Method and aparatus for presence based resource management

• US 9,117,054 B2
• Filed: 12/21/2012
• Issued: 08/25/2015
• Est. Priority Date: 12/21/2012
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Forcepoint LLC
• Inventors: Black, Robert Barth
• Primary Examiner(s): HENNING, MATTHEW T
• Application Number:
  US13/724,990
• Publication Number:
  US 20140181889A1
• Time in Patent Office: 977 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time

Abstract

Methods and apparatus provide resource authorization based on a computer'"'"'s presence information. Presence information may include information relating to a computer'"'"'s operating environment. In some implementations, a presence detector on a computer determines presence information and provides the information to a resource manager. The computer may then generate a resource access request. A resource manager may then determine whether the resource request is authorized based, at least in part, on the presence information. The resource manager then responds to the resource access request, either granting or denying the request for resources.

Claims

1. A method of reducing risk associated with a computer that may be infected with a malicious application comprising:

receiving, from the computer over a network, first presence data indicating a first interactivity level of more than two interactivity levels of a logged in user of the computer;

receiving a first network request by the logged in user from the computer for first resources external to the computer;

executing instructions on computer hardware to determine a first resource control policy to apply to the first network request by the logged in user for the first resources external to the computer based on the first interactivity level;

executing instructions on computer hardware to apply the first resource control policy to the first request for resources;

receiving, from the computer over the network, second presence data indicating a different second interactivity level of the more than two interactivity levels of the logged in user of the computer;

receiving a second network request by the logged in user from the computer for second resources external to the computer;

executing instructions on computer hardware to determine a second resource control policy to apply to the second network request by the logged in user for the second resources external to the computer based on the second interactivity level; and

executing instructions on computer hardware to apply the second policy to the second request.

2. The method of claim 1, wherein the first and second interactivity levels are received over the network from an agent running on the computer.

3. The method of claim 2, wherein the interactivity level is based on whether an input has been received from an input device directly connected to the computer within a time period.

4. The method of claim 2, wherein the interactivity level is based on whether an interactive shell is running on the computer.

5. The method of claim 2, wherein the interactivity level is based on whether a screen saver is active on the computer'"'"'s console.

6. The method of claim 1, wherein the interactivity level is based on the amount of idle CPU cycles on the computer within a time period.

7. The method of claim 1, wherein the interactivity level indicates whether the computer is communicating over a secure network connection.

8. The method of claim 1, wherein the interactivity level indicates the computer'"'"'s location within a corporate network.

9. The method of claim 1, wherein the interactivity level indicates the physical location of the computer.

10. The method of claim 1, wherein the resource control policy controls the use of hardware resources of the computer.

11. The method of claim 1, wherein the resource control policy controls access to network data by the computer.

12. The method of claim 11, wherein the access to network data is controlled based, at least in part, on one or more content categories of a URL identifying the network data.

13. The method of claim 12 wherein a first set of URL categories are accessible to the computer when the interactivity level indicates a first state and a second set of URL categories are accessible to the computer when the interactivity level indicates a second state.

14. The method of claim 1, wherein the resource control policy controls whether network communication by the computer is encrypted.

15. The method of claim 1, wherein the resource control policy controls whether network data sent by the computer is compressed.

16. The method of claim 1, wherein the resource control policy controls whether network data sent by the computer is signed.

17. The method of claim 1, wherein the resource control policy controls the rate at which data sent or received by the computer may be transferred on a network.

18. The method of claim 1, wherein the resource control policy controls content of email messages sent by the computer.

19. The method of claim 1, further comprising receiving an indication of one or more display settings from the computer, wherein the determining of the resource control policy to apply to the first network request is further based on the received indication(s).

20. The method of claim 1, further comprising receiving an indication of whether a privacy shield is installed on the computer, wherein the determining of the first resource control policy to apply to the first network request is further based on the received indication.

21. An apparatus for reducing risk associated with a computer that may be infected with a malicious application, comprising:

a memory;

a processor, configured to fetch instructions from the memory; and

a network interface, operatively coupled to the processor,

wherein the memory stores;

a presence management module, configured to cause the processor to receive first and second presence data comprising indications of different interactivity levels of a logged in user from the user'"'"'s computer over a network via the network interface, wherein each of the first and second presence data indicates one of more than two interactivity levels,

a URL filtering interface module, configured to cause the processor to receive first and second URL access requests including corresponding first and second requested URLs,

a URL categorization module, configured to cause the processor to determine one or more URL categories for each of the requested URLs,

a policy determination module, configured to cause the processor to determine a policy to apply to each of the requested URLs based, at least in part, on a different received interactivity level of the logged in user, and

a policy application module, configured to cause the processor to authorize or not authorize access to each of the requested URLs by the computer based, at least in part, on the determined policy for that URL and the one or more URL categories corresponding to the URL.

22. The apparatus of claim 21, wherein the different interactivity levels are received over the network via the network interface from an agent running on the computer.

23. The apparatus of claim 21, wherein the URL access request is based, at least in part, on a request for the URL by the computer.

24. An apparatus for reducing risk associated with a computer that may be infected with a malicious application, comprising:

means for communicating over a network;

means for receiving a plurality of indications of different interactivity levels of a logged in user from the user'"'"'s computer via the communicating means, each indication indicating one of more than two interactivity levels;

means for receiving a network request from the user'"'"'s computer for resources via the communication means; and

means for applying a resource control policy to the received network request based on at least one of the received interactivity levels.

25. The apparatus of claim 24, further comprising:

means for receiving a uniform resource locator (URL) request for network data;

means for receiving an indication of the computer'"'"'s location within a corporate network, wherein the resource control policy controls access to the network data based, at least in part, on one or more content categories of the URL and the computer'"'"'s location within the corporate network.

26. A non-transitory computer readable medium, storing instructions that when executed by a processor perform a method of reducing risk associated with a computer that may be infected with a malicious application, the method comprising:

receiving a plurality of indications of different interactivity levels of a logged in user from the user'"'"'s computer over a network, each indication indicating one of more than two interactivity levels;

receiving a network request from the user'"'"'s computer for resources; and

applying a resource control policy based on at least one of the received interactivity levels of the logged in user.

27. The non-transitory computer readable medium of claim 26, further comprising:

receiving an indication of the computer'"'"'s location within a corporate network; and

receiving a uniform resource locator (URL) request for network data, and wherein the resource control policy controls access to the network data based, at least in part, on one or more content categories of the URL and the computer'"'"'s location within the corporate network.