Query interface to policy server

• US 9,154,489 B2
• Filed: 08/14/2013
• Issued: 10/06/2015
• Est. Priority Date: 03/10/1997
• Status: Expired due to Fees

• Current Assignee: Quest Software, Inc.
• Original Assignee: Dell Software, Inc. (Dell Technologies Inc.)
• Inventors: Hannel, Clifford Lee, May, Anthony
• Primary Examiner(s): Hwa, Shyue Jiunn
• Application Number:
  US13/967,207
• Publication Number:
  US 20140059645A1
• Time in Patent Office: 783 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A scalable access filter that is used together with others like it in a virtual private network to control access by users at clients in the network to information resources provided by servers in the network. Each access filter uses a local copy of an access control data base to determine whether an access request is made by a user. Each user belongs to one or more user groups and each information resource belongs to one or more information sets. Access is permitted or denied according to access policies which define access in terms of the user groups and information sets. The first access filter in the path performs the access check, encrypts and authenticates the request; the other access filters in the path do not repeat the access check. The interface used by applications to determine whether a user has access to an entity is now an SQL entity. The policy server assembles the information needed for the response to the query from various information sources, including source external to the policy server.

Claims

1. A method for custom authentication, the method comprising:

storing information in memory regarding a plurality of custom-authenticated user groups, wherein each custom-authenticated user group has a dossier, wherein membership of each custom-authenticated user group is determined based on a user dossier and the dossier of the custom-authenticated user group, and wherein the user dossier and the dossier of the custom-authenticated user group are a list of attribute-value pairs;

receiving an access request sent over a communication network from a user of a client device, wherein the access request includes authentication information from the user dossier, and wherein the access request is a SQL (structured query language) query;

identifying that the access request is associated with a custom-authenticated user group;

evaluating the access request with the dossier of the requested customer-authenticated user group;

determining that the authentication information in the access request does not meet the requirements of the dossier associated with the requested customer-authenticated user group, wherein the requirements of the dossier associated with the requested custom-authenticated user group includes additional information not provided by the user in the access request;

generating a query to one or more databases to obtain additional information to complete the dossier for the user, wherein the completed dossier for the user satisfies the requirements associated with the dossier of the requested customer-authenticated user group; and

assigning an access status for the user based on the completed dossier for the user.

2. The method of claim 1, wherein the user access status permits the user access to the requested customer-authenticated user group.

3. The method of claim 1, wherein the user access status denies the user access to the requested customer-authenticated user group.

4. The method of claim 1, wherein the determining that the access request does not meet the requirements of the dossier associated with the requested customer-authenticated user group includes identifying what additional information is required from the user to meet the requirements of the dossier.

5. The method of claim 4, further comprising requesting the user for additional information required to meet the requirements of the dossier of the requested customer-authenticated user group.

6. The method of claim 5, wherein the additional information may be provided by the user on the client device.