Method And System For Managing Access To A Resource Over A Network Using Status Information Of A Principal

1 . A method for managing access to a resource over a network using status information of a principal, the method comprising:

receiving status information for a principal that is allowed to access a resource available via a network communication session with a network service;

determining whether the received status information is inconsistent with allowing access to the resource; and

preventing an initiation of a network communication session with the network service for accessing the resource when the received status information of the principal is inconsistent with allowing access to the resource.

2 . The method of claim 1 further comprising storing access information that associates status information with an access condition, wherein the access condition indicates whether access to the resource is allowable based on the status information.

3 . The method of claim 1 wherein preventing an initiation of a network communication session includes preventing an initiation of a network session with the network service for accessing the resource for at least one of the principal, a plurality of principals, and all principals authorized to access the resource.

4 . The method of claim 1 wherein determining whether the received status information is inconsistent with allowing access to the resource includes determining an access condition associated with the received status information.

5 . The method of claim 1 wherein preventing the initiation of the communication session includes:

sending a message to a device hosting the network service, wherein the device supports at least one communication port associated with the network service for accessing the resource and the message includes at least one of a command to close the associated communication port, thereby disallowing the establishment of a communication session between the principal and the network service, a command to shut down the network service, a command to restrict other services supported by the device including operating system managed threads, memory and persistent storage, a command to enter an operating mode that disables access to the resource, and a command to power off.

6 . The method of claim 1 wherein preventing the initiation of the communication session includes:

sending a message to a network traffic control device that controls network traffic into and out of a service device hosting the network service, wherein the network traffic control device includes a switch, a router, a firewall, and a virtual private network service, and wherein the message includes a command to disallow access to the service device by the principal.

7 . The method of claim 1 wherein preventing the initiation of the communication session includes:

sending a message to a device associated with the principal, wherein the message includes at least one of a command to disable network communications to a network address corresponding to one of the network service, a service device hosting the network service, and a subnet including the service device, a command to disable an agent used to communicate with the network service, and a command to reconfigure the agent used to communicate with the network service such that the agent is unable to establish a communication session with the network service.

8 . The method of claim 1 further comprising:

providing an access control service for restricting access to the resource to authorized users; and

denying access to the access control service when the received status information of the principal is inconsistent with allowing access to the resource.

9 . The method of claim 1 wherein receiving status information for a principal that is allowed to access a resource available via a network communication session with a network service includes receiving an indication that the principal has retrieved a token.

10 . The method of claim 1 wherein determining whether the received status information of the first principal is inconsistent with allowing access to the resource is based on the received status information of the principal and on at least one of status information for a second principal, an attribute associated with another entity, access control rules for the resource, and an indication as to when the principal is allowed access to the resource.

11 . The method of claim 1 wherein receiving status information for a principal that is allowed to access a resource available via a network communication session with a network service includes receiving an indication that a VPN client associated with the principal is interacting with a VPN service associated with a service device hosting the network service.

12 . A computer readable medium containing a computer program, executable by a machine, for managing access to a resource over a network using status information of a principal, the computer readable medium comprising instructions for:

receiving status information for a principal that is allowed to access a resource available via a network communication session with a network service;

determining whether the received status information is inconsistent with allowing access to the resource; and

preventing an initiation of a network communication session with the network service for accessing the resource when the received status information of the principal is inconsistent with allowing access to the resource.

13 . The computer readable medium of claim 12 further comprising instructions for storing access information that associates status information with an access condition, wherein the access condition indicates whether access to the resource is allowable based on the status information.

14 . The computer readable medium of claim 12 comprising instructions for preventing an initiation of a network session with the network service for accessing the resource for at least one of the principal, a plurality of principals, and all principals authorized to access the resource.

15 . The computer readable medium of claim 12 further comprising instructions for:

sending a message to a service device hosting the network service, wherein the service device supports at least one communication port associated with the network service for accessing the resource and the message includes at least one of a command to close the associated communication port, thereby disallowing the establishment of a communication session between the principal and the network service, a command to shut down the network service, a command to restrict other services supported by the service device including operating system managed threads, memory and persistent storage, a command to enter an operating mode that disables access to the network service, and a command to power off.

16 . The computer readable medium of claim 12 further comprising instructions for:

sending a message to a network traffic control device that controls network traffic into and out of a service device hosting the network service, wherein the network traffic control device includes a switch, a router, a firewall, and a virtual private network gateway service, and wherein the message includes a command to disallow access to the service device by the principal.

