Network Access Control with Compliance Policy Check

Abstract

Embodiments of the present invention include methods involving an authentication application, a client application, or a combination of a network access control server with the authentication application and the client application. The client application collects compliance data regarding the user device and communicates the compliance data to the network access control server. The network access control server generates a compliance check result based on whether the compliance data indicates that the user device is compliant with a security policy for the software-as-a-service server. The authentication application grants access by the user device when the compliance check result is positive; and the authentication application denies access by the user device when the compliance check result is negative. In some embodiments, the compliance check result or a user device identifier is stored in a web browser cookie or a client certificate on the user device.

Description

CROSS REFERENCE TO RELATED APPLICATIONS[0001]This patent application is a continuation of U.S. patent application Ser. No. 15 / 069,459 filed Mar. 14, 2016, which is a continuation-in-part of U.S. patent application Ser. No. 14 / 572,699 filed Dec. 16, 2014, which are incorporated by reference herein.BACKGROUND OF THE INVENTION[0002]Network access control (NAC), also called network admission control, enhances or enables the security of a proprietary network (e.g., a Software-as-a-Service (SAAS) proprietary network server) by restricting the availability of network resources to endpoint user devices that comply with a defined security policy. In some cases, an NAC server performs authentication and authorization functions for the user devices of potential subscribers by verifying login information, e.g. username and password, when the user devices attempt to login to the proprietary network, e.g., through the Internet. In addition, the NAC server may restrict the data that each particula...

AI Technical Summary

Benefits of technology

The present invention provides a method and system for authentication and access control in a software-as-a-service server environment. The technical effects of the invention include improved security and compliance with data policies, as well as a better user experience through a more secure login process. The system involves a network access control server, an authentication application, and a device application running on the user device. The device application collects compliance data regarding the user device and sends it to the network access control server, which generates a compliance check result based on the compliance data and a security policy for the software-as-a-service server. The authentication application requests the compliance data from the network access control server and grants or denies access to the server based on the check result. The compliance data may include hardware, software, and configuration data of the user device, such as encryption state, malware infection state, and unwanted application presence. Overall, the invention enhances security and access control in a software-as-a-service server environment.

Problems solved by technology

However, security issues still arise with respect to NAC systems in proprietary networks with large numbers of users and many different, frequently changing, devices that may be used to access the proprietary network.

Images