# US 2015/0229651 A1 · Methods and systems for controlling access to computing resources based on known security vulnerabilities > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2015/0229651 A1 - Document ID: US20150229651A1 - Status: Published application - Kind: A1 - Application number: 14/618,685 - Filed: 2015-02-10 - Published: 2015-08-13 - Earliest claimed: 2005-12-21 - Assignees: Fiberlink Communications Corporation - Applicants: Fiberlink Communications Corporation - Inventors: BLAIR NICODEMUS; Billy Edison Stephens - Web page: https://patentgrep.com/patent/US20150229651A1 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 11/3495: {for systems} - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 63/102: {Entity profiles} - H04L 63/105: {Multiple levels of security} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - G06F 16/17: Details of further file system functions - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods and systems are provided for fine tuning access control by remote, endpoint systems to host systems. Multiple conditions/states of one or both of the endpoint and host systems are monitored, collected and fed to an analysis engine. Using one or more of many different flexible, adaptable models and algorithms, an analysis engine analyzes the status of the conditions and makes decisions in accordance with pre-established policies and rules regarding the security of the endpoint and host system. Based upon the conditions, the policies, and the analytical results, actions are initiated regarding security and access matters. In one described embodiment of the invention, the monitored conditions include software vulnerabilities. ## Claims ### Claim at position 1 1-28. (canceled) ### Claim 29 A method for controlling the operation of an endpoint, comprising: providing a user interface, at a computing system remote from the end point, configured to allow configuration of a plurality of policies; maintaining the plurality of policies in a data store on the computing system; identifying, from the plurality of policies, a plurality of operating conditions on the endpoint to monitor; configuring one or more software services provided by an operating system on the endpoint to monitor the plurality of operating conditions; receiving, across a network, at the computing system, status information about the plurality of operating conditions on the endpoint gathered by the one or more software services; determining, by the computing system, a compliance state of the endpoint based on the status information and a plurality of compliance policies in the data store; and initiating, by the computing system, based on the compliance state, an action identified in at least one rule in the data store, wherein the action is carried out by a processor on the endpoint. ### Claim 30 (depends on 29) The method of claim 29, wherein the action comprises controlling access of the endpoint to computing resources. ### Claim 31 (depends on 29) The method of claim 29, wherein the user interface comprises a web page. ### Claim 32 (depends on 29) The method of claim 29, further comprising requesting, at the computing system, the status information on a periodic basis. ### Claim 33 (depends on 29) The method of claim 29, wherein the endpoint comprises a mobile device. ### Claim 34 (depends on 29) The method of claim 29, further comprising configuring one or more application running on the endpoint on the endpoint to monitor at least a subset of the plurality of operating conditions. ### Claim 35 (depends on 29) The method of claim 29, wherein the conditions comprise at least one hardware condition. ### Claim 36 (depends on 29) The method of claim 29, wherein the conditions comprise at least one software condition. ### Claim 37 (depends on 29) The method of claim 29, wherein the computing system comprises a plurality of servers. ### Claim 38 (depends on 29) The method of claim 29, wherein the plurality of policies includes at least one policy that includes the at least one rule that identifies the action. ### Claim 39 A non-transitory computer readable medium containing computer instructions for controlling the operation of an endpoint, comprising: providing a user interface, at a computing system remote from the end point, configured to allow configuration of a plurality of policies; maintaining the plurality of policies in a data store on the computing system; identifying, from the plurality of policies, a plurality of operating conditions on the endpoint to monitor; configuring one or more software services provided by an operating system on the endpoint to monitor the plurality of operating conditions; receiving, across a network, at the computing system, status information about the plurality of operating conditions on the endpoint gathered by the one or more software services; determining, by the computing system, a compliance state of the endpoint based on the status information and a plurality of compliance policies in the data store; and initiating, by the computing system, based on the compliance state, an action identified in at least one rule in the data store, wherein the action is carried out by a processor on the endpoint. ### Claim 40 (depends on 39) The computer readable medium of claim 39, wherein the action comprises controlling access of the endpoint to computing resources. ### Claim 41 (depends on 39) The computer readable medium of claim 39, wherein the user interface comprises a web page. ### Claim 42 (depends on 39) The computer readable medium of claim 39, further comprising requesting, at the computing system, the status information on a periodic basis. ### Claim 43 (depends on 39) The computer readable medium of claim 39, wherein the endpoint comprises a mobile device. ### Claim 44 (depends on 39) The computer readable medium of claim 39, further comprising configuring one or more application running on the endpoint on the endpoint to monitor at least a subset of the plurality of operating conditions. ### Claim 45 (depends on 39) The computer readable medium of claim 39, wherein the conditions comprise at least one hardware condition. ### Claim 46 (depends on 39) The computer readable medium of claim 39, wherein the conditions comprise at least one software condition. ### Claim 47 (depends on 39) The computer readable medium of claim 39, wherein the computing system comprises a plurality of servers. ### Claim 48 (depends on 39) The computer readable medium of claim 39, wherein the plurality of policies includes at least one policy that includes the at least one rule that identifies the action. ### Claim 49 A system for controlling the operation of an endpoint, comprising: a user interface, provided by a computing system remote from the end point, configured to allow configuration of a plurality of policies; a data store, at the computing system, that contains the plurality of policies; one or more software services provided by an operating system on the endpoint configured to monitor a plurality of operating conditions identified in the plurality of policies; and one or more hardware processors at the computing system configured to: receive, across a network, status information about the plurality of operating conditions on the endpoint gathered by the one or more software services, determine a compliance state of the endpoint based on the status information and a plurality of compliance policies in the data store, and initiate, based on the compliance state, an action identified in at least one rule in the data store, wherein the action is carried out by the hardware processor on the endpoint. ### Claim 50 (depends on 49) The system of claim 49, wherein the action comprises controlling access of the endpoint to computing resources. ### Claim 51 (depends on 49) The system of claim 49, wherein the user interface comprises a web page. ### Claim 52 (depends on 49) The system of claim 49, wherein the one or more processors are further configured to request the status information from the endpoint on a periodic basis. ### Claim 53 (depends on 49) The system of claim 49, wherein the endpoint comprises a mobile device. ### Claim 54 (depends on 49) The system of claim 49, further comprising one or more application running on the endpoint configured to monitor a plurality of operating conditions identified in the plurality of policies. ### Claim 55 (depends on 49) The system of claim 49, wherein the conditions comprise at least one hardware condition. ### Claim 56 (depends on 49) The system of claim 49, wherein the conditions comprise at least one software condition. ### Claim 57 (depends on 49) The system of claim 49, wherein the computing system comprises a plurality of servers. ### Claim 58 (depends on 49) The system of claim 49, wherein the plurality of policies includes at least one policy that includes the at least one rule that identifies the action.