Method for authentication and assuring compliance of devices accessing external services
View Patent ↗Systems and methods are described for determining whether an electronic computing device complies with the security policy for a network. The invention includes receiving an electronic request signal including an electronically encoded request to allow an electronically encoded process operating on an electronic processor of the electronic computer device to establish electronic communication with a specific target electronic device or service operating on the electronic communications and data network; receiving electronically encoded information about the identity of the electronically encoded process, the electronic computing device, or the use of the electronic computing device; receiving electronically encoded policy elements for the security policy; receiving electronically encoded information about the compliance of the electronic computing device; receiving electronically encoded information related to the identity of the principal of the electronic computing device; and determining whether the electronic computing device complies with the security policy.
1. A system for providing a compliance-based identity for determining whether an electronic computing device complies with the security policy for an electronic communications and data network of electronic computer devices, such determination including the context of said electronic computing devices, comprising:
an identity provider comprising a memory storing computer readable instructions, and a microprocessor for executing said instructions;
said identity provider configured to:
receive an electronic request signal from said electronic computing device and establish a virtual private network (VPN) connection with said electronic computing device and a VPN concentrator, said electronic request signal including an electronically encoded request to allow an electronically encoded process operating on an electronic processor of said electronic computer device to establish electronic communication with a specific target electronic device or service operating on said electronic communications and data network;
receive from said electronic computing device electronically encoded information about the identity of said electronically encoded process, said electronic computing device, or the user of said electronic computing device;
receive from a policy store electronically encoded policy elements defined by said security policy;
receive from a compliance server electronically encoded information about the compliance of said electronic computing device with respect to said security policy;
receive from said VPN concentrator electronically encoded information related to the identity of the principal of said electronic computing device; and
determine at said identity provider whether said electronic computing device complies with said security policy using said request, said identity, said compliance, and said principal identity information, and said policy elements.
2. The system of claim 1 , wherein said electronically encoded policy elements are included in a look-up in a local electronic data store.
3. The system of claim 1 , wherein said electronically encoded policy elements are selected from the group consisting of: specifications related to time of day access, location of access, required user device specifications, forbidden user device specifications, and anti-virus status.
4. The system of claim 1 , wherein said information about the compliance of said electronic computing device is received from said electronic computing device in said electronic request signal.
5. The system of claim 1 , wherein said information about the compliance of said electronic computing device is received from an compliance server or compliance data store.
6. The system of claim 1 , wherein said identity provider is further configured to generate at least one electronically encoded indicator.
7. The system of claim 1 , wherein at least a portion of said electronically encoded information related to the identity of the principal of said electronic computing device has been validated.
8. A method for determining whether an electronic computing device complies with the security policy for an electronic communications and data network of electronic computer devices, such determination including the context of said electronic computing device, said method comprising:
establishing a virtual private network (VPN) connection with said electronic computing device, an identity provider, and a VPN concentrator;
receiving over from said electronic computing device said VPN connection an electronic request signal, said electronic request signal including an electronically encoded request to allow an electronically encoded process operating on an electronic processor of said electronic computer device to establish electronic communication with a specific target electronic device or service operating on said electronic communications and data network;
receiving from said electronic computing device electronically encoded information about the identity of said electronically encoded process, said electronic computing device, or the user of said electronic computing device;
receiving from a policy store electronically encoded policy elements for said security policy;
receiving from a compliance server electronically encoded information about the compliance of said electronic computing device with respect to said security policy;
receiving from said VPN connection electronically encoded information related to the identity of the principal of said electronic computing device; and
determining at said identity provider whether said electronic computing device complies with said security policy using said request, said identity, said compliance, and said principal identity information, and said policy elements.
9. The method of claim 8 , wherein said receiving of said electronically encoded policy elements includes looking up said electronically encoded policy elements in a local electronic data store.
10. The method of claim 8 , wherein said electronically encoded policy elements are selected from the group consisting of: specifications related to time of day access, location of access, required user device specifications, forbidden user device specifications, and anti-virus status.
11. The method of claim 8 , including receiving said information about the compliance of said electronic computing device from said electronic computing device or in said electronic request signal.
12. The method of claim 8 , including receiving said information about the compliance of said electronic computing device from an compliance server or compliance data store.
13. The method of claim 8 , further including generating at least one electronically encoded indicator.
14. The system of claim 8 , wherein at least a portion of said electronically encoded information related to the identity of the principal of said electronic computing device has been validated.
15. A non-transitory computer-readable medium, containing electronically encoded computer readable program control devices thereon, said electronically encoded computer readable program control devices being configured to enable an electronic computer to perform electronic computer operations comprising:
establishing a virtual private network (VPN) connection with said electronic computing device, an identity provider, and a VPN concentrator;
receiving over from said electronic computing device said VPN connection an electronic request signal, said electronic request signal including an electronically encoded request to allow an electronically encoded process operating on an electronic processor of said electronic computer device to establish electronic communication with a specific target electronic device or service operating on said electronic communications and data network;
receiving from said electronic computing device electronically encoded information about the identity of said electronically encoded process, said electronic computing device, or the user of said electronic computing device;
receiving from a policy store electronically encoded policy elements for said security policy;
receiving from a compliance server electronically encoded information about the compliance of said electronic computing device with respect to said security policy;
receiving from said VPN connection electronically encoded information related to the identity of the principal of said electronic computing device; and
determining at said identity provider whether said electronic computing device complies with said security policy using said request, said identity, said compliance, and said principal identity information, and said policy elements.
16. The non-transitory computer-readable medium of claim 15 , wherein said receiving of said electronically encoded policy elements includes looking up said electronically encoded policy elements in a local electronic data store.
17. The non-transitory computer-readable medium of claim 15 , wherein said electronically encoded policy elements are selected from the group consisting of: specifications related to time of day access, location of access, required user device specifications, forbidden user device specifications, and anti-virus status.
18. The non-transitory computer-readable medium of claim 15 , including receiving said information about the compliance of said electronic computing device from said electronic computing device in said electronic request signal.
19. The non-transitory computer-readable medium of claim 15 , including receiving said information about the compliance of said electronic computing device from an compliance server or compliance data store.
20. The non-transitory computer-readable medium of claim 15 , further including generating at least one electronically encoded indicator.
21. The system of claim 15 , wherein at least a portion of said electronically encoded information related to the identity of the principal of said electronic computing device has been validated.