Granted Patent B1

US 8,667,555 · App. 11/678,432 · Granted Mar 4, 2014

Abstract

Claims (113)

1. A method comprising:

receiving, by a device, user data associated with a user device,

the user data including integrity information, associated with the user device, that is received from one or more integrity plug-ins associated with the user device,

the device being different than the user device;

generating, by the device and based on the received user data, a plurality of integrity policies,

each of the plurality of integrity policies being associated with a respective rule for accessing, by the user device, a resource,

each respective rule, associated with each of the plurality of integrity policies, being different;

parsing, by the device, each of the plurality of integrity policies to determine a type of the respective rule associated with each of the plurality of integrity policies;

determining, by the device and based on each determined type of respective rule, a remote integrity server, of a plurality of remote integrity servers, associated with processing each determined type of respective rule;

distributing, by the device, information identifying at least one respective rule and a portion of the user data corresponding to the at least one respective rule to at least one of the plurality of remote integrity servers based on at least one function performed by each of the plurality of remote integrity servers,

the portion of the user data being a subset of the user data and including a portion of the integrity information;

receiving, by the device, one or more integrity results from the at least one of the plurality of remote integrity servers based on the portion of the user data and the at least one respective rule,

at least one of the one or more integrity results indicating whether to grant or deny access, to the resource, by the user device; and

formulating, by the device and based on the one or more integrity results, at least one of an access recommendation or an overall integrity result for the user device.

2. The method of claim 1 , further comprising:

determining whether to grant or deny access to the user device based on the at least one of the access recommendation or the overall integrity result.

3. The method of claim 1 , where generating the plurality of integrity policies comprises:

receiving one or more integrity policies for analyzing the integrity information.

4. The method of claim 1 , where generating the plurality of integrity policies comprises:

receiving one or more integrity policies that include a condition for the user device to access a protected resource.

5. The method of claim 1 , where distributing the information identifying the at least one respective rule and the portion of the user data corresponding to the at least one respective rule comprises:

distributing the information identifying the at least one respective rule and the portion of the user data based on a portion of the plurality of integrity policies.

6. The method of claim 1 , where receiving the one or more integrity results comprises:

receiving the one or more integrity results from one or more remote integrity plug-ins associated with a respective one of the plurality of remote integrity servers.

7. The method of claim 1 , where formulating the at least one of the access recommendation or the overall integrity result further comprises:

formulating the at least one of the access recommendation or the overall integrity result to facilitate determination of whether to grant or deny access to the user device.

8. The method of claim 1 , where the device comprises a network access authority device.

9. The method of claim 1 , further comprising:

granting or denying access, by the user device, to the resource based on the at least one of the access recommendation or the overall integrity result.

10. The method of claim 1 , where formulating the at least one of the access recommendation or the overall integrity result further comprises:

formulating the at least one of the access recommendation or the overall integrity result for a single integrity policy of the plurality of integrity policies.

11. A method comprising:

receiving, by a device, user data associated with a user device requesting access to a resource,

the user data including integrity information, associated with the user device, that is received from one or more integrity plug-ins associated with the user device,

the device being different than the user device;

generating, by the device, a plurality of integrity policies based on the received user data,

each of the plurality of integrity policies being associated with a respective rule for accessing the resource,

each respective rule being different;

providing, by the device, the user data and the plurality of integrity policies to an integrity plug-in proxy of the device;

parsing, by the integrity plug-in proxy, each of the plurality of integrity policies to determine a type of the respective rule associated with each of the plurality of integrity policies;

determining, by the integrity plug-in proxy and based on each determined type of respective rule, a remote integrity server, of a plurality of remote integrity servers, associated with processing each determined type of respective rule;

distributing, by the integrity plug-in proxy, information identifying at least one respective rule and a portion of the user data corresponding to the at least one respective rule to at least one of the plurality of remote integrity servers based on at least one function performed by each of the plurality of remote integrity servers,

the portion of the user data being a subset of the user data and including a portion of the integrity information,

receiving, by the integrity plug-in proxy, one or more integrity results from the at least one of the plurality of remote integrity servers based on the portion of the user data and the at least one respective rule,

at least one of the one or more integrity results indicating whether to grant or deny access, to the resource, by the user device;

receiving, by the device, an access recommendation or an overall integrity result from the integrity plug-in proxy based on the received one or more integrity results; and

granting or denying, by the device, access to the user device based on the access recommendation or the overall integrity result.

12. The method of claim 11 , where generating the plurality of integrity policies comprises:

generating one or more integrity policies, of the plurality of integrity policies, that include a condition for the user device to access the resource.

13. The method of claim 11 , where each of the respective rules comprises:

at least one rule to examine the user device and prohibit the user device from accessing the resource when the user device is unsafe or non-compliant.

14. The method of claim 11 , where the device comprises a network access authority device.

15. The method of claim 11 , where granting or denying access to the user device comprises:

granting access to the user device when the user device is determined to be trustworthy based on the access recommendation or the overall integrity result.

