System, method, apparatus and computer program product for facilitating digital communications

• US 20050086510A1
• Filed: 08/16/2004
• Published: 04/21/2005
• Est. Priority Date: 08/15/2003
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: Fiberlink Communications Corporation (International Business Machines Corporation)
• Inventors: Pappano, Joseph E., Bluestone, Derek, Adams, Clinton, Pressman, Howard M., Nicodemus, Blair Gaver
• Granted Patent: US 7,395,341 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: H04L 12/2898 Subscriber equipments DSL modems H04M11/062; cable modems H04L12/2801
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0414 during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/168 specially adapted for link layer protocols, e.g. asynchronous transfer mode [ATM], synchronous optical network [SONET] or point-to-point protocol [PPP]
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 74/00 Wireless channel access

Abstract

A computer-implemented method and apparatus prevents unsecured access to a computer over a network by a client running on a remote computer. In one aspect of the present invention, a client policy is stored on the remote computer. The client policy includes a configuration of the remote computer that reduces the likelihood of a security breach of the computer as a result of the remote computer accessing the computer. A request is received from a user for access to the computer. It is verified that the remote computer conforms with the client policy, and the client is connected to said computer.

Claims

1. A computer-implemented method for preventing unsecured access to a computer over a network by a client running on a remote computer comprising:

storing a client policy on said remote computer, said client policy including a configuration of said remote computer that reduces the likelihood of a security breach of said computer as a result of said remote computer accessing said computer;

receiving a request from a user for access to said computer;

verifying that the remote computer conforms with said client policy; and

connecting said client to said computer.

2. The method recited in claim 1, wherein said verifying step includes verifying that none of a list of forbidden applications are running on said remote computer.

3. The method recited in claim 1, wherein said verifying step includes verifying that none of a list of forbidden applications are running on said remote computer, said list of forbidden applications including at least one of:

viruses, spyware, instant messaging, unlicensed, and file sharing applications.

4. The method recited in claim 1, wherein said verifying step includes verifying that all of a list of required applications are running on said remote computer.

5. The method recited in claim 1, wherein said verifying step includes verifying that all of a list of required applications are running on said remote computer, said list of required applications including at least one of:

firewall, anti-virus, and anti-spyware applications.

6. The method recited in claim 1, further comprising:

periodically determining that said remote computer conforms with said client policy; and

taking a policy based action, said policy based action including at least one of;

correcting a non-conforming condition and notifying said user of said non-conforming condition.

7. The method recited in claim 6, further comprising:

disconnecting said client from at least one of said computer and an Internet connection if said non-conforming condition cannot be corrected.

8. The method recited in claim 1, further comprising:

transmitting a list of policy violations to an access control gateway.

9. A computer-implemented method for preventing unsecured access to a computer over a network by a client running on a remote computer comprising:

storing at least one client policy, said client policy including a configuration of said remote computer that reduces the likelihood of a security breach of said computer as a result of said remote computer accessing said computer;

receiving a request from a user for access to said computer;

determining a location type of said remote computer;

selecting a desired policy from among said at least one client policy based on said location type of said remote computer;

selecting a connection type from available connections to said computer based on said desired policy;

verifying that said remote computer conforms with said desired policy; and

connecting said client to said computer.

10. The method recited in claim 9, wherein said determining step includes determining said location type of one of:

non-corporate/non-roaming, corporate/non-roaming, and non-corporate/roaming.

11. The method recited in claim 9, wherein said verifying step includes verifying that none of a list of forbidden applications are running on said remote computer.

12. The method recited in claim 9, wherein said verifying step includes verifying that none of a list of forbidden applications are running on said remote computer, said list of forbidden applications including at least one of:

viruses, spyware, instant messaging, unlicensed, and file sharing applications.

13. The method recited in claim 9, wherein said verifying step includes verifying that all of a list of required applications are running on said remote computer.

14. The method recited in claim 9, wherein said verifying step includes verifying that all of a list of required applications are running on said remote computer, said list of required applications including at least one of:

firewall, anti-virus, and anti-spyware applications.

15. The method recited in claim 9, further comprising:

periodically determining that said remote computer conforms with said client policy; and

taking a policy based action, said policy based action including at least one of;

correcting a non-conforming condition and notifying said user of said non-conforming condition.

16. The method recited in claim 15, further comprising:

disconnecting said client from at least one of said computer and an Internet connection if said non-conforming condition cannot be corrected.

17. The method recited in claim 9, further comprising:

transmitting a list of policy violations to an access control gateway.

18. A computer-implemented method for preventing unsecured access to a computer over a network by a client running on a remote computer comprising:

transmitting a client policy to said remote computer, said client policy including a configuration of said remote computer that reduces the likelihood of a security breach of said computer as a result of said remote computer accessing said computer;

receiving a list of policy violations from said remote computer; and

modifying access rights of a user operating said remote computer.

19. The method recited in claim 18, wherein said modifying step includes denying said remote computer access to said computer.

20. A computer program product including a computer storage medium and a computer program code mechanism embedded in the computer storage medium for preventing unsecured access to a computer over a network by a client running on a remote computer, the computer code mechanism comprising:

a computer code device configured to store a client policy on said remote computer, said client policy including a configuration of said remote computer that reduces the likelihood of a security breach of said computer as a result of said remote computer accessing said computer;

a computer code device configured to receive a request from a user for access to said computer;

a computer code device configured to verify that the remote computer conforms with said client policy; and

a computer code device configured to connect said client to said computer.