17 . The computer readable medium of claim 12 further comprising instructions for:

sending a message to a device associated with the principal, wherein the message includes at least one of a command to disable network communications to a network address corresponding to one of the network service, a service device hosting the network service, and a subnet including the service device, a command to disable an agent used to communicate with the network service, and a command to reconfigure the agent used to communicate with the network service such that the agent is unable to establish a communication session with the network service.

18 . The computer readable medium of claim 12 further comprising instructions for:

denying access to an access control service for restricting access to the resource to authorized users when the received status information of the principal is inconsistent with allowing access to the resource.

19 . The computer readable medium of claim 12 further comprising instructions for receiving an indication that the principal has retrieved a token and determining whether the received indication is inconsistent with allowing access to the resource.

20 . The computer readable medium of claim 12 further comprising instructions for determining whether the received status information of the first principal is inconsistent with allowing access to the resource is based on the received status information of the principal and on at least one of status information for a second principal, an attribute associated with another entity, access control rules for the resource, and an indication as to when the principal is allowed access to the resource.

21 . The computer readable medium of claim 12 further comprising instructions for receiving an indication that a VPN client associated with the principal is interacting with a VPN service associated with a service device hosting the network service and determining whether the received indication is inconsistent with allowing access to the resource.

22 . A system for managing access to a resource over a network using status information of a principal, the system comprising:

means for receiving status information for a principal that is allowed to access a resource available via a network communication session with a network service;

means for determining whether the received status information is inconsistent with allowing access to the resource; and

means for preventing an initiation of a network communication session with the network service for accessing the resource when the received status information of the principal is inconsistent with allowing access to the resource.

23 . A system for managing access to a resource over a network using status information of a principal, the system comprising:

a principal monitor component configured for receiving status information for a principal that is allowed to access a resource available via a network communication session with a network service;

a session policy manager component configured for determining whether the received status information is inconsistent with allowing access to the resource; and,

a session controller component configured for preventing an initiation of a network communication session with the network service for accessing the resource when the received status information of the principal is inconsistent with allowing access to the resource.

24 . The system of claim 23 further comprising a data store for storing access information that associates status information with an access condition, wherein the access condition indicates whether access to the resource is allowable based on the status information.

25 . The system of claim 23 wherein the session controller component is configured for preventing an initiation of a network session with the network service for accessing the resource for at least one of the principal, a plurality of principals, and all principals authorized to access the resource.

26 . The system of claim 23 wherein the service policy manager component is configured for determining whether the received status information is inconsistent with allowing access to the resource by determining an access condition associated with the received status information.

27 . The system of claim 23 wherein the session controller service component is configured for sending a message to a service device hosting the resource, wherein the service device supports at least one communication port associated with the network service for accessing the resource and the message includes at least one of a command to close the associated communication port, thereby disallowing the establishment of a communication session between the principal and the network service, a command to shut down the network service, a command to restrict other services supported by the service device including operating system managed threads, memory and persistent storage, a command to enter an operating mode that disables access to the network service, and a command to power off.

28 . The system of claim 23 wherein a message handler component responsive to the session controller component is configured for sending a message to a network traffic control device that controls network traffic into and out of a service device hosting the resource, wherein the network traffic control device includes a switch, a router, a firewall, and a virtual private network service, and wherein the message includes a command to disallow access to the service device by the principal.

29 . The system of claim 23 wherein a message handler responsive to the session controller is configured for sending a message to a device associated with the principal, wherein the message includes at least one of a command to disable network communications to a network address corresponding to one of the network service, a service device hosting the resource, and a subnet including the service device, a command to disable an agent used to communicate with the network service, and a command to reconfigure an agent used to communicate with the network service such that the agent is unable to establish a communication session with the network service.

30 . The system of claim 23 wherein the session controller component is configured for denying access to an access control service when the received status information of the principal is inconsistent with allowing access to the resource.

31 . The system of claim 23 wherein the principal monitor component is configured for receiving an indication that the principal has retrieved a token; and,

the session policy manager component is configured for determining whether the received indication is inconsistent with allowing access to the resource.

32 . The system of claim 23 wherein the session policy manager component is configured for determining whether the received status information of the first principal is inconsistent with allowing access to the resource based on the received status information of the principal, and on at least one of status information for a second principal, an attribute associated with another entity, access control rules for the resource, and an indication as to when the principal is allowed access to the resource.

33 . The system of claim 23 wherein the principal monitor component is configured for receiving an indication that a VPN client associated with the principal is interacting with a VPN service associated with a service device hosting the network service; and,

the session policy manager component is configured for determining whether the received indication is inconsistent with allowing access to the resource.