# US 11,310,275 B2 · Managing admission of unrecognized devices onto an enterprise network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,275 B2 - Document ID: US11310275B2 - Status: Granted - Kind: B2 - Application number: 15/885,347 - Filed: 2018-01-31 - Published: 2019-08-01 - Granted: 2022-04-19 - Earliest claimed: 2018-01-31 - Assignees: Sophos Limited - Applicants: Sophos Limited - Inventors: John Edward Tyrone Shaw; Ross McKerchar; Moritz Daniel Grimm; Jan Karl Heinrich Weber; Shail R. Talati; Kenneth D. Ray; Andrew J. Thomas - Web page: https://patentgrep.com/patent/US11310275B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/0281: {Proxies} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1433: {Vulnerability analysis} - H04W 12/79: Radio fingerprint - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A threat management facility detects a device on an enterprise network and determines whether the device is one of a set of managed devices for the enterprise network. When the device is not one of the set of managed devices, the threat management facility may selectively direct the device to a portal that provides support to the user of the device while the device awaits admission to the enterprise network. As the user interacts with the portal, the portal may manage admission of unrecognized devices onto the enterprise network while making efficient use of network administrator resources. ## Claims ### Claim 1 A method comprising: detecting a device on an enterprise network; when the device provides, to a threat management facility, a heartbeat from a local security agent executing on the device that identifies the device as one of a set of managed devices for the enterprise network, permitting the device to communicate over the enterprise network; and when the device does not provide the heartbeat to the threat management facility, identifying a type of the device from among two or more device types, and upon determining that the type includes a user interface and that the type is manageable by the threat management facility by delivery of the local security agent to the device, directing the device to a landing page of a portal configured to manage admission of unrecognized devices onto the enterprise network by interactively guiding a user of the device through a network entry procedure in the user interface and delivering device management capability to the device by delivering the local security agent that provides the heartbeat to the device for installation on the device. ### Claim 2 (depends on 1) The method of claim 1, further comprising sending a request from the portal to the device for the heartbeat that identifies the device. ### Claim 3 (depends on 1) The method of claim 1, wherein the two or more device types are distinguishable based on a fingerprint associated with the device. ### Claim 4 (depends on 3) The method of claim 3, wherein the fingerprint of the device is based on one or more of network traffic, packet header information, or status reports obtained from communications by the device. ### Claim 5 (depends on 1) The method of claim 1, wherein delivering device management capability to the device includes presenting a landing page to the device, the landing page interactively guiding a user of the device through a network entry procedure. ### Claim 6 (depends on 1) The method of claim 1, wherein delivering device management capability to the device includes installing the local security agent on the device. ### Claim 7 (depends on 1) The method of claim 1, wherein delivering device management capability to the device includes scanning the device for compliance with a security policy. ### Claim 8 (depends on 1) The method of claim 1, further comprising presenting an admission decision for the device to an administrator through a user interface at the threat management facility. ### Claim 9 A computer program product encoded on one or more non-transitory computer storage media, the computer program product comprising instructions that, when executed by one or more computing devices, cause the one or more computing devices to perform operations comprising: detecting a device on an enterprise network; when the device provides, to a threat management facility, a heartbeat from a local security agent executing on the device that identifies the device as one of a set of managed devices for the enterprise network, permitting the device to communicate over the enterprise network; and when the device does not provide the heartbeat to the threat management facility, identifying a type of the device from among two or more device types, and upon determining that the type includes a user interface and that the type is manageable by the threat management facility by delivery of the local security agent to the device, directing the device to a landing page of a portal configured to manage admission of unrecognized devices onto the enterprise network by interactively guiding a user of the device through a network entry procedure in the user interface and delivering device management capability to the device by delivering the local security agent that provides the heartbeat to the device for installation on the device. ### Claim 10 (depends on 9) The computer program product of claim 9, wherein the two or more device types are distinguishable based on a fingerprint associated with the device. ### Claim 11 (depends on 10) The computer program product of claim 10, wherein the fingerprint of the device is based on one or more of network traffic, packet header information, or status reports obtained from communications by the device. ### Claim 12 (depends on 9) The computer program product of claim 9, wherein delivering device management capability to the device includes presenting a landing page to the device, the landing page interactively guiding a user of the device through a network entry procedure. ### Claim 13 (depends on 9) The computer program product of claim 9, wherein delivering device management capability to the device includes installing the local security agent on the device. ### Claim 14 (depends on 9) The computer program product of claim 9, wherein delivering device management capability to the device includes scanning the device for compliance with a security policy. ### Claim 15 A system comprising: a portal for managing admission of unrecognized devices onto an enterprise network, the portal including a first memory and a first processor, the first memory having stored thereon computer executable instructions for causing the first processor to deliver device management capability to a device on the enterprise network; and a threat management facility associated with the enterprise network and in communication with the portal, the threat management facility including a second memory and a second processor, the second memory having stored thereon computer executable instructions for causing the second processor to identify the device as one of a set of managed devices for the enterprise network, to permit the device to communicate over the enterprise network when the device is one of the set of managed devices, and, when the device is not one of the set of managed devices, to identify a type of the device from among two or more device types, and upon determining that the type includes a user interface and that the type is manageable by the threat management facility by delivery of a local security agent to the device, to direct the device to a landing page of the portal and to cause the portal to interactively guide a user of the device through a network entry procedure using the user interface and to deliver the device management capability to the device by delivering the local security agent that provides a heartbeat to the device for installation on the device. ### Claim 16 (depends on 15) The system of claim 15, wherein to deliver device management capability to the device includes presenting a landing page to the device, the landing page interactively guiding a user of the device through a network entry procedure. ### Claim 17 (depends on 15) The system of claim 15, wherein to deliver device management capability to the device includes installing the local security agent on the device. ### Claim 18 (depends on 15) The system of claim 15, wherein to deliver device management capability to the device includes scanning the device for compliance with a security policy. ### Claim 19 (depends on 15) The system of claim 15, wherein the two or more device types are distinguishable based at least in part on a user interface of the device. ### Claim 20 (depends on 19) The system of claim 19, wherein a device that lacks a user interface suitable for interacting with the portal is categorized as an unmanageable type of device.