Method and system for verifying and updating the configuration of an access device during authentication

• US 7,539,862 B2
• Filed: 04/08/2004
• Issued: 05/26/2009
• Est. Priority Date: 04/08/2004
• Status: Active Grant

• Current Assignee: Channel IP BV
• Original Assignee: Ipass Incorporated (Pareteum Corp.)
• Inventors: Edgett, Jeff Steven, Bullock, Blair Thomas, Nelson, Barbara, Underwood, James Marion, Vollbrecht, John Robert, Albert, Roy David
• Primary Examiner(s): Chai; Longbit
• Application Number:
  US10/821,313
• Publication Number:
  US 20050228874A1
• Time in Patent Office: 1,874 Days
• Field of Search: 713/168
• US Class Current: 713/168
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

A system and method is provided to verify configuration of a client access device requesting access to a network by establishing a communications link between a network access system and the client access device to authenticate and authorize the client access device and a user associated with the client access device. The network access system further receives client device configuration data from the client access device over the communications link during an authentication and authorization exchange and processes the client device configuration data to determine if the client access device will be granted access to the network.

Claims

1. A method comprising:

performing, in a first service access provider, operations including,

receiving an access request from a client access device, the access request requesting access to a network, wherein a user associated with the client access device is a subscriber of a second service access provider, wherein the second service provider is physically distinguished from the first service provider;

establishing a communications link with the client access device to authenticate and authorize the user, including delivering an agent to the client access device, the agent operable to identify the client device configuration;

receiving client device configuration data from the agent over the communications link during an authentication and authorization exchange;

transmitting the client device configuration data destined for the second service access provider, wherein the second service access provider is operable to process the client device configuration data and selectively grant the client access device access to the network based upon the client device configuration data; and

receiving an indication about whether the client access device is granted access to the network, the indication originating from the second service access provider.

2. The method of claim 1, wherein determining if the client device configuration data meets predetermined security requirements includes comparing the client device configuration data with reference configuration data.

3. The method of claim 1, wherein the second service access provider is further operable to update the client device configuration data if the client device configuration data fails to meet the predetermined security requirements.

4. The method of claim 3, wherein selectively granting the client access device access to the network includes, denying access to the network if the client device configuration data is not updated.

5. The method of claim 1, wherein the agent is further operable to communicate the client device configuration data to a server of the network.

6. The method of claim 5, which includes, if after the processing of the client device configuration data the client device configuration data requires an update, using the agent to update the client access device with updated configuration data.

7. The method of claim 6, which includes, after updating the client access device, receiving an update result indicator from the agent to confirm that the configuration of the client access device has been updated.

8. The method of claim 1, wherein the establishing of the communications link with the client access device includes communicating a command set, which includes at least one command, to the client access device, the command set operable to identifer the client device configuration data and to communicate the client device configuration data to a server of the network.

9. The method of claim 8, which includes, if after the processing of the client device configuration data the client device configuration data requires an update, using the command set to update the client access device with updated configuration data.

10. The method of claim 9, wherein the command set further includes a first command set to identify and communicate the client device configuration data to the server, and a second command set to update the client access device with the updated configuration data.

11. The method of claim 9, which includes, after updating the client access device, receiving an update result indicator from the client access device to confirm that the configuration of the client access device has been updated.

12. The method of claim 1, the operations further including, after establishing communications with the client access device, transmitting authentication information to the second service access provider, the second service access provider further operable to authenticate the user.

13. The method of claim 12, wherein authenticating the user includes verifying user login information associated with the user attempting access to the network.

14. The method of claim 1, wherein the client device configuration data includes at least one of virus definition data, firewall configuration data, and operating system configuration data.

15. A system to verify configuration data of a client access device requesting access to a packet-switched computer network, the system comprising:

a first service access provider, coupled to the packet-switched computer network, to establish a communications link to the client access device, including delivering an agent to the client access device, the agent operable to identify the client device configuration, via the packet switched computer network to receive, from the client access device, authentication information for a user associated with the client access device and to receive the configuration data from the client access device over the communications link during an authentication and authorization exchange; and

a second service access provider to receive said authentication information and the said configuration data from the first service access provider, to process the configuration data, to selectively grant the client access device access to the network based upon the configuration data, and to originate an indication whether the client access device is granted access to the network; and

wherein the second service provider is physically distinguished from the first service provider and the client access device is a subscriber of the second service access provider.

16. The system of claim 15, wherein the second service access provider includes a configuration server to process the client device configuration data such that the configuration server determines if the client device configuration data meets predetermined security requirements.

