# US 10,313,350 B2 · Remote access to resources over a network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,313,350 B2
- Document ID: US10313350B2
- Status: Granted
- Kind: B2
- Application number: 15/907,194
- Filed: 2018-02-27
- Published: 2018-09-06
- Granted: 2019-06-04
- Earliest claimed: 2003-12-10
- Assignees: SonicWALL, Inc.
- Applicants: SonicWALL US Holdings Inc.
- Inventors: Chris Hopen; Gary Tomlinson; Parvez Anandam; Brian Young; Alan Flagg; Jude Michael Dylan O'Reilley
- Web page: https://patentgrep.com/patent/US10313350B2

## CPC

- H04L 12/2856: {Access arrangements, e.g. Internet access (asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W)}
- G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements
- H04L 47/783: Distributed allocation of resources, e.g. bandwidth brokers
- H04L 47/805: {QOS or priority aware}
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/0263: {Rule management}
- H04L 63/0272: {Virtual private networks}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 67/563: Data redirection of data network streams
- G06F 2221/034: Test or assess a computer or a system
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 67/63: Routing a service request depending on the request content or context
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Systems and techniques are provided for controlling requests for resources from remote computers. A remote computer's ability to access a resource is determined based upon the computer's operating environment. The computer or computers responsible for controlling access to a resource will interrogate the remote computer to ascertain its operating environment. The computer or computers responsible for controlling access to a resource may, for example, download one or more interrogator agents onto the remote computer to determine its operating environment. Based upon the interrogation results, the computer or computers responsible for controlling access to a resource will control the remote computer's access to the requested resource.

## Claims

### Claim 1

A method for controlling access to data, the method comprising:
receiving a signature from an interrogator agent at a first computer, wherein the signature includes a set of Boolean logical expressions defining a list of artifacts that characterize an operating environment of the first computer;
matching the set of Boolean logical expressions with at least one configuration controlled by a provisioning server; and
classifying the first computer into a zone in accordance with the at least one configuration, the zone governed by a rule identifying one or more operating environment requirements for accessing one or more resources in a server system, wherein the first computer is allowed to access at least one of the resources based on the classification.

### Claim 2 (depends on 1)

The method of claim 1, wherein matching the set of Boolean logical expressions with the at least one configuration comprises:
identifying that the set of Boolean logical expressions includes an AND operator and one or more artifact literal values; and
identifying that the set of Boolean logical expressions meets a condition for classifying the first computer into the zone based on each of the one or more artifact literal values associated with the AND operator indicating a TRUE state.

### Claim 3 (depends on 2)

The method of claim 2, wherein the one or more artifact literal values include at least one of a computer object, a process object, a security process object, an anti-virus agent, a communication process objects, agents associated with a virtual private network (VPN), or an application program.

### Claim 4 (depends on 2)

The method of claim 2, wherein matching the set of Boolean logical expressions with the at least one configuration further comprises:
identifying that the set of Boolean logical expressions includes an OR operator and one or more associated artifact literal values;
identifying that at least one of the agent literal values associated with the OR operator indicates a TRUE state; and
identifying that the set of Boolean logical expressions meets a condition for classifying the first computer into the zone based on the identification that the identification that the at least one agent literal value associated with the OR operator indicates the TRUE state.

### Claim 5 (depends on 4)

The method of claim 4, wherein the at least one agent literal value associated with the OR operator includes at least one of a computer object, a process object, a security process object, an anti-virus agent, a communication process objects, a firewall agent, agents associated with a virtual private network (VPN), or an application program.

### Claim 6 (depends on 1)

The method of claim 1, wherein the first computer is a user device.

### Claim 7 (depends on 1)

The method of claim 1, wherein the first computer is a firewall.

### Claim 8

A method for controlling access to data, the method comprising:
downloading an interrogator agent onto a first computer over a communication network;
executing the interrogator agent, wherein execution of the interrogator agent by a processor of the first computer;
identifies one or more artifacts characterizing an operating environment of the first computer, and
generates a signature based on the identified artifacts, wherein the signature includes a set of Boolean logical expressions defining a list of the identified artifacts; and
sending the signature to a server for evaluation, wherein the server classifies the first computer into a zone based on matching the set of Boolean logical expressions with at least one configuration controlled by a provisioning server, the zone governed by a rule identifying one or more operating environment requirements for accessing one or more resources.

### Claim 9 (depends on 8)

The method of claim 8, further comprising:
sending a request to access at least one of the resources; and
accessing the at least one resource based on the first computer having been classified into the zone.

### Claim 10 (depends on 8)

The method of claim 8, wherein the identified artifacts include at least one of a computer object, a process object, a security process object, an anti-virus agent, a communication process objects, agents associated with a virtual private network (VPN), or an application program.

### Claim 11 (depends on 8)

The method of claim 8, further comprising:
receiving an indication regarding an update to the operating environment of the first computer;
executing program code, wherein the execution of the program code by the processor of the first computer updates the operating environment of the first computer device;
generating a second signature that includes a second set of Boolean logical expressions defining a list of artifacts that characterize the updated operating environment of the first computer device; and
sending the second signature to the server, wherein the server classifies the first computer based on matching the second set of Boolean logical expressions to at least one configuration associated with another zone governed by another rule.

### Claim 12 (depends on 11)

The method of claim 11, further comprising accessing at least one resource based on the first computer having been classified into the other zone.

### Claim 13 (depends on 11)

The method of claim 11, wherein the program code includes at least one of a type of operating system software, a version of the operating system software, a software patch, or a security program.

### Claim 14

A method for controlling access to data, the method comprising:
receiving a request to access a resource, the request sent from a requesting computer over a communication network and indicating an operating environment of the requesting computer;
identifying that the operating environment of the requesting computer does not conform to a configuration rule; and
sending program code to the requesting computer, wherein the requesting computer executes the program code to update the operating environment to conform to the configuration rule.

### Claim 15 (depends on 14)

The method of claim 14, wherein identifying that the operating environment of the requesting computer does not conform to the configuration rule includes evaluating a signature of the requesting computer.

### Claim 16 (depends on 15)

The method of claim 15, wherein the signature includes a set of Boolean logical expressions defining a list of artifacts that characterize the operating environment of the requesting computer, and wherein evaluating the signature of the requesting computer comprises matching the set of Boolean logical expressions to at least one configuration controlled by a provisioning server.

### Claim 17 (depends on 14)

The method of claim 14, further comprising:
sending an interrogator agent to the requesting computer over the communication network, wherein the interrogator agent is executable by a processor of the requesting computer to identify one or more artifacts that characterize the operating environment; and
receiving information regarding the identified artifacts from the interrogator agent.

### Claim 18 (depends on 17)

The method of claim 17, wherein the interrogator agent is further executable to generate a signature that includes a set of Boolean logical expressions defining a list of the identified artifacts.

### Claim 19 (depends on 18)

The method of claim 18, wherein the information received from the interrogator agent includes the signature, and further comprising:
identifying that the Boolean logical expression includes an AND operator and one or more associated artifact literal values; and
identifying that the Boolean logical expression meets a condition for classifying the requesting computer into a zone based on each of the artifact literal values associated with the AND operator indicating a TRUE state.