Granted Patent B1

US 8,185,933 · App. 13/019,162 · Granted May 22, 2012

Abstract

Claims (44)

1. A method of controlling access of a plurality of local endpoint devices to a remote network resource by an edge router local to the plurality of local endpoint devices and remote from the remote network resource, wherein the edge router routes packets to the local endpoint devices and provides network access to the local endpoint devices, wherein a remote access control server local to the remote network resource controls access to the remote network resource, and wherein the edge router controls access to the remote network resource on behalf of the remote access control server, the method comprising:

locally caching, by the edge router, a set of endpoint security information maintained by the remote access control server, wherein the locally cached set of endpoint security information specifies one or more policies to control access to the remote network resource by the plurality of local endpoint devices; and

controlling, by the edge router on behalf of the remote access control server, access to the remote network resource by a first one of the endpoint devices based on the locally cached endpoint security information, an identity of a user of the first one of the endpoint devices, and a security state of the first one of the endpoint devices.

2. The method of claim 1 , wherein the policies comprise a plurality of user role policies and a plurality of endpoint health policies, wherein each of the user role policies contains a mapping between a username and a list of roles associated with the username, and wherein each of the endpoint health policies provides a list of user roles that are incompatible with access to a network resource for endpoint devices having a particular security state, and wherein controlling access comprises:

authenticating the user;

in response to authenticating the user, determining the list of roles associated with the identity of the user based on the user role policies;

removing invalid roles from the list of roles based on application of the one or more endpoint health policies to the security state of the first one of the endpoint devices;

generating device-specific access rights for the first one of the endpoint devices based on remaining roles in the list of roles associated with the identity of the user after removing the invalid roles when there is at least one remaining role in the list of roles; and

governing access to the remote network resource based on the device-specific access rights for the first one of the endpoint devices.

3. The method of claim 2 , wherein at least one of the one or more policies denies access to users of a defined role when the users of the defined role are using an endpoint device that is hosting malicious software.

4. The method of claim 3 , wherein the at least one of the one or more policies grants access to users of roles other than the defined role when the users of the roles other than the defined role are using an endpoint device that is hosting the malicious software.

5. The method of claim 2 , wherein at least one of the one or more policies grants access to users of a defined role when the users of the defined role are using an endpoint device that is executing antivirus software.

6. The method of claim 2 , further comprising requesting a current version of one of the endpoint health policies from the remote server when the current version of the one of the endpoint health policies is not cached locally.

7. The method of claim 2 , further comprising requesting a current version of the user role policy for the user from the remote server when the current version of the user role policy is not cached locally.

8. The method of claim 1 , further comprising:

establishing a virtual private network (VPN) connection between the edge router and a remote device that is local to the remote network resource; and

after determining that the first one of the endpoint devices is permitted to access the remote network resource, retrieving the remote network resource via the VPN.

9. The method of claim 1 , further comprising:

receiving, by the edge router, authentication information that describes the user from the first one of the endpoint devices, wherein the authentication information specifies the identity of the user; and

receiving, by the edge router, health information that describes the security state of the first one of the endpoint devices.

10. The method of claim 9 , wherein the health information specifies whether a software application is installed on the first one of the endpoint devices.

11. The method of claim 9 , wherein receiving health information comprises receiving health information from an endpoint defense agent installed on the first one of the endpoint devices.

12. The method of claim 9 , further comprising:

forwarding the authentication information and the health information to the remote server,

wherein controlling access by the edge router on behalf of the remote access control server comprises:

after forwarding the authentication information and the health information to the remote server, beginning a timeout period;

determining that a connection between the edge router and the remote access control server has failed when the timeout period expires before receiving a response from the remote access control server; and

controlling access by the edge router on behalf of the remote access control server when the connection between the edge router and the remote access control server is determined to have failed.

13. The method of claim 1 , further comprising attempting to retrieve a portion of the endpoint security information from the remote server when the cached endpoint security information is not a current version of the endpoint security information maintained by the remote server.

