Compliance-based client access control for network services

A method comprising:

• receiving, by a client device, from an access control server, one or more compliance requirements for accessing a service;
• providing, to the access control server, one or more compliance indicators associated with the one or more compliance requirements, wherein:
• a compliance requirement of the one or more compliance requirements comprises a first check and a second check, and
• a compliance indicator of the one or more compliance indicators associated with the compliance requirement comprises at least one of:
• a logical conjunction of a result of the first check and a result of the second check, or a logical disjunction of the result of the first check and the result of the second check;
• providing, to the access control server, a request for an access certificate to access the service;
• receiving, from the access control server, the access certificate certifying accessibility of the service to the client device, wherein the access certificate comprises:
• an indication that at least one of the client device, a user of the client device, or a user session instantiated on the client device complies with the one or more compliance requirements, and
• a digital signature of the access control server that is verifiable by the service;
• and
• providing the access certificate to a provider server associated with the service.

A system comprising:

• a memory device;
• and
• a processing device coupled to the memory device, the processing device to perform operations comprising:
• providing, by an access control server, to a client device, one or more compliance requirements for accessing a service;
• receiving, from the client device, one or more compliance indicators associated with the one or more compliance requirements, wherein:
• a compliance requirement of the one or more compliance requirements comprises a first check and a second check, and
• a compliance indicator of the one or more compliance indicators associated with the compliance requirement comprises at least one of:
• a logical conjunction of a result of the first check and a result of the second check, or a logical disjunction of the result of the first check and the result of the second check;
• receiving, from the client device, a request for an access certificate to access the service;
• evaluating the one or more compliance indicators based on the one or more compliance requirements;
• responsive to determining that each compliance requirement of the one or more compliance requirements is satisfied by a respective compliance indicator of the one or more compliance indicators, generating the access certificate certifying accessibility of the service to the client device, wherein the access certificate comprises:
• an indication that at least one of the client device, a user of the client device, or a user session instantiated on the client device complies with the one or more compliance requirements, and
• a digital signature of the access control server that is verifiable by the service;
• and
• providing the access certificate to the client device.