non-transitory computer readable storage medium of claim 15, wherein the condition comprises at least one of a presence of security software, a security signature or an encryption capability.

18. The non-transitory computer readable storage medium of claim 15, wherein a cloud service access and information gateway compares the security status of the user device to the network access control policy.

19. The non-transitory computer readable storage medium of claim 18, wherein the cloud service access and information gateway is independent of the user device and the cloud service.

20. The non-transitory computer readable storage medium of claim 15, wherein determining the update to the security status of the device comprises identifying at least one of security software, a security agent, a security signature or an encryption capability in real time before responding to the request.