Combining network endpoint policy results
View Patent ↗An endpoint integrity system controls access to resources of a protected network for endpoint devices attempting to access the protected network. The system may include a number of evaluation modules that communicate with an endpoint device. The evaluation modules generate policy results for the endpoint device, in which each of the policy results assume one of three or more states, called a multi-state policy result. The multi-state policy results are combined to produce a combined Boolean policy result.
1. A network device comprising:
a plurality of evaluation modules to:
receive information associated with an endpoint device, and
generate, based on the information, respective policy results for the endpoint device, where each of the respective policy results is selected from a group of three or more states that include:
a pass state,
a fail state, and
a third state that differs from the pass state and the fail state;
a result combination component to:
receive, from the plurality of evaluation modules, the respective policy results, and
combine, based on a custom criterion, the respective policy results, from the plurality of evaluation modules, to produce a combined Boolean policy result; and
a processor to evaluate the endpoint device based on the combined Boolean policy result.
2. The network device of claim 1 , where the custom criterion includes a Boolean expression in which a set of possible operands for the expression include each of the three or more states.
3. The network device of claim 1 , where the third state includes:
an isolate state, or
a no recommendation state.
4. The network device of claim 1 , where the policy results relate to an integrity status of the endpoint device.
5. The network device of claim 1 , where the policy results relate to at least one of:
an identity of a user of the endpoint device, or
an identity of the endpoint device.
6. The network device of claim 1 , where the plurality of evaluation modules include:
a particular evaluation module to confirm a presence of at least one of security-related hardware or security-related software associated with the endpoint device.
7. The network device of claim 6 , where the security-related hardware includes a firewall, and
where the security-related software includes:
antivirus software, or
anti-spyware software.
8. The network device of claim 1 , where the processor further includes:
a policy enforcement component to control access to network resources for the endpoint device based on the combined Boolean policy result.
9. A method comprising:
receiving a request, by a network device, from an endpoint device, to initiate a connection;
obtaining, by the network device, a plurality of policy results relating to a security state of the endpoint device, where each of the plurality of policy results is selected from a group of three or more states that include:
a pass state,
a fail state, and
a third state that differs from the pass state and the fail state;
combining, by the network device, the plurality of policy results to obtain a Boolean policy result based on a criterion associated with an expression that includes a set of respective possible operands the three or more states, where the criterion includes at least two different Boolean operators; and
determining, by the network device and based on the Boolean policy result, whether to establish the connection requested by the endpoint device.
10. The method of claim 9 , further comprising:
restricting access, by the endpoint device, to resources based on the Boolean policy result.
11. The method of claim 9 , where the at least two different Boolean operators, for the expression, include at least one of AND, OR, or NOT operators.
12. The method of claim 9 , where obtaining the plurality of policy results includes:
exchanging information between a plurality of corresponding client-side and server-side evaluation modules to obtain the plurality of policy results.
13. The method of claim 9 , where the plurality of policy results relate to an integrity status of the endpoint device.
14. The method of claim 9 , where the plurality of policy results relate to at least one of:
an identity of a user of the endpoint device, or
an identity of the endpoint device.
15. The method of claim 9 , where the plurality of policy results relate to confirming a presence of at least one of security-related hardware or security-related software associated with the endpoint device.
16. A system comprising:
a non-transitory memory to store computer-executable instructions; and
one or more processors to execute the computer-executable instructions to:
obtain a plurality of policy results associated with an endpoint device, where each of the plurality of policy results is selected from a group of three or more states that include:
a pass state,
a fail state, and
a third state that is different from the pass state and the fail state;
obtain, based on the plurality of policy results, a Boolean policy result;
control, based on the Boolean policy result, access between the endpoint device and a protected network; and
determine based on the Boolean policy result, whether to grant access, by the endpoint device, to resources of the protected network.
17. The system of claim 16 , where the one or more processors, when obtaining the Boolean policy result, are further to:
obtain the Boolean policy result based on a criterion associated with an expression that includes respective possible operands for the three or more states.
18. The system of claim 17 , where the criterion includes a custom criterion specified by an administrator.
19. The system of claim 18 , where the one or more processors are further to:
provide, for presentation to the administrator, an interface to receive, from the administrator, the custom criterion.
20. The system of claim 16 , where the third state includes at least one of an isolate state or a no recommendation state.
21. The system of claim 17 , where the plurality of policy results relate to an integrity status of the endpoint device.
22. The system of claim 17 , where the plurality of policy results relate to confirming a presence of at least one of security-related hardware or security-related software associated with the endpoint device.
23. A system comprising:
one or more devices to:
receive a request to initiate a connection from an endpoint device;
interact with the endpoint device to obtain a plurality of policy results relating to a security state of the endpoint device, each of the plurality of policy results being selected from a group of three or more possible states that include:
a pass state,
a fail state, and
one or more third states that differs from the pass state and the fail state;
combine the plurality of policy results to obtain a Boolean policy result based on a criterion, where the criterion is associated with an expression that includes respective possible operands for the three or more possible states; and
determine, based on the Boolean policy result, whether to establish the connection requested by the endpoint device.
24. The network device of claim 1 , where the criterion is a first custom criterion received from an administrator, where the Boolean policy result is a first Boolean policy result, where the network device further includes:
a criterion generation component to receive a different second custom criterion from the administrator,
where the result combination component is further to combine, based on the second custom criterion, the generated policy results from the evaluation modules to produce a different second Boolean policy result.
25. The method of claim 9 , where the plurality of policy results includes first policy results and second policy results, and
where obtaining the plurality of policy results includes:
receiving information from the endpoint device;
processing the information to form the first policy results; and
receiving, from a device that differs from the network device, the second policy results.
26. The system of claim 16 , where the one or more processors, when obtaining the plurality of policy results, are further to:
obtain a Boolean policy result by combining the plurality of policy results with additional policy results received from another device that differs from the endpoint device.
27. The system of claim 23 where the criterion is a first custom criterion received from an administrator,
where the Boolean policy result is a first Boolean policy result, and
where the one or more devices are further to:
receive a different second custom criterion from the administrator,
combine, based on the second custom criterion, the generated policy results from the evaluation modules to produce a second Boolean policy result that differs from the first Boolean policy result.