21. A computer program product including a computer storage medium and a computer program code mechanism embedded in the computer storage medium for preventing unsecured access to a computer over a network by a client running on a remote computer, the computer code mechanism comprising:

a computer code device configured to store at least one client policy, said client policy including a configuration of said remote computer that reduces the likelihood of a security breach of said computer as a result of said remote computer accessing said computer;

a computer code device configured to receive a request from a user for access to said computer;

a computer code device configured to determine a location type of said remote computer;

a computer code device configured to select a desired policy from among said at least one client policy based on said location type of said remote computer;

a computer code device configured to select a connection type from available connections to said computer based on said desired policy;

a computer code device configured to verify that said remote computer conforms with said desired policy; and

a computer code device configured to connect said client to said computer.

22. A computer program product including a computer storage medium and a computer program code mechanism embedded in the computer storage medium for preventing unsecured access to a computer over a network by a client running on a remote computer, the computer code mechanism comprising:

a computer code device configured to transmit a client policy to said remote computer, said client policy including a configuration of said remote computer that reduces the likelihood of a security breach of said computer as a result of said remote computer accessing said computer;

a computer code device configured to receive a list of policy violations from said remote computer; and

a computer code device configured to modify access rights of a user operating said remote computer.

23. An apparatus for preventing unsecured access to a computer over a network by a client running on a remote computer comprising:

means for storing a client policy on said remote computer, said client policy including a configuration of said remote computer that reduces the likelihood of a security breach of said computer as a result of said remote computer accessing said computer;

means for receiving a request from a user for access to said computer;

means for verifying that the remote computer conforms with said client policy; and

means for connecting said client to said computer.

24. An apparatus for preventing unsecured access to a computer over a network by a client running on a remote computer comprising:

means for storing at least one client policy, said client policy including a configuration of said remote computer that reduces the likelihood of a security breach of said computer as a result of said remote computer accessing said computer;

means for receiving a request from a user for access to said computer;

means for determining a location type of said remote computer;

means for selecting a desired policy from among said at least one client policy based on said location type of said remote computer;

means for selecting a connection type from available connections to said computer based on said desired policy;

means for verifying that said remote computer conforms with said desired policy; and

means for connecting said client to said computer.

25. An apparatus for preventing unsecured access to a computer over a network by a client running on a remote computer comprising:

means for transmitting a client policy to said remote computer, said client policy including a configuration of said remote computer that reduces the likelihood of a security breach of said computer as a result of said remote computer accessing said computer;

means for receiving a list of policy violations from said remote computer;

means for modifying access rights of a user operating said remote computer.

26. An apparatus for preventing unsecured access to a computer over a network by a client running on a remote computer comprising:

a storage mechanism configured to store a client policy on said remote computer, said client policy including a configuration of said remote computer that reduces the likelihood of a security breach of said computer as a result of said remote computer accessing said computer;

an input/output device configured to receive a request from a user for access to said computer; and

a processor including a verification mechanism configured to verify that the remote computer conforms with said client policy,

wherein said input/output device is configured to connect said client to said computer.

27. The apparatus recited in claim 26, wherein said verification mechanism is configured to verify that none of a list of forbidden applications are running on said remote computer.

28. The apparatus recited in claim 27, wherein said list of forbidden applications includes at least one of:

viruses, spyware, instant messaging, unlicensed, and file sharing applications.

29. The apparatus recited in claim 26, wherein said verification mechanism is configured to verify that all of a list of required applications are running on said remote computer.

30. The apparatus recited in claim 29, wherein said list of required applications includes at least one of:

firewall, anti-virus, and anti-spyware applications.

31. An apparatus for preventing unsecured access to a computer over a network by a client running on a remote computer comprising:

a storage mechanism configured to store at least one client policy, said client policy including a configuration of said remote computer that reduces the likelihood of a security breach of said computer as a result of said remote computer accessing said computer;

an input/output device configured to receive a request from a user for access to said computer; and

a processor including;

a location determination mechanism configured to determine a location type of said remote computer;

a policy selection mechanism configured to select a desired policy from among said at least one client policy based on said location type of said remote computer;

a connection selection mechanism configured to select a connection type from available connections to said computer based on said desired policy; and

a verification mechanism configured to verify that said remote computer conforms with said desired policy,

wherein said input/output device is configured to connect said client to said computer.

32. The apparatus recited in claim 31, wherein said verification mechanism is configured to verify that none of a list of forbidden applications are running on said remote computer.

33. The apparatus recited in claim 32, wherein said list of forbidden applications includes at least one of:

viruses, spyware, instant messaging, unlicensed, and file sharing applications.

34. The apparatus recited in claim 31, wherein said verification mechanism is configured to verify that all of a list of required applications are running on said remote computer.

35. The apparatus recited in claim 34, wherein said list of required applications includes at least one of:

firewall, anti-virus, and anti-spyware applications.

36. An apparatus for preventing unsecured access to a computer over a network by a client running on a remote computer comprising:

an input/output device configured to transmit a client policy to said remote computer, said client policy including a configuration of said remote computer that reduces the likelihood of a security breach of said computer as a result of said remote computer accessing said computer, said input/output device configured to receive a list of policy violations from said remote computer; and

a processor including an access control mechanism configured to modify access rights of a user operating said remote computer.

37. The method recited in claim 36, wherein said access control mechanism is configured to deny said remote computer access to said computer.