14. An edge router device for controlling access of a plurality of local endpoint devices to a remote network resource, wherein the edge router is local to the plurality of local endpoint devices and remote from the remote network resource, wherein the edge router routes packets to the local endpoint devices and provides network access to the local endpoint devices, wherein a remote access control server local to the remote network resource controls access to the remote network resource, and wherein the edge router controls access to the remote network resource on behalf of the remote access control server, the edge router device comprising:

a memory storing instructions for a local access module; and

a processor configured to execute the instructions for the local access module to locally cache a set of endpoint security information maintained by the remote access control server, wherein the locally cached set of endpoint security information specifies one or more policies to control access to the remote network resource by the plurality of local endpoint devices, and control, on behalf of the remote access control server, access to the remote network resource by a first one of the endpoint devices based on the locally cached endpoint security information, an identity of a user of the first one of the endpoint devices, and a security state of the first one of the endpoint devices.

15. The edge router device of claim 14 , wherein the local access module is configured to establish a virtual private network (VPN) connection between the edge router and a remote device that is local to the remote network resource, and, after determining that the first one of the endpoint devices is permitted to access the remote network resource, retrieve the remote network resource via the VPN.

16. The edge router device of claim 14 , wherein the local access module is configured to receive authentication information that describes the user from the first one of the endpoint devices, wherein the authentication information specifies the identity of the user, and receive health information that describes the security state of the first one of the endpoint devices.

17. The edge router device of claim 16 , wherein the health information specifies whether a software application is installed on the first one of the endpoint devices.

18. The edge router device of claim 16 , wherein the local access module is configured to receive health information from an endpoint defense agent installed on the first one of the endpoint devices.

19. The edge router device of claim 16 , wherein the local access module is configured to forward the authentication information and the health information to the remote server, and wherein to control access on behalf of the remote access control server, the local access module is configured to, after forwarding the authentication information and the health information to the remote server, begin a timeout period, determine that a connection between the edge router and the remote access control server has failed when the timeout period expires before receiving a response from the remote access control server, and control access on behalf of the remote access control server when the connection between the edge router and the remote access control server is determined to have failed.

20. The edge router device of claim 9 , wherein the local access module is configured to attempt to retrieve a portion of the endpoint security information from the remote server when the cached endpoint security information is not a current version of the endpoint security information maintained by the remote server.

21. A system comprising:

a plurality of local endpoint devices; and

an edge router device for controlling access of the plurality of local endpoint devices to a remote network resource, wherein the edge router is local to the plurality of local endpoint devices and remote from the remote network resource, wherein the edge router routes packets to the local endpoint devices and provides network access to the local endpoint devices, wherein a remote access control server local to the remote network resource controls access to the remote network resource, and wherein the edge router controls access to the remote network resource on behalf of the remote access control server, wherein the edge router device is configured to locally cache a set of endpoint security information maintained by the remote access control server, wherein the locally cached set of endpoint security information specifies one or more policies to control access to the remote network resource by the plurality of local endpoint devices, and control, on behalf of the remote access control server, access to the remote network resource by a first one of the endpoint devices based on the locally cached endpoint security information, an identity of a user of the first one of the endpoint devices, and a security state of the first one of the endpoint devices.

22. A non-transitory computer-readable storage medium comprising instructions that, when executed, cause a processor of an edge router device for controlling access of a plurality of local endpoint devices to a remote network resource, wherein the edge router is local to the plurality of local endpoint devices and remote from the remote network resource, wherein the edge router routes packets to the local endpoint devices and provides network access to the local endpoint devices, wherein a remote access control server local to the remote network resource controls access to the remote network resource, and wherein the edge router controls access to the remote network resource on behalf of the remote access control server, to:

locally cache a set of endpoint security information maintained by the remote access control server, wherein the locally cached set of endpoint security information specifies one or more policies to control access to the remote network resource by the plurality of local endpoint devices; and

control, on behalf of the remote access control server, access to the remote network resource by a first one of the endpoint devices based on the locally cached endpoint security information, an identity of a user of the first one of the endpoint devices, and a security state of the first one of the endpoint devices.

Assignments (12)