Method and system for assigning access control levels in providing access to networked content files

• US 8,065,423 B2
• Filed: 03/01/2006
• Issued: 11/22/2011
• Est. Priority Date: 09/30/2004
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Simmons, Timothy Ernest, Braddy, Ricky Gene, Cockerill, Aaron David
• Primary Examiner(s): WINDER, PATRICE L
• Application Number:
  US11/365,355
• Publication Number:
  US 20060190455A1
• Time in Patent Office: 2,092 Days
• Field of Search: 709/225, 709/229, 709/230, 709/246, 709/228
• US Class Current: 709/229
• CPC Class Codes: G06F 16/88 Mark-up to mark-up conversion conversion for visualization in web browsing G06F16/9577
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 4/18 Information format or content conversion, e.g. adaptation by the network of the transmitted or received information for the purpose of wireless delivery to users or terminals

Abstract

A method and system for assigning access control levels when granting access to resources includes a client node, a collection agent, and a policy engine. The client node requests access to a resource. The collection agent gathers information about the client node. The policy engine receives the gathered information and assigns one of a plurality of levels of access responsive to application of a policy to the received information and transmits the information.

Claims

1. An intermediary between a server and a client node, for granting the client node access to resources, the intermediary comprising:

a first module initiating information gathering on a first client node operated by a user via a first collection agent responsive to a request from the first client node to access a resource, receiving the gathered information about the first client node, initiating information gathering on a second client node operated by the user via a second collection agent responsive to a request from the second client node to access the resource, and receiving the gathered information about the second client node; and

a policy engine in communication with the first collection agent and the second collection agent, granting to the user a first level of access to the resource responsive to application of a policy to the information gathered about the first client node when used by the user, and granting to the user a second level of access to the resource responsive to application of a policy to the information gathered about the second client node when used by the user,

wherein the first level of access is selected from a plurality of levels of access, and wherein the second level of access is selected from the plurality of levels of access and allows access to the resource by requiring the use of an application hosted by a remote server to perform operations on the resource instead of an application hosted by the second client node.

2. The intermediary of claim 1, wherein the policy engine further comprises a database storing configurable policies.

3. The intermediary of claim 1, wherein the policy engine determines that the first client node does not satisfy a condition responsive to the application of a condition policy to the information gathered about the first client node, and updates the first client node to allow the first level of access to the resource responsive to the determination.

4. The intermediary of claim 1, wherein the intermediary resides on a firewall.

5. The intermediary of claim 1, wherein a system administrator configures policies in the intermediary to provide a level of access control rights to at least one of the first client node and the second client node.

6. The intermediary of claim 1, wherein the first module communicates instructions to the first collection agent determining the type of information to gather.

7. The intermediary of claim 1, wherein the policy engine communicates a policy determination to a firewall.

8. The intermediary of claim 1, wherein the policy engine communicates the first level of access to a firewall to provide the first level of access to the first client node.

9. The intermediary of claim 1, further comprising an access control server providing authentication and authorization services for a request to access a resource.

10. The intermediary of claim 1, wherein the intermediary communicates with an access control server providing authentication and authorization services for a request to access a resource.

11. The intermediary of claim 9, wherein the access control server provides the first level of access to the first client node.

12. The intermediary of claim 1, wherein the first module transmits the first collection agent to the first client node.

13. The intermediary of claim 12, wherein the first module transmits the first collection agent for execution on the first client node.

14. The intermediary of claim 12, wherein the first module transmits at least one of the first and second collection agents as at least one script.

15. The intermediary of claim 12, wherein the first module transmits at least one of the first and second collection agents as bytecode.

16. The intermediary of claim 12, wherein the policy engine communicates the first level of access to a proxy to provide the first level of access to the first client node.

17. The intermediary of claim 12, wherein the first module receives, from one of the collection agents, a request for instructions to identify the type of information to gather.

18. The intermediary of claim 12, wherein the first module receives information about at least one of the first and second client nodes, said information residing on a server.

19. The intermediary of claim 18, wherein the first module receives information comprising HTTP headers, a network zone of the first client node, or a method of authentication used by the first client node.

20. The intermediary of claim 12, wherein the first module receives information comprising a machine ID of the first client node, MAC addresses of installed network cards, an operating system type, existence of a patch to an operating system, existence of a virus scanner, or existence of a firewall.

21. The intermediary of claim 1, wherein the first module receives information comprising an HTTP header, a watermark on the first client device, or membership in an Active Directory.

22. A method of granting, by an intermediary between a server and a client node, access to resources, the method comprising:

(a-1) initiating, by an intermediary, information gathering on a first client node operated by a user via a first collection agent in response to a request from the first client node for access to a resource;

(a-2) initiating, by the intermediary, information gathering on a second client node operated by the user via a second collection agent in response to a request from the second client node to access the resource;

(b-1) receiving, by the intermediary, the information about the first client node;

(b-2) receiving, by the intermediary, the information about the second client node;

(c-1) granting to the user, by a policy engine of the intermediary in communication with the first collection agent and the second collection agent, a first of level of access to the resource responsive to application of a policy to the information gathered about the first client node when used by the user; and

(c-2) granting to the user, by the policy engine, a second level of access to the resource responsive to application of a policy to the information gathered about the second client node when used by the user,

wherein the first level of access is selected from a plurality of levels of access, and wherein the second level of access is selected from the plurality of levels of access and allows access to the resource by requiring the use of an application hosted by a remote server to perform operations on the resource instead of an application hosted by the second client node.

23. The method of claim 22, wherein step (a-1) further comprises initiating the information gathering over a network connection.

24. The method of claim 22, wherein step (b-1) further comprises receiving the information over a network connection.

25. The method of claim 22, wherein step (a-1) further comprises initiating the information gathering by transmitting the first collection agent to the first client node.

26. The method of claim 22, wherein step (c-1) further comprises determining if the gathered information satisfies a condition.

27. The method of claim 26, further comprising authenticating credentials included in the gathered information.

28. The method of claim 26, wherein step (c-1) further comprises making an access control decision by applying a policy to the condition.

29. The method of claim 22, wherein step (b-1) comprises receiving, by an access control server in communication with the intermediary, the gathered information.

30. The method of claim 22, further comprising determining that the first client node does not satisfy a condition, and updating the first client node to allow the first level of access to the resource responsive to the determination.

31. The method of claim 22, wherein step (c-1) further comprises communicating the first level of access to a firewall for providing the first level of access to the first client node.

32. The method of claim 22, wherein step (c-1) further comprises communicating the first level of access to a proxy for providing the first level of access to the first client node.

33. The method of claim 22, wherein step (c-1) further comprises communicating, via an SSL VPN, the first level of access to one of a firewall and a proxy.

34. The method of claim 22, wherein step (c-1) further comprises providing authentication and authorization services, via an access control server in communication with the intermediary, for accessing the resource.