16. The method of claim 11 , where granting or denying access to the user device comprises:

denying access to the user device when the user device is determined to be untrustworthy based on the access recommendation or the overall integrity result.

17. A device comprising:

a memory to store a plurality of instructions; and

a processor to execute the plurality of instructions in the memory to:

receive user data associated with a user device requesting access to a resource,

the user data including integrity information, associated with the user device, that is received from one or more integrity plug-ins associated with the user device;

generate a plurality of integrity policies based on the user data,

each of the plurality of integrity policies being associated with a respective rule for accessing the resource,

each respective rule, associated with each of the plurality of integrity policies, being different;

parse each of the plurality of integrity policies to determine a type of the respective rule associated with each of the plurality of integrity policies;

determine, based on each determined type of respective rule, a remote integrity server, of a plurality of remote integrity servers, associated with processing each determined type of respective rule;

distribute information identifying at least one respective rule and a portion of the user data corresponding to the at least one respective rule to at least one of the plurality of remote integrity servers based on at least one function performed by each of the plurality of remote integrity servers,

the portion of the user data being a subset of the user data and including a portion of the integrity information;

receive integrity results from the at least one of the plurality of remote integrity servers based on the portion of the user data and the at least one respective rule,

at least one of the integrity results indicating whether to grant or deny access, to the resource, by the user device;

collate the integrity results; and

formulate an access recommendation or an overall integrity result for the user device based on the collated integrity results.

18. The device of claim 17 , where the processor is further to:

receive one or more integrity policies for analyzing the integrity information.

19. The device of claim 17 , where the processor is further to:

receive one or more integrity policies that include a condition for the user device to access the resource.

20. The device of claim 17 , where the processor is further to:

receive the integrity results from one or more remote integrity plug-ins associated with each of the plurality of remote integrity servers.

21. The device of claim 17 , where the processor, when formulating the access recommendation or the overall integrity result, is further to:

formulate the access recommendation or the overall integrity result for multiple, different integrity policies.

22. The device of claim 17 , where the processor, when formulating the access recommendation or the overall integrity result, is further to:

formulate the access recommendation or the overall integrity result to facilitate determination of whether to grant or deny the user device access to the resource.

23. The device of claim 17 , where the processor, when formulating the access recommendation or the overall integrity result, is further to:

formulate the access recommendation or the overall integrity result for a single integrity policy.

24. The device of claim 17 , where the processor is further to:

grant or deny access, by the user device, to the resource based on formulating the access recommendation or the overall integrity result.

25. A non-transitory computer-readable medium storing instructions, the instructions comprising:

one or more instructions which, when executed by a device, cause the device to:

receive user information associated with a user device requesting access to a protected resource,

the user information including integrity information, associated with the user device, that is received from one or more integrity plug-ins associated with the user device;

generate a plurality of integrity policies based on the user information,

each of the plurality of integrity policies being associated with a respective rule for accessing, by the user device, the protected resource,

each respective rule, associated with each of the plurality of integrity policies, being different;

parse each of the plurality of integrity policies to determine a type of the respective rule associated with each of the plurality of integrity policies;

determine, based on each determined type of respective rule, a remote integrity server, of a plurality of remote integrity servers, associated with processing each determined type of respective rule;

distribute information identifying at least one respective rule and a portion of the user information corresponding to the at least one respective rule to at least one of the plurality of remote integrity servers based on at least one function performed by each of the plurality of remote integrity servers,

the portion of the user information being a subset of the user information and including a portion of the integrity information;

receive integrity results from the at least one of the plurality of remote integrity servers based on the portion of the user information and the at least one respective rule,

at least one of the integrity results indicating whether to grant or deny access, to the protected resource, by the user device;

collate the integrity results to determine an access recommendation or an overall integrity result; and

grant or deny the user device access to the protected resource based on the access recommendation or the overall integrity result.

26. The medium of claim 25 , where the one or more instructions to generate the plurality of integrity policies further comprise:

one or more instructions to generate integrity policies, of the plurality of integrity policies, that include a condition for the user device to access the protected resource.

27. The medium of claim 25 , where each of the respective rules comprises:

at least one rule to examine the user device and prohibit the user device from accessing the protected resource when the user device is unsafe or non-compliant.

28. The medium of claim 25 , further comprising:

one or more instructions to receive the access recommendation or the overall integrity result for a single integrity policy.

29. The medium of claim 25 , where the one or more instructions to grant or deny the user device access to the protected resource further comprise:

one or more instructions to grant the user device access to the protected resource when the user device is determined to be trustworthy based on the access recommendation or the overall integrity result.

30. The medium of claim 25 , where the one or more instructions to grant or deny the user device access to the protected resource further comprise:

one or more instructions to deny the user device access to the protected resource when the user device is determined to be untrustworthy based on the access recommendation or the overall integrity result.

31. The medium of claim 25 , where the one or more instructions to collate the integrity results to determine an access recommendation or an overall integrity result further comprise:

one or more instructions to collate the access recommendation or the overall integrity result for multiple, different integrity policies of the plurality of integrity policies.

Assignments (16)