METHODS AND SYSTEMS FOR ACCESS ROUTING AND RESOURCE MAPPING USING FILTERS

• US 20090006618A1
• Filed: 06/28/2007
• Published: 01/01/2009
• Est. Priority Date: 06/28/2007
• Status: Abandoned Application

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Hayton, Richard
• Application Number:
  US11/769,896
• Publication Number:
  US 20090006618A1
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for access routing and resource mapping using filters includes the step of receiving a request from a client for access to a resource. A rule is identified, the rule having a rule priority level and associated with: i) a filter, ii) at least one method for providing access to the resource, and iii) a server in a plurality of servers. The filter is applied, the filter identifying at least one pre-requisite to accessing the resource. A determination is made that the client satisfies the at least one pre-requisite, responsive to applying the filter. A determination is made regarding whether to provide access to the resource to the client by the server in the plurality of servers according to the at least one method for providing access to the resource. The server in the plurality of servers provides access to the resource for the client according to the at least one method for providing access to the resource.

Claims

1. A method for access routing and resource mapping using filters, the method comprising the steps of:

(a) receiving a request from a client for access to a resource;

(b) identifying a rule having a rule priority level and associated with;

i) a filter, ii) at least one method for providing access to the resource, and iii) a server in a plurality of servers;

(c) applying the filter, the filter identifying at least one pre-requisite to accessing the resource;

(d) determining that the client satisfies the at least one pre-requisite, responsive to applying the filter;

(e) determining whether to provide access to the resource to the client by the server in the plurality of servers according to the at least one method for providing access to the resource; and

(f) providing, by the server in the plurality of servers, access to the resource for the client according to the at least one method for providing access to the resource.

2. The method of claim 1, wherein step (b) further comprises associating the rule with a method for providing access to the resource by streaming the resource to the client.

3. The method of claim 1, wherein step (b) further comprises associating the rule with a method for providing access to the resource by transmitting application-output data to the client using a presentation layer protocol.

4. The method of claim 1, wherein step (b) further comprises associating the rule with a method for providing access to the resource by executing the resource on a virtual machine executing on the server in the plurality of servers and transmitting application-output data to the client from the virtual machine using a presentation layer protocol.

5. The method of claim 1, wherein step (c) further comprises applying the filter to information associated with the client.

6. The method of claim 1, wherein step (c) further comprises applying the filter to information associated with a user of the client.

7. The method of claim 1, wherein step (d) further comprises determining that the client executes a specified anti-virus program.

8. The method of claim 1, wherein step (d) further comprises determining that the client is associated with a network address in a specified range of network addresses.

9. The method of claim 1, wherein step (d) further comprises determining that the client executes a specified operating system program.

10. The method of claim 1, wherein step (e) further comprises determining that the client is able to use the method for providing access specified by the rule.

11. The method of claim 1, wherein step (e) further comprises determining that the server in the plurality of servers by the rule is able to provide the resource to the client via the at least one method for providing access.

12. The method of claim 1, wherein step (f) comprises identifying a second rule having a lower rule priority level than the first rule priority level, the second rule associated with a second method for providing access to the resource and associated with a second server in the plurality of servers.

13. The method of claim 12, wherein step (e) further comprises determining that the client fails to satisfy the at least one pre-requisite, responsive to applying the filter.

14. The method of claim 12, wherein step (e) further comprises determining that the client is unable to use the at least one method for providing access specified by the rule.

15. The method of claim 12, wherein step (e) further comprises determining that the server in the plurality of servers by the rule is unable to provide the resource to the client via the at least one method for providing access.

16. The method of claim 12, wherein step (f) comprises identifying a second rule having a lower rule priority level than the first rule priority level, the second rule associated with the at least one method for providing access to the resource and associated with a second server in the plurality of servers.

17. The method of claim 12, wherein step (f) comprises identifying a second rule having a lower rule priority level than the first rule priority level, the second rule associated with a second method for providing access to the resource and associated with the server in the plurality of servers.

18. The method of claim 12 further comprising the steps of:

(g) determining whether to provide access to the resource to the client by the second server in the plurality of servers according to the second method for providing access to the resource; and

(h) providing, by the second server in the plurality of servers, access to the resource according to the second method for providing access.

19. The method of claim 18, wherein step (g) further comprises applying a second filter.

20. The method of claim 18, wherein step (g) further comprises determining whether to provide access to the resource to the client by the second server in the plurality of servers according to the at least one method for providing access to the resource.

21. The method of claim 20, wherein step (h) further comprises providing, by the second server in the plurality of servers, access to the resource according to the at least one method for providing access.

