Remote access to resources over a network
Systems and techniques are provided for controlling requests for resources from remote computers. A remote computer's ability to access a resource is determined based upon the computer's operating environment. The computer or computers responsible for controlling access to a resource will interrogate the remote computer to ascertain its operating environment. The computer or computers responsible for controlling access to a resource may, for example, download one or more interrogator agents onto the remote computer to determine its operating environment. Based upon the interrogation results, the computer or computers responsible for controlling access to a resource will control the remote computer's access to the requested resource.
1. A method for controlling access to data, the method comprising:
receiving a signature from an interrogator agent at a first computer, wherein the signature includes a set of Boolean logical expressions defining a list of artifacts that characterize an operating environment of the first computer;
matching the set of Boolean logical expressions with at least one configuration controlled by a provisioning server; and
classifying the first computer into a zone in accordance with the at least one configuration, the zone governed by a rule identifying one or more operating environment requirements for accessing one or more resources in a server system, wherein the first computer is allowed to access at least one of the resources based on the classification.
2. The method of claim 1 , wherein matching the set of Boolean logical expressions with the at least one configuration comprises:
identifying that the set of Boolean logical expressions includes an AND operator and one or more artifact literal values; and
identifying that the set of Boolean logical expressions meets a condition for classifying the first computer into the zone based on each of the one or more artifact literal values associated with the AND operator indicating a TRUE state.
3. The method of claim 2 , wherein the one or more artifact literal values include at least one of a computer object, a process object, a security process object, an anti-virus agent, a communication process objects, agents associated with a virtual private network (VPN), or an application program.
4. The method of claim 2 , wherein matching the set of Boolean logical expressions with the at least one configuration further comprises:
identifying that the set of Boolean logical expressions includes an OR operator and one or more associated artifact literal values;
identifying that at least one of the agent literal values associated with the OR operator indicates a TRUE state; and
identifying that the set of Boolean logical expressions meets a condition for classifying the first computer into the zone based on the identification that the identification that the at least one agent literal value associated with the OR operator indicates the TRUE state.
5. The method of claim 4 , wherein the at least one agent literal value associated with the OR operator includes at least one of a computer object, a process object, a security process object, an anti-virus agent, a communication process objects, a firewall agent, agents associated with a virtual private network (VPN), or an application program.
6. The method of claim 1 , wherein the first computer is a user device.
7. The method of claim 1 , wherein the first computer is a firewall.
8. A method for controlling access to data, the method comprising:
downloading an interrogator agent onto a first computer over a communication network;
executing the interrogator agent, wherein execution of the interrogator agent by a processor of the first computer;
identifies one or more artifacts characterizing an operating environment of the first computer, and
generates a signature based on the identified artifacts, wherein the signature includes a set of Boolean logical expressions defining a list of the identified artifacts; and
sending the signature to a server for evaluation, wherein the server classifies the first computer into a zone based on matching the set of Boolean logical expressions with at least one configuration controlled by a provisioning server, the zone governed by a rule identifying one or more operating environment requirements for accessing one or more resources.
9. The method of claim 8 , further comprising:
sending a request to access at least one of the resources; and
accessing the at least one resource based on the first computer having been classified into the zone.
10. The method of claim 8 , wherein the identified artifacts include at least one of a computer object, a process object, a security process object, an anti-virus agent, a communication process objects, agents associated with a virtual private network (VPN), or an application program.
11. The method of claim 8 , further comprising:
receiving an indication regarding an update to the operating environment of the first computer;
executing program code, wherein the execution of the program code by the processor of the first computer updates the operating environment of the first computer device;
generating a second signature that includes a second set of Boolean logical expressions defining a list of artifacts that characterize the updated operating environment of the first computer device; and
sending the second signature to the server, wherein the server classifies the first computer based on matching the second set of Boolean logical expressions to at least one configuration associated with another zone governed by another rule.
12. The method of claim 11 , further comprising accessing at least one resource based on the first computer having been classified into the other zone.
13. The method of claim 11 , wherein the program code includes at least one of a type of operating system software, a version of the operating system software, a software patch, or a security program.
14. A method for controlling access to data, the method comprising:
receiving a request to access a resource, the request sent from a requesting computer over a communication network and indicating an operating environment of the requesting computer;
identifying that the operating environment of the requesting computer does not conform to a configuration rule; and
sending program code to the requesting computer, wherein the requesting computer executes the program code to update the operating environment to conform to the configuration rule.
15. The method of claim 14 , wherein identifying that the operating environment of the requesting computer does not conform to the configuration rule includes evaluating a signature of the requesting computer.
16. The method of claim 15 , wherein the signature includes a set of Boolean logical expressions defining a list of artifacts that characterize the operating environment of the requesting computer, and wherein evaluating the signature of the requesting computer comprises matching the set of Boolean logical expressions to at least one configuration controlled by a provisioning server.
17. The method of claim 14 , further comprising:
sending an interrogator agent to the requesting computer over the communication network, wherein the interrogator agent is executable by a processor of the requesting computer to identify one or more artifacts that characterize the operating environment; and
receiving information regarding the identified artifacts from the interrogator agent.
18. The method of claim 17 , wherein the interrogator agent is further executable to generate a signature that includes a set of Boolean logical expressions defining a list of the identified artifacts.
19. The method of claim 18 , wherein the information received from the interrogator agent includes the signature, and further comprising:
identifying that the Boolean logical expression includes an AND operator and one or more associated artifact literal values; and
identifying that the Boolean logical expression meets a condition for classifying the requesting computer into a zone based on each of the artifact literal values associated with the AND operator indicating a TRUE state.