US 2022/0103594 A1 · ADJUSTING BEHAVIOR OF AN ENDPOINT SECURITY AGENT BASED ON NETWORK LOCATION

Abstract

Systems and methods for adjusting the behavior of an endpoint security agent based on a network location are provided. According to an embodiment, an agent of an endpoint device detects whether the endpoint has moved to a new network by monitoring for changes to an IP address associated with the endpoint. When the detecting is affirmative, the agent further determines whether a trusted network determination service associated with a cloud-based security service is reachable. When the determining is affirmative, the agent further identifies whether the new network is among a set of trusted networks that have been previously registered with the cloud-based security service by querying the trusted network determination service. When the identifying is affirmative, a particular security feature on the endpoint is configured for operation within a trusted network and when the identifying is negative, the particular security feature is configured for operation outside of a trusted networks.

Claims28

Dependent claims

A method performed within an agent running on an endpoint device by a processing resource of the endpoint device, the method comprising:

detecting whether the endpoint device has been moved to a new network by monitoring for changes to an Internet Protocol (IP) address associated with the endpoint device;
when said detecting is affirmative:
determining whether a trusted network determination service associated with a cloud-based security service is reachable via the new network;
when said determining is affirmative:
identifying whether the new network is among a plurality of trusted networks that have been previously registered with the cloud-based security service by querying the trusted network determination service;
and
when said identifying is affirmative, configuring a particular security feature implemented by the agent for operation inside one of the plurality of trusted networks;
and
when said identifying is negative, configuring the particular security feature for operation outside of the plurality of trusted networks.

6 more elements

An endpoint device comprising:

a processing resource;
and
a non-transitory computer-readable medium, coupled to the processing resource, having stored therein instructions that when executed by the processing resource cause the processing resource to perform a method comprising:
detecting, by an agent running on the endpoint device, whether the endpoint device has been moved to a new network by monitoring for changes to an Internet Protocol (IP) address associated with the endpoint device;
when said detecting is affirmative:
determining, by the agent, whether a trusted network determination service associated with a cloud-based security service is reachable via the new network;
when said determining is affirmative:
identifying, by the agent, whether the new network is among a plurality of trusted networks that have been previously registered with the cloud-based security service by querying the trusted network determination service;
and
when said identifying is affirmative, configuring, by the agent, a particular security feature implemented on the endpoint device for operation inside one of the plurality of trusted networks;
and
when said identifying is negative, configuring the particular security feature for operation outside of the plurality of trusted networks.

9 more elements

Dependencies are inferred from the claim text.

Adjusting behavior of an endpoint security agent based on network location

Life of this patent

Adjusting behavior of an endpoint security agent based on network location

Life of this patent

Abstract

Claims28