Method of optimizing policy conformance check for a device with a large set of posture attribute combinations
View Patent ↗A method, apparatus, and electronic device for conforming integrity of a client device 106 are disclosed. A memory 1100 may store a policy tag 404 associated with a subgroup of a group of policies 1102 and having a tag timestamp. A network interface 1060 may receive the certificate of health 300 from the client device 106 . A processor 1010 may extract from the certificate of health a certificate timestamp 302 and a policy tag 304 . The processor 1010 may access the tag timestamp. The processor 1010 may execute a comparison of the certificate timestamp 302 with the tag timestamp. The network interface 1060 may grant access to a network 104 based in part upon the comparison.
1. A method for conforming integrity of a client device, comprising:
receiving a certificate of health from the client device;
extracting from the certificate of health a certificate timestamp and a policy tag associated with a subgroup of a group of policies;
storing multiple policy tags in a priority order;
accessing a tag timestamp associated with the policy tag;
executing a comparison of the certificate timestamp with the tag timestamp; and
granting access to a network based in part upon the comparison.
2. The method of claim 1 , further comprising:
granting access to a quarantine network if the certificate timestamp predates the tag timestamp and the tag timestamp is a critical timestamp.
3. The method of claim 1 , further comprising:
instructing the client device to perform a detailed remediation process if the certificate timestamp predates the tag timestamp.
4. The method of claim 3 , further comprising:
granting access to the network if the certificate timestamp predates the tag timestamp, the tag timestamp is a non-critical timestamp, and the certificate of health has no policy tags with a critical timestamp that postdates the certificate timestamp.
5. The method of claim 1 , further comprising:
accessing a threshold timestamp associated with the group of policies; and
granting access to a quarantine network if the certificate timestamp predates the threshold timestamp.
6. The method of claim 1 , further comprising:
associating a policy timestamp with a policy of the group of policies.
7. The method of claim 1 , wherein the policy tag is a combo tag associated with a set of policy tags.
8. An access server for conforming integrity of a client device, comprising:
a memory that stores a policy tag associated with a subgroup of a group of policies and a tag timestamp, wherein the memory stores multiple policy tags in a priority order;
a processor that extracts from a certificate of health a certificate timestamp and the policy tag, accesses the tag timestamp, and executes a comparison of the certificate timestamp with the tag timestamp; and
a network interface that receives the certificate of health from the client device and grants access to a network based in part upon the comparison.
9. The access server of claim 8 , wherein the network interface grants access to a quarantine network if the certificate timestamp predates the tag timestamp and the tag timestamp is a critical timestamp.
10. The access server of claim 8 , wherein the network interface instructs the client device to perform a detailed remediation process if the certificate timestamp predates the tag timestamp.
11. The access server of claim 10 , wherein the network interface grants access to the network if the certificate timestamp predates the tag timestamp, the tag timestamp is a non-critical timestamp, and the certificate of health has no policy tags with a critical timestamp that postdates the certificate timestamp.
12. The access server of claim 8 , wherein the processor accesses a threshold timestamp associated with the group of policies and grants access to a quarantine network if the certificate timestamp predates the threshold timestamp.
13. The access server of claim 8 , wherein the memory associates a policy timestamp with a policy of the group of policies.
14. The access server of claim 8 , wherein the policy tag is a combo tag associated with a set of policy tags.
15. A system comprising:
a client device to securely access a network, comprising:
a memory that stores a certificate of health containing a policy tag associated with a subgroup of a group of policies and a certificate timestamp; and
a transceiver that transmits the certificate of health to the network and accesses the network based in part upon a comparison of a tag timestamp associated with the policy tag and the certificate timestamp; and
an access server comprising:
a memory that stores multiple policy tags in a priority order.
16. The system of claim 15 , wherein the client device further-comprises:
a processor that performs a detailed remediation process if the certificate timestamp predates the tag timestamp.
17. The system of claim 15 , wherein the client device further-comprises:
a processor that performs a detailed remediation process after the client device accesses a quarantine network if the certificate timestamp predates the tag timestamp and the tag timestamp is a critical timestamp.
18. The system of claim 15 , wherein the transceiver accesses a quarantine network if a threshold timestamp associated with the group of policies predates the certificate timestamp.
19. The system of claim 15 , wherein the policy tag is a combo tag associated with a set of policy tags.