System and method of network access security policy management by user and device
A system and method are provided for management of access security by user and device. A security policy enforcement point is provided with a user policy module to receive user credentials from an access device of the user and a point for setting device dependent security policy to receive device credentials from the access device. A user policy is retrieved from a user database with use of the user credentials while a device policy is retrieved from a device database with use of the device credentials. The user policy and device policy are combined and used in the SPEP to enforce a user and device based security policy.
1. A system for user-device access security policy management, the system comprising:
a security policy enforcement manager that is configured to receive, from an access device, user credentials over a first information channel, to receive, from the access device, device credentials over a second information channel, to retrieve a user security policy with use of said user credentials, to retrieve a device security policy with use of said device credentials, to generate a user-device security policy with use of said user security policy and said device security policy, and to enforce said user-device security policy, wherein a user is able to switch between different devices under the same user credentials by using different device credentials.
2. The system of claim 1 , wherein the device credentials comprise a device indicator which comprises at least one of a device type, a device model, a device configuration, and a device class.
3. The system of claim 2 , wherein the security policy enforcement manager further comprises:
a user policy module for retrieving said user security policy from a user database, and
a Point for Setting Device Dependent Security Policy (PSDDSP) for retrieving said device security policy from a device database.
4. The system of claim 3 , wherein said user database comprises a user record corresponding to said user credentials, said user record comprising information pertaining to said user security policy, and wherein said device database comprises a device record corresponding to said device credentials, said device record comprising information pertaining to said device security policy.
5. The system of claim 1 , wherein said user-device security policy is generated by combining user security rules of said user security policy with device security rules of said device security policy.
6. The system of claim 5 , wherein said combining comprises adding said user security rules to said device security rules to form a set of user-device rules of said user-device policy.
7. A method for user-device access security policy management, the method comprising:
receiving, at a security policy enforcement manager from an access device, user credentials over a first information channel;
receiving, at the security policy enforcement manager from the access device, device credentials over a second information channel;
retrieving a user security policy with use of said user credentials;
retrieving a device security policy with use of said device credentials;
generating a user-device security policy with use of said user security policy and said device security policy; and
enforcing said user-device security policy, wherein a user is able to switch between different devices under the same user credentials by using different device credentials.
8. The method of claim 7 , wherein the device credentials comprise a device indicator comprising at least one of a device type, a device model, a device configuration, and a device class.
9. The method of claim 8 , wherein said retrieving of said user security policy further comprises:
retrieving by a user policy module said user security policy from a user database, and wherein said retrieving of said device policy further comprises:
retrieving, by a Point for Setting Device Dependent Security Policy (PSDDSP), said device security policy from a device database.
10. The method of claim 9 , wherein said user database comprises a user record corresponding to said user credentials, said user record comprising information pertaining to said user security policy, and wherein said device database comprises a device record corresponding to said device credentials, said device record comprising information pertaining to said device security policy.
11. The method of claim 7 , wherein generating said user-device security policy further comprises:
combining user security rules of said user security policy with device security rules of said device security policy.
12. The method of claim 11 , wherein said step of combining further comprises:
adding said user security rules to said device security rules to form a set of user-device rules of said user-device policy.