22. The method of claim 1, wherein step (f) comprises identifying a second rule having a lower rule priority level than the first rule priority level, the second rule associated with a second filter, a second method for providing access to the resource, and a second server in the plurality of servers.

23. The method of claim 22, wherein step (e) further comprises determining that the client fails to satisfy the at least one pre-requisite, responsive to applying the filter.

24. The method of claim 22, wherein step (e) further comprises determining that the client is unable to use the method for providing access specified by the rule.

25. The method of claim 22, wherein step (e) further comprises determining that the server in the plurality of servers by the rule is unable to provide the resource to the client via the first method for providing access.

26. The method of claim 22, wherein step (f) comprises identifying a second rule having a lower rule priority level than the first rule priority level, the second rule associated with a second filter, the at least one method for providing access to the resource and a second server in the plurality of servers.

27. The method of claim 22, wherein step (f) comprises identifying a second rule having a lower rule priority level than the first rule priority level, the second rule associated with a second filter, a second method for providing access to the resource and the server in the plurality of servers.

28. The method of claim 22 further comprising the steps of:

(g) determining that the client satisfies at least one pre-requisite associated with the second filter, responsive to an application of the second filter;

(h) determining whether to provide access to the resource to the client by the second server in the plurality of servers according to the second method for providing access to the resource; and

(i) providing, by the second server in the plurality of servers, access to the resource according to the second method for providing access.

29. The method of claim 28, wherein step (h) further comprises determining that the client is able to use the second method for providing access specified by the second rule.

30. The method of claim 28, wherein step (h) further comprises determining that the second server in the plurality of servers by the rule is able to provide the resource to the client via the at least one method for providing access.

31. The method of claim 28, wherein step (h) further comprises determining whether to provide access to the resource to the client by the server in the plurality of servers according to a second method for providing access to the resource.

32. The method of claim 28, wherein step (h) further comprises determining whether to provide access to the resource to the client by the second server in the plurality of servers according to the at least one method for providing access to the resource.

33. The method of claim 32, wherein step (i) further comprises providing, by the second server in the plurality of servers, access to the resource according to the at least one method for providing access.

34. A system for access routing and resource mapping using filters comprising:

a rule having a first rule priority level and comprising;

an identification of a filter identifying at least one pre-requisite to accessing the resource,

an identification of at least one method for providing access to a resource, and

an identification of a server in a plurality of servers;

a policy engine comprising

means for identifying the rule,

means for applying the filter to a client requesting access to the resource,

means for determining that the client satisfies the at least one pre-requisite, responsive to applying the filter, and

means for determining whether to provide access to the resource to the client by the server in the plurality of servers according to the at least one method for providing access to the resource;

wherein

the server in the plurality of servers provides access to the resource according to the at least one method for providing access.

35. The system of claim 34, wherein the rule further comprises an identification of a filter identifying a pre-requisite specifying a network address range required for access to the resource.

36. The system of claim 34, wherein the rule further comprises an identification of a filter identifying a pre-requisite specifying an operating system type required for access to the resource.

37. The system of claim 34, wherein the rule further comprises an identification of a filter identifying a pre-requisite specifying an application type required for access to the resource.

38. The system of claim 34, wherein the rule further comprises an identification of a method for providing access to a resource by streaming the resource to the client.

39. The system of claim 34, wherein the rule further comprises an identification of a method for providing access to a resource by executing the resource on a server in the plurality of servers and transmitting application-output data to the client using a presentation layer protocol.

40. The system of claim 34, wherein the rule further comprises an identification of a method for providing access to a resource by executing the resource on a virtual machine executing on a server in the plurality of servers and transmitting application-output data to the client using a presentation layer protocol.

41. The system of claim 34, wherein the rule further comprises an identification of a server in a plurality of servers, the server providing access to the resource.

42. The system of claim 34, wherein the policy engine further comprises

means for identifying a second rule having a lower rule priority level than the first rule priority level, the second rule associated with a second method for providing access to the resource and a second server in the plurality of servers,

means for determining whether to provide access to the resource to the client by the second server in the plurality of servers according to the second method for providing access to the resource;

wherein

the second server in the plurality of servers provides access to the resource according to the second method for providing access.

43. The system of claim 34, wherein the policy engine further comprises

means for identifying a second rule having a lower rule priority level than the first rule priority level, the second rule associated with a second filter, a second method for providing access to the resource, and a second server in the plurality of servers,

means for determining that the client satisfies at least one pre-requisite associated with the second filter, responsive an application of the second filter, and

means for determining whether to provide access to the resource to the client by the second server in the plurality of servers according to the second method for providing access to the resource;

wherein

the second server in the plurality of servers provides access to the resource according to the second method for providing access.