17. The system of claim 16, wherein the configuration server compares the client device configuration data with reference configuration data to determine if the client device configuration data meets predetermined security requirements.

18. The system of claim 16, wherein the configuration server, after the client device configuration data is processed, updates the client device configuration data.

19. The system of claim 18, wherein the configuration server denies network access to the client access device if the client device configuration data is not updated.

20. The system of claim 16, wherein to establish the communications link with the client access device, the second service access provider communicates an agent to the client access device, the agent operable to identify the client device configuration data and to communicate the client device configuration data to at least one of the second service access provider and the configuration server.

21. The system of claim 20, wherein if after the processing of the client device configuration data the client device configuration data requires an update, the configuration server being configurable to use the agent to update client device configuration data with updated configuration data.

22. The system of claim 21, wherein after the agent updates the client access device, the configuration server receives an update result indicator from the agent to confirm that the configuration of the client device has been updated.

23. The system of claim 16, wherein to establish the communications link with the client access device, the first service access provider communicates a command set to the client access device, the command set operable to identify the client device configuration data and to communicate the client device configuration data to at least one of the first service access provider and the configuration server.

24. The system of claim 23, wherein if after the processing of the client device configuration data, the client device configuration data requires an update, the configuration server is operable to further use the command set to update client device configuration data with updated configuration data.

25. The system of claim 24, wherein after the configuration server updates the client access device, the configuration server receives an update result indicator from the client access device to confirm that the client configuration has been updated.

26. The system of claim 23, wherein the command set further includes a first command set to identify and communicate the client device configuration data to the server, and a second command set to update the client access device with the updated configuration data.

27. The system of claim 15, wherein the second service access provider includes an authentication server to authenticate and authorize a user associated with the client access device.

28. The system of claim 15, wherein the client device configuration data includes at least one of virus definition data, firewall configuration data, and operating system configuration data.

29. A machine readable storage medium storing a set of instructions that, when executed by a machine, cause the machine to:

perform, in a first service access provider, following operations;

receiving an access request from a client access device, the access request requesting access to a network, wherein a user associated with the client access device is a subscriber of a second service access provider, wherein the second service provider is physically distinguished from the first service provider;

establishing a communications link with a client access device including delivering an agent to the client access device, the agent operable to identify the client device configuration to authenticate and authorize the user associated with the client access device;

receiving client device configuration data from device over the communications link during an authentication and authorization exchange;

transmitting the client device configuration data destined for the second service access provider, wherein the second service access provider is operable to process the client device configuration data and to selectively grant the client access device access to the network based upon the client device configuration data; and

receiving an indication about whether the client access device is granted access to the network, the indication originating from the second service access provider.

30. The machine readable medium of claim 29, wherein after the processing of the client device configuration data, the client device configuration data is updated with updated configuration data.

31. A method to manage access to a network from a client access device, the method comprising:

requesting access to the network, the requesting involving a first service access provider and a second service access provider,

authenticating a user associated with the client access device in an authentication and authorization exchange, at the first service provider, involving an agent delivered to the client access device, said delivered agent operable to identify the client device configuration data, wherein the user is a subscriber of the second service access provider;

communicating client device configuration data to the second service access provider via said delivered agent, wherein the client device configuration data includes security setting status data received from executables operating on the client device;

processing the configuration data, by the second service access provider;

receive a verification response from the second service access provider via the first service access provider; and

if the user is authenticated and the verification response from the second service access provider indicates acceptance of the client device configuration data, access the network via the first service provider.

32. The method of claim 31, wherein prior to receiving the verification response, updated configuration data is received from the second service access provider via the first service access provider, the updated configuration data to replace the client device configuration data.

33. A machine readable storage medium storing a set of instructions that, when executed by a machine, cause the machine to:

request, from a first service access provider, access to a network, the requesting involving a first service access provider and a second service access provider, wherein the second service provider is physically distinguished from the first service provider;

authenticate and authorize a user associated with the request in an authentication and authorization exchange, at the first service provider, involving an agent delivered to the client access device, said delivered agent operable to identify the client device configuration data, wherein the user is a subscriber of the second service access provider;

communicate client device configuration data to the second service access provider via the agent;

wherein the client device configuration data includes security setting status data received from executables operating on the client device;

process the configuration data, by the second service access provider,

receive a verification response from the second service access provider via the first service access provider; and

if the user is authenticated and the verification response from the second service access provider indicates acceptance of the client device configuration data, access the network via the first service provider.

34. The machine readable medium of claim 33, wherein prior to receiving a verification response, updated configuration data is received from the second service access provider to replace the client device configuration data.