Method and system for performing a security check

• US 8,429,721 B1
• Filed: 10/23/2009
• Issued: 04/23/2013
• Est. Priority Date: 08/13/2004
• Status: Active Grant

• Current Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Original Assignee: Juniper Networks Incorporated
• Inventors: Tock, Theron, Egorov, Vadim, Srinivas, Sampath, Harding, Andrew R
• Primary Examiner(s): Tabor, Amare F
• Application Number:
  US12/604,902
• Time in Patent Office: 1,278 Days
• Field of Search: 726/4, 726/25, 713/168
• US Class Current: 726/4
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An access request is transmitted from a first device to a second device causing one or more security functions to be executed on the first device. Whether to grant the access request is based on a result of the executed one or more security functions.

Claims

1. A method performed by a server, the method comprising:

receiving, based on receiving an indication of a uniform resource locator (URL) entered by a user of a remote device, an indication that the user is attempting to establish a session with the server;

using, by the server, the URL to retrieve a first authorization policy associated with the session from a first data structure;

causing, by the server, a first security checker, associated with the first authorization policy, to be executed on the remote device;

receiving, at the server, a user ID associated with the user;

identifying, by the server, a second authorization policy associated with the user ID;

determining, by the server device, that the second authorization policy is not the same as the first authorization policy;

causing, by the server, a second security checker, associated with the second authorization policy, to be executed on the remote device when the second authorization policy is not the same as the first authorization policy; and

determining, by the server, a level of access for the user based on a result of the execution of the first security checker or the second security checker.

2. The method of claim 1, where identifying the second authorization policy associated with the user ID comprises:

using the user ID to look up the second authorization policy in a second data structure.

3. The method of claim 1, further comprising:

receiving a first report associated with execution of the first security checker;

receiving a second report associated with execution of the second security checker; and

determining the level of access based on the first report or second report.

4. The method of claim 1, further comprising:

determining a level of access for the user based on a result of the execution of the first security checker when the second authorization policy is the same as the first authorization policy.

5. The method of claim 1, further comprising:

determining a level of access for the user based on a result of the execution of the second security checker when the second authorization policy is not the same as the first authorization policy.

6. A system comprising:

a server to;

receive, based on receiving an indication of a uniform resource locator (URL) entered by a user of a remote device, an indication that the user is attempting to establish a session;

retrieve, using the URL, a first authorization policy, associated with the session, from a first data structure;

cause a first security checker, associated with the first authorization policy, to be executed on the remote device;

receive a user ID associated with the user;

identify a second authorization policy associated with the user ID;

determine that the second authorization policy is not the same as the first authorization policy;

cause a second security checker, associated with the second authorization policy, to be executed on the remote device when the second authorization policy is not the same as the first authorization policy; and

determine a level of access for the user based on a result of the execution of the first security checker or the second security checker.

7. The system of claim 6, where when identifying the second authorization policy associated with the user ID, the server is to:

use the user ID to look up the second authorization policy in a second data structure.

8. The system of claim 6, where the server is further to:

receive a first report associated with execution of the first security checker;

receive a second report associated with execution of the second security checker; and

determine the level of access based on the first report or second report.

9. The system of claim 6, where the server is further to:

determine a level of access for the user based on a result of the execution of the first security checker when the second authorization policy is the same as the first authorization policy.

10. The system of claim 6, where the server is further to:

determine a level of access for the user based on a result of the execution of the second security checker when the second authorization policy is not the same as the first authorization policy.

11. A method comprising:

configuring, by a security system and based on an identity of a user attempting to access a remote device, a group of security modules to add one or more independently produced security modules,

the security modules, of the group of security modules, each implementing one or more security functions that are to be executed on the remote device,

the one or more independently produced security modules being produced by entities different than an entity that produced the security system,

the group of security modules including;

a package manifest section that includes a name of a provider of the security module,

a security module section that includes an identification of one or more policies supported by the security module, and

a security framework section that includes a program interface for the security module;

transmitting, by the security system, the group of security modules to the remote device for execution of the one or more security functions implemented by the security modules at the remote device; and

determining, by the security system, whether to grant, to the user access to the remote device based on a result of the executed one or more security functions.

12. The method of claim 11, further comprising:

receiving a result of the one or more executed security functions.

13. The method of claim 11, where the group of security modules further includes:

a security module section that includes an identification of one or more policies supported by the security module.

14. The method of claim 11, where the security functions in the group of security modules relate to one or more of spyware detection, virus detection, or detection of missing software patches.