Plug-in based policy evaluation
View Patent ↗A device may include an interface to send authentication information to a plug-in, where the authentication information is related to a client device. The interface may send a policy identifier to the plug-in, where the policy identifier identifies a policy, and may receive a policy result from the plug-in, where the policy result is produced using the authentication information and a policy requirement identified by the policy identifier, and where the policy result identifies whether the client device complies with the policy.
1. A method comprising:
identifying, by a first device, information identifying a policy associated with a second device,
the second device being different than the first device,
the first device including a first server, and
the second device including a client device;
identifying, by the first device, a requirement identifier for the policy, the requirement identifier including information related to a policy
requirement that needs to be satisfied for the second device to be identified as complying with the policy;
transmitting, by a plug-in of the first device, the policy requirement and information associated with the second device to a third device,
the third device being different than the first device and the second device,
and the third device including a second server;
receiving, by the plug-in of the first device, a policy result from the third device, the policy result being received based on transmitting the policy
requirement and the information associated with the second device to the third device, and
the policy result indicating whether the second device complies with the policy; and
transmitting, by the first device and to a fourth device, an instruction,
the fourth device being different than the first device, the second device, and the third device,
the fourth device including a network device,
the instruction being based on the policy result, and
the instruction being transmitted to the fourth device to enable the fourth device to selectively grant the second device access to a network destination.
2. The method of claim 1 , where the policy result indicates that the second device does not comply with the policy, and
where transmitting the instruction comprises:
transmitting the instruction to cause the fourth device to deny the second device access to the network destination and to enable the second device to obtain particular information based on the policy result indicating that the second device does not comply with the policy,
the particular information being used by the second device to bring the second device in compliance with the policy.
3. The method of claim 1 , further comprising:
validating an identity of the second device prior to transmitting the policy requirement and the information associated with the second device.
4. The method of claim 3 , further comprising:
receiving a user name and password associated with the second device,
where validating the identity of the second device includes:
determining whether the user name and password are valid.
5. The method of claim 1 , where identifying the information identifying the policy includes:
identifying the information identifying the policy based on information identifying a user of the second device.
6. The method of claim 1 , where the policy result indicates that the second device complies with the policy, and
where transmitting the instruction comprises:
transmitting the instruction to cause the fourth device to grant the second device access to the network destination based on the policy result indicating that the second device complies with the policy.
7. The method of claim 1 , where receiving the policy result includes:
receiving information that includes:
information identifying a user associated with the second device,
the information identifying the policy, and
information indicating whether the policy requirement has been met by the second device.
8. A system comprising:
a first device to:
identify information identifying a policy associated with a second device,
the second device being different than the first device,
the first device including a first server, and
the second device including a client device;
identify a requirement identifier for the policy,
the requirement identifier including information related to a policy requirement that needs to be satisfied for the second device to be identified as complying with the policy;
transmit, by a plug-in of the first device, the policy requirement and information associated with the second device to a third device,
the third device being different than the first device and the second device, and
the third device including a second server;
receive, by the plug-in of the first device, a result from the third device,
the result being received based on transmitting the policy requirement and the information associated with the second device to the third device, and
the result indicating whether the second device complies with the policy; and transmit, to a fourth device, an instruction,
the fourth device being different than the first device, the second device, and the third device,
the fourth device including a network device,
the instruction being based on the result, and
the instruction being transmitted to the fourth device to enable the fourth device to selectively grant the second device access to a network destination.
9. The system of claim 8 ,
where the first server includes a remote authentication dial-in user service (RADIUS) server, and
where the RADIUS server is to:
perform user authentication to validate an identity of the second device.
10. The system of claim 9 , where, when performing the user authentication, the RADIUS server is to:
determine whether a user name and password, of a user associated with the second device, are valid.
11. The system of claim 8 ,
where the second server includes a policy server, and
where the network device includes a network access device.
12. The system of claim 8 , where, when receiving the result, the plug-in of the first device is to:
receive information that includes:
information identifying a user associated with the second device,
the information identifying the policy, and
information indicating whether the policy requirement has been met by the second device.
13. The system of claim 8 , where the policy relates to an antivirus software, and
where the result indicates whether the second device is running the antivirus software.
14. The system of claim 8 , where, when identifying the information identifying the policy, the first device is to:
identify the information identifying the policy based on:
a user name of a user of the second device,
information identifying the network destination, or
information identifying a port, of the second device, that is used to access the fourth device.
15. The system of claim 8 , where the result indicates that the second device does not comply with the policy, and
where, when transmitting the instruction, the first device is to:
transmit the instruction to cause the fourth device to deny the second device access to the network destination and to enable the second device to obtain particular information,
the particular information being used by the second device to bring the second device in compliance with the policy.
16. A non-transitory computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by a first device, cause the first device to:
identify information identifying a policy associated with a second device,
the second device being different than the first device,
the first device including a first server, and
the second device including a client device;
identify a requirement identifier for the policy,
the requirement identifier including information related to a policy requirement that needs to be satisfied for the second device to be identified as complying with the policy;
transmit, by a plug-in of the first device, the policy requirement and information associated with the second device to a third device,
the third device being different than the first device and the second device, and
the third device including a second server;
receive, by the plug-in of the first device, a result from the third device,
the result being received based on transmitting the policy requirement and the information associated with the second device to the third device, and
the result indicating whether the second device complies with the policy; and
transmit, to a fourth device, an instruction,
the fourth device being different than the first device, the second device, and the third device,
the fourth device including a network device,
the instruction being based on the result, and
the instruction being transmitted to the fourth device to enable the fourth device to selectively grant the second device access to a network destination.
17. The non-transitory computer-readable medium of claim 16 , where the one or more instructions to identify the information identifying the policy include:
one or more instructions to identify the information identifying the policy based on:
information identifying a user of the second device,
information identifying the network destination, or
information identifying a port, of the second device, that is used to access the fourth device.
18. The non-transitory computer-readable medium of claim 16 , where the instructions further comprise:
one or more instructions to validate an identity of the second device prior to transmitting the policy requirement and the information associated with the second device.
19. The non-transitory computer-readable medium of claim 16 , where the one or more instructions to receive the result include:
one or more instructions to receive information that includes:
information identifying a user associated with the second device,
the information identifying the policy, and
information indicating whether the policy requirement has been met by the second device.
20. The non-transitory computer-readable medium of claim 16 , where the result indicates that the second device does not comply with the policy, and
where the one or more instructions to transmit the instruction include:
one or more instructions to transmit the instruction to cause the fourth device to deny the second device access to the network destination and to enable the second device to download software from a fifth device,
the software being downloaded by the second device to bring the second device in compliance with the policy.