Back to results
US 11,539,695 B2Granted
Secure controlled access to protected resources
AssigneeTwingate, Inc.
InventorsLior Rozner, Alexander William Marshall, Eran Moshe Kampf, Dmitry Adamushka, Dzianis Vashchuk, Eugene Lapidous
Life of this patent
Estimating the term…
Abstract
A client node (CN) requests content from an access node (AN). Rule set ACR_CN is provided to CN and AN and ACR_AN is used by AN. A request sent by CN in violation of ACR_CN may be blocked and cause AN to block subsequent requests from CN that would be allowed per ACR_CN. A request blocked according to ACR_AN but not ACR_CN is blocked but subsequent requests may still be allowed according to ACR_CN and ACR_AN. Authenticated distribution of the ACR_CN and ACR_AN may be performed in cooperation with a controller using authenticated tokens (AT).
Claims25
A system for managing access comprising:
- a first computer connected to a network and configured to control access to a protected resource, the first computer comprising one or more processing devices and one or more memory devices operably coupled to the one or more processing devices, the one or more memory devices storing executable code, that, when executed by the one or more processing devices, causes the one or more processing devices to:
- obtain one or more rules formulated to determine whether one or more resource requests should be sent from the first computer to a second computer;
- intercept, by a module on the first computer, a first resource request;
- apply the one or more rules to the first resource request;
- if the first resource request is allowed according to the one or more rules:
- (a) send the one or more rules to the second computer;
- and
- after performing (a), (b) send the first resource request to the second computer;
- wherein the executable code, when executed by the one or more processing devices, further causes the one or more processing devices to:
- obtain the one or more rules by:
- (c) after intercepting the first resource request, holding the first resource request on the first computer;
- and
- while performing (c):
- sending a second request to a third computer for the one or more rules;
- and
- receiving a response to the second request from the third computer, the response including the one or more rules;
- apply the one or more rules contained in the response from the third computer to the first resource request;
- and
- if the first resource request should be sent to the second computer according to the one or more rules, send at least part of the response received from the third computer to the second computer before sending the first resource request to the second computer.
16 more elements
A system for managing access comprising:
- a first computer connected to a network and configured to control access to a protected resource, the first computer comprising one or more processing devices and one or more memory devices operably coupled to the one or more processing devices, the one or more memory devices storing executable code, that, when executed by the one or more processing devices, causes the one or more processing devices to:
- obtain a first rule set containing one or more rules formulated to determine whether one or more intercepted resource requests are for a protected resource;
- intercept a first request of the one or more intercepted resource requests from a second computer;
- and
- if the first request matches one or more rules in the first rule set perform in order:
- holding the first request on the first computer;
- sending a request to a third computer for a second rule set including one or more rules formulated to determine whether the one or more intercepted resource requests are allowed to be issued by the first computer;
- receiving the second rule set;
- if the first request is allowed according to the second rule set, sending the first request to the second computer;
- and
- if the first request is not allowed according to the second rule set, blocking the first request.
8 more elements
A system for managing access comprising:
- a first computer connected to a network and configured to control access to a protected resource, the first computer comprising one or more processing devices and one or more memory devices operably coupled to the one or more processing devices, the one or more memory devices storing executable code, that, when executed by the one or more processing devices, causes the one or more processing devices to:
- store a first rule set including one or more rules formulated to determine whether one or more incoming requests from a second computer can be allowed to proceed;
- receive a first request for a resource from the second computer;
- determine that the first request is blocked according to the first rule set;
- in response to determining that the first request is blocked according to the first rule set, preventing request allowance according to the first rule set;
- receive a second rule set including one or more rules formulated to determine whether the one or more incoming requests from the second computer can be allowed to proceed;
- evaluate whether a time of receipt of the second rule set is after a time one or after blocking of the first request;
- if the time of receipt of the second rule set is before the time on or after blocking of the first request, prevent request allowance according to the second rule set;
- and
- if the time of receipt of the second rule set is after the time on or after blocking of the first request, allow one or more subsequent requests that are allowable according to the second rule set.
7 more elements
Dependencies are inferred from